From 3b479c8af1c4b8f6a86347202bfede80882eef41 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 14 Jun 2021 11:55:13 +0200 Subject: [PATCH 01/26] hpot --- .../powershell_creating_thread_mutex.yml | 44 ++++++++++++++++++ .../powershell_processing_stream_of_data.yml | 44 ++++++++++++++++++ ...wershell_using_memory_as_backing_store.yml | 44 ++++++++++++++++++ .../recon_avproduct_through_pwh_or_wmi.yml | 45 +++++++++++++++++++ .../endpoint/recon_using__wmi_class.yml | 44 ++++++++++++++++++ .../wmi_recon_running_process_or_services.yml | 44 ++++++++++++++++++ .../powershell_creating_thread_mutex.test.yml | 12 +++++ ...ershell_processing_stream_of_data.test.yml | 12 +++++ ...ell_using_memory_as_backing_store.test.yml | 12 +++++ ...econ_avproduct_through_pwh_or_wmi.test.yml | 12 +++++ .../endpoint/recon_using__wmi_class.test.yml | 12 +++++ ...recon_running_process_or_services.test.yml | 12 +++++ 12 files changed, 337 insertions(+) create mode 100644 detections/endpoint/powershell_creating_thread_mutex.yml create mode 100644 detections/endpoint/powershell_processing_stream_of_data.yml create mode 100644 detections/endpoint/powershell_using_memory_as_backing_store.yml create mode 100644 detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml create mode 100644 detections/endpoint/recon_using__wmi_class.yml create mode 100644 detections/endpoint/wmi_recon_running_process_or_services.yml create mode 100644 tests/endpoint/powershell_creating_thread_mutex.test.yml create mode 100644 tests/endpoint/powershell_processing_stream_of_data.test.yml create mode 100644 tests/endpoint/powershell_using_memory_as_backing_store.test.yml create mode 100644 tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml create mode 100644 tests/endpoint/recon_using__wmi_class.test.yml create mode 100644 tests/endpoint/wmi_recon_running_process_or_services.test.yml diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml new file mode 100644 index 0000000000..1db33626b8 --- /dev/null +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -0,0 +1,44 @@ +name: Powershell Creating Thread Mutex +id: 637557ec-ca08-11eb-bd0a-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious powershell script that using mutex function. + This function is commonly seen in some obfuscated powershell script to make sure that only one instance of + there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. +search: '`powershell` EventCode=4104 + | eval mutex = if(match(Message, "Threading.Mutex"),1,0) + | addtotals fieldname=Score mutex + | where mutex= 1 + | stats count min(_time) as firstTime max(_time) as lastTime by Score EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_creating_thread_mutex_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: powershell developer may used this function in their script for instance checking too. +references: +- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Score + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml new file mode 100644 index 0000000000..7dc8e48d0a --- /dev/null +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -0,0 +1,44 @@ +name: Powershell Processing Stream Of Data +id: 0d718b52-c9f1-11eb-bc61-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect suspicious powershell that processing compressed stream data. + This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated + and will be deflated during execution. +search: '`powershell` EventCode=4104 + | eval compress = if(match(Message, "IO.Compression.") OR match(Message, "IO.StreamReader") OR match(Message, "]::Decompress"), 1, 0) + | addtotals fieldname=Score compress + | where compress= 1 + | stats count min(_time) as firstTime max(_time) as lastTime by Score EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_processing_stream_of_data_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: powershell may used this function to process compressed data. +references: +- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9 +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + - Score + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml new file mode 100644 index 0000000000..b91a2e4da5 --- /dev/null +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -0,0 +1,44 @@ +name: Powershell Using memory As Backing Store +id: c396a0c4-c9f2-11eb-b4f5-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect suspicious powershell script that using memory stream as new object backstore. + This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory + to run or drop the actual payload to the compromise machine. +search: '`powershell` EventCode=4104 + | eval mem = if(match(Message,"New-Object IO.MemoryStream"), 1, 0) + | addtotals fieldname=score mem + | where mem = 1 + | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_using_memory_as_backing_store_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: powershell may used this function to store out object into memory. +references: +- https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1140 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + - score + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml new file mode 100644 index 0000000000..64d3696afe --- /dev/null +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -0,0 +1,45 @@ +name: Recon AVProduct Through Pwh or WMI +id: 28077620-c9f6-11eb-8785-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a powershell script that do a recon or checking to the av product install on the machine. + This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. +search: '`powershell` EventCode=4104 + | eval select_cmd = if(match(Message, "SELECT"), 1, 0) + | eval av = if(match(Message, "AntiVirusProduct") OR match(Message,"AntiSpywareProduct"), 1,0) + | addtotals fieldname=score select_cmd, av + | where score = 2 + | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `recon_avproduct_through_pwh_or_wmi_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: network administrator may used this command for checking purposes +references: +- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ +tags: + analytic_story: + - Ransomware + - Malicious PowerShell + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + - score + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/recon_using__wmi_class.yml b/detections/endpoint/recon_using__wmi_class.yml new file mode 100644 index 0000000000..4a2247aca4 --- /dev/null +++ b/detections/endpoint/recon_using__wmi_class.yml @@ -0,0 +1,44 @@ +name: Recon Using WMI Class +id: 018c1972-ca07-11eb-9473-acde48001122 +version: 1 +date: '2021-06-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a powershell script that do a recon to the targetted or compromised machine. + This technique is common nowadays to know the running process, services +search: '`powershell` EventCode=4104 + | eval pwsh = if(match(Message, "SELECT") OR match(Message, "Get-WmiObject"), 1, 0) + | eval recon = if(match(Message, "Win32_Bios") OR match(Message,"Win32_OperatingSystem") OR match(Message,"Win32_Processor") + OR match(Message,"Win32_ComputerSystem") OR match(Message,"Win32_ComputerSystemProduct") OR match(Message,"Win32_ShadowCopy"), 1,0) + | addtotals fieldname=score pwsh, recon + | where score = 2 + | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: network administrator may used this command for checking purposes +references: +- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - score + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml new file mode 100644 index 0000000000..14294a934c --- /dev/null +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -0,0 +1,44 @@ +name: WMI Recon Running Process Or Services +id: b5cd5526-cce7-11eb-b3bd-acde48001122 +version: 1 +date: '2021-06-14' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This seearch is to detect a suspicious powershell/wmi query to recon running process and running services. + This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. +search: '`powershell` EventCode=4104 + | eval select_cmd = if(match(Message, "SELECT"), 1, 0) + | eval av = if(match(Message, "Win32_Service") OR match(Message,"Win32_Process"), 1,0) + | addtotals fieldname=score select_cmd, av + | where score = 2 + | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wmi_recon_running_process_or_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: network administrator may used this command for checking purposes +references: +- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ +tags: + analytic_story: + - Malicious PowerShell + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - score + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/powershell_creating_thread_mutex.test.yml b/tests/endpoint/powershell_creating_thread_mutex.test.yml new file mode 100644 index 0000000000..c82a94f942 --- /dev/null +++ b/tests/endpoint/powershell_creating_thread_mutex.test.yml @@ -0,0 +1,12 @@ +name: Powershell Creating Thread Mutex Unit Test +tests: +- name: Powershell Creating Thread Mutex + file: endpoint/powershell_creating_thread_mutex.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/powershell_processing_stream_of_data.test.yml b/tests/endpoint/powershell_processing_stream_of_data.test.yml new file mode 100644 index 0000000000..e2450f20ba --- /dev/null +++ b/tests/endpoint/powershell_processing_stream_of_data.test.yml @@ -0,0 +1,12 @@ +name: Powershell Processing Stream Of Data Unit Test +tests: +- name: Powershell Processing Stream Of Data + file: endpoint/powershell_processing_stream_of_data.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/powershell_using_memory_as_backing_store.test.yml b/tests/endpoint/powershell_using_memory_as_backing_store.test.yml new file mode 100644 index 0000000000..ca8be846f5 --- /dev/null +++ b/tests/endpoint/powershell_using_memory_as_backing_store.test.yml @@ -0,0 +1,12 @@ +name: Powershell Using memory As Backing Store Unit Test +tests: +- name: Powershell Using memory As Backing Store + file: endpoint/powershell_using_memory_as_backing_store.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml b/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml new file mode 100644 index 0000000000..5a8c2518f7 --- /dev/null +++ b/tests/endpoint/recon_avproduct_through_pwh_or_wmi.test.yml @@ -0,0 +1,12 @@ +name: Recon AVProduct Through Pwh or WMI Unit Test +tests: +- name: Recon AVProduct Through Pwh or WMI + file: endpoint/recon_avproduct_through_pwh_or_wmi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/recon_using__wmi_class.test.yml b/tests/endpoint/recon_using__wmi_class.test.yml new file mode 100644 index 0000000000..7d7aece511 --- /dev/null +++ b/tests/endpoint/recon_using__wmi_class.test.yml @@ -0,0 +1,12 @@ +name: Recon Using WMI Class Unit Test +tests: +- name: Recon Using WMI Class + file: endpoint/recon_using__wmi_class.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/wmi_recon_running_process_or_services.test.yml b/tests/endpoint/wmi_recon_running_process_or_services.test.yml new file mode 100644 index 0000000000..aa512d8ef1 --- /dev/null +++ b/tests/endpoint/wmi_recon_running_process_or_services.test.yml @@ -0,0 +1,12 @@ +name: WMI Recon Running Process Or Services Unit Test +tests: +- name: WMI Recon Running Process Or Services + file: endpoint/wmi_recon_running_process_or_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file From c2ff77befb4f49a817d22830b65902e95176dccb Mon Sep 17 00:00:00 2001 From: root Date: Mon, 14 Jun 2021 10:27:11 +0000 Subject: [PATCH 02/26] Added detection testing service results inPowershell Creating Thread Mutex --- .../powershell_creating_thread_mutex.yml | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 1db33626b8..46d401d5e2 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -6,21 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious powershell script that using mutex function. - This function is commonly seen in some obfuscated powershell script to make sure that only one instance of - there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. -search: '`powershell` EventCode=4104 - | eval mutex = if(match(Message, "Threading.Mutex"),1,0) - | addtotals fieldname=Score mutex - | where mutex= 1 - | stats count min(_time) as firstTime max(_time) as lastTime by Score EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_creating_thread_mutex_filter`' +description: This search is to detect suspicious powershell script that using mutex + function. This function is commonly seen in some obfuscated powershell script to + make sure that only one instance of there process is running to a compromise machine + which is also a good indicator to check why powershell script is using it. +search: '`powershell` EventCode=4104 | eval mutex = if(match(Message, "Threading.Mutex"),1,0) + | addtotals fieldname=Score mutex | where mutex= 1 | stats count min(_time) as firstTime + max(_time) as lastTime by Score EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -known_false_positives: powershell developer may used this function in their script for instance checking too. +known_false_positives: powershell developer may used this function in their script + for instance checking too. references: - https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/ tags: @@ -40,5 +38,8 @@ tags: - EventCode - Message - ComputerName - - User - security_domain: endpoint \ No newline at end of file + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log From aee919474ee0b0487c7beca75152d23708d5ac0a Mon Sep 17 00:00:00 2001 From: root Date: Mon, 14 Jun 2021 10:48:43 +0000 Subject: [PATCH 03/26] Added detection testing service results inPowershell Processing Stream Of Data --- .../powershell_processing_stream_of_data.yml | 27 ++++++++++--------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 7dc8e48d0a..6d04d22a23 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -6,17 +6,15 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect suspicious powershell that processing compressed stream data. - This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated - and will be deflated during execution. -search: '`powershell` EventCode=4104 - | eval compress = if(match(Message, "IO.Compression.") OR match(Message, "IO.StreamReader") OR match(Message, "]::Decompress"), 1, 0) - | addtotals fieldname=Score compress - | where compress= 1 - | stats count min(_time) as firstTime max(_time) as lastTime by Score EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_processing_stream_of_data_filter`' +description: this search is to detect suspicious powershell that processing compressed + stream data. This technique was seen in obfuscated powershell or powershell with + embedded .net or binary files that are stream flated and will be deflated during + execution. +search: '`powershell` EventCode=4104 | eval compress = if(match(Message, "IO.Compression.") + OR match(Message, "IO.StreamReader") OR match(Message, "]::Decompress"), 1, 0) | + addtotals fieldname=Score compress | where compress= 1 | stats count min(_time) + as firstTime max(_time) as lastTime by Score EventCode Message ComputerName User + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -40,5 +38,8 @@ tags: - Message - ComputerName - User - - Score - security_domain: endpoint \ No newline at end of file + - Score + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log From 219a73ae7c31e47ff5424d6b072b17135e2489c4 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 14 Jun 2021 11:40:08 +0000 Subject: [PATCH 04/26] Added detection testing service results inPowershell Using memory As Backing Store --- ...wershell_using_memory_as_backing_store.yml | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index b91a2e4da5..8414abe20c 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -6,21 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect suspicious powershell script that using memory stream as new object backstore. - This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory - to run or drop the actual payload to the compromise machine. -search: '`powershell` EventCode=4104 - | eval mem = if(match(Message,"New-Object IO.MemoryStream"), 1, 0) - | addtotals fieldname=score mem - | where mem = 1 - | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_using_memory_as_backing_store_filter`' +description: this search is to detect suspicious powershell script that using memory + stream as new object backstore. This technique is commonly seen in malicious powershell + contain a stream flate data and will be decompressed in memory to run or drop the + actual payload to the compromise machine. +search: '`powershell` EventCode=4104 | eval mem = if(match(Message,"New-Object IO.MemoryStream"), + 1, 0) | addtotals fieldname=score mem | where mem = 1 | stats count min(_time) as + firstTime max(_time) as lastTime by score EventCode Message ComputerName User | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_using_memory_as_backing_store_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -known_false_positives: powershell may used this function to store out object into memory. +known_false_positives: powershell may used this function to store out object into + memory. references: - https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/ tags: @@ -39,6 +37,9 @@ tags: - EventCode - Message - ComputerName - - User + - User - score - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log From ab69531f6fc1a8f1bd818bd78785f969ed00fdb9 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 14 Jun 2021 12:04:32 +0000 Subject: [PATCH 05/26] Added detection testing service results inRecon AVProduct Through Pwh or WMI --- .../recon_avproduct_through_pwh_or_wmi.yml | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 64d3696afe..059dfe2418 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -6,20 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a powershell script that do a recon or checking to the av product install on the machine. - This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. -search: '`powershell` EventCode=4104 - | eval select_cmd = if(match(Message, "SELECT"), 1, 0) - | eval av = if(match(Message, "AntiVirusProduct") OR match(Message,"AntiSpywareProduct"), 1,0) - | addtotals fieldname=score select_cmd, av - | where score = 2 - | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a powershell script that do a recon or checking + to the av product install on the machine. This technique is commonly seen in APT + or malware like ransomware to list all security product and disable it. +search: '`powershell` EventCode=4104 | eval select_cmd = if(match(Message, "SELECT"), + 1, 0) | eval av = if(match(Message, "AntiVirusProduct") OR match(Message,"AntiSpywareProduct"), + 1,0) | addtotals fieldname=score select_cmd, av | where score = 2 | stats count + min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed - registry to monitor this event. + logs with the powershell logs from your endpoints. make sure you enable needed registry + to monitor this event. known_false_positives: network administrator may used this command for checking purposes references: - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ @@ -41,5 +39,8 @@ tags: - Message - ComputerName - User - - score - security_domain: endpoint \ No newline at end of file + - score + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log From 4d748347be7d0c2d4f7b7c5f42540c2c917ba5b2 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 14 Jun 2021 12:28:21 +0000 Subject: [PATCH 06/26] Added detection testing service results inRecon Using WMI Class --- .../endpoint/recon_using__wmi_class.yml | 31 ++++++++++--------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/recon_using__wmi_class.yml b/detections/endpoint/recon_using__wmi_class.yml index 4a2247aca4..ce456b3438 100644 --- a/detections/endpoint/recon_using__wmi_class.yml +++ b/detections/endpoint/recon_using__wmi_class.yml @@ -6,20 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a powershell script that do a recon to the targetted or compromised machine. - This technique is common nowadays to know the running process, services -search: '`powershell` EventCode=4104 - | eval pwsh = if(match(Message, "SELECT") OR match(Message, "Get-WmiObject"), 1, 0) - | eval recon = if(match(Message, "Win32_Bios") OR match(Message,"Win32_OperatingSystem") OR match(Message,"Win32_Processor") - OR match(Message,"Win32_ComputerSystem") OR match(Message,"Win32_ComputerSystemProduct") OR match(Message,"Win32_ShadowCopy"), 1,0) - | addtotals fieldname=score pwsh, recon - | where score = 2 - | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User - | `security_content_ctime(firstTime)` +description: This search is to detect a powershell script that do a recon to the targetted + or compromised machine. This technique is common nowadays to know the running process, + services +search: '`powershell` EventCode=4104 | eval pwsh = if(match(Message, "SELECT") OR + match(Message, "Get-WmiObject"), 1, 0) | eval recon = if(match(Message, "Win32_Bios") + OR match(Message,"Win32_OperatingSystem") OR match(Message,"Win32_Processor") OR + match(Message,"Win32_ComputerSystem") OR match(Message,"Win32_ComputerSystemProduct") + OR match(Message,"Win32_ShadowCopy"), 1,0) | addtotals fieldname=score pwsh, recon + | where score = 2 | stats count min(_time) as firstTime max(_time) as lastTime by + score EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed - registry to monitor this event. + logs with the powershell logs from your endpoints. make sure you enable needed registry + to monitor this event. known_false_positives: network administrator may used this command for checking purposes references: - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ @@ -40,5 +40,8 @@ tags: - EventCode - Message - ComputerName - - User - security_domain: endpoint \ No newline at end of file + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log From a292fe978967e94e91154f161bdd34abb0d1673b Mon Sep 17 00:00:00 2001 From: root Date: Mon, 14 Jun 2021 13:04:18 +0000 Subject: [PATCH 07/26] Added detection testing service results inWMI Recon Running Process Or Services --- .../wmi_recon_running_process_or_services.yml | 30 ++++++++++--------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index 14294a934c..adb1453850 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -6,20 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This seearch is to detect a suspicious powershell/wmi query to recon running process and running services. - This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. -search: '`powershell` EventCode=4104 - | eval select_cmd = if(match(Message, "SELECT"), 1, 0) - | eval av = if(match(Message, "Win32_Service") OR match(Message,"Win32_Process"), 1,0) - | addtotals fieldname=score select_cmd, av - | where score = 2 - | stats count min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This seearch is to detect a suspicious powershell/wmi query to recon + running process and running services. This technique is commonly seen in malware + and apt attack to mapped all running security application or services on the compromised + machine. +search: '`powershell` EventCode=4104 | eval select_cmd = if(match(Message, "SELECT"), + 1, 0) | eval av = if(match(Message, "Win32_Service") OR match(Message,"Win32_Process"), + 1,0) | addtotals fieldname=score select_cmd, av | where score = 2 | stats count + min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed - registry to monitor this event. + logs with the powershell logs from your endpoints. make sure you enable needed registry + to monitor this event. known_false_positives: network administrator may used this command for checking purposes references: - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ @@ -40,5 +39,8 @@ tags: - EventCode - Message - ComputerName - - User - security_domain: endpoint \ No newline at end of file + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log From bed3227224ac6cc5dfbb91d3cc0705ab2636ad87 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 15 Jun 2021 16:43:23 +0200 Subject: [PATCH 08/26] wild_check --- .../endpoint/powershell_creating_thread_mutex.yml | 10 +++++----- .../powershell_processing_stream_of_data.yml | 10 +++++----- .../powershell_using_memory_as_backing_store.yml | 10 +++++----- .../endpoint/recon_avproduct_through_pwh_or_wmi.yml | 10 ++++------ detections/endpoint/recon_using__wmi_class.yml | 13 +++++-------- .../wmi_recon_running_process_or_services.yml | 10 ++++------ 6 files changed, 28 insertions(+), 35 deletions(-) diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 46d401d5e2..4619e86eae 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -10,10 +10,11 @@ description: This search is to detect suspicious powershell script that using mu function. This function is commonly seen in some obfuscated powershell script to make sure that only one instance of there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. -search: '`powershell` EventCode=4104 | eval mutex = if(match(Message, "Threading.Mutex"),1,0) - | addtotals fieldname=Score mutex | where mutex= 1 | stats count min(_time) as firstTime - max(_time) as lastTime by Score EventCode Message ComputerName User | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' +search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_creating_thread_mutex_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -34,7 +35,6 @@ tags: - Splunk Cloud required_fields: - _time - - Score - EventCode - Message - ComputerName diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 6d04d22a23..6e67204d90 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -10,11 +10,11 @@ description: this search is to detect suspicious powershell that processing comp stream data. This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated and will be deflated during execution. -search: '`powershell` EventCode=4104 | eval compress = if(match(Message, "IO.Compression.") - OR match(Message, "IO.StreamReader") OR match(Message, "]::Decompress"), 1, 0) | - addtotals fieldname=Score compress | where compress= 1 | stats count min(_time) - as firstTime max(_time) as lastTime by Score EventCode Message ComputerName User - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' +search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" OR Message = "*]::Decompress*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_processing_stream_of_data_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 8414abe20c..d58f45ae96 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -10,10 +10,11 @@ description: this search is to detect suspicious powershell script that using me stream as new object backstore. This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory to run or drop the actual payload to the compromise machine. -search: '`powershell` EventCode=4104 | eval mem = if(match(Message,"New-Object IO.MemoryStream"), - 1, 0) | addtotals fieldname=score mem | where mem = 1 | stats count min(_time) as - firstTime max(_time) as lastTime by score EventCode Message ComputerName User | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_using_memory_as_backing_store_filter`' +search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_using_memory_as_backing_store_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -38,7 +39,6 @@ tags: - Message - ComputerName - User - - score security_domain: endpoint automated_detection_testing: passed dataset: diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 059dfe2418..201d522189 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -9,11 +9,10 @@ datamodel: description: This search is to detect a powershell script that do a recon or checking to the av product install on the machine. This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. -search: '`powershell` EventCode=4104 | eval select_cmd = if(match(Message, "SELECT"), - 1, 0) | eval av = if(match(Message, "AntiVirusProduct") OR match(Message,"AntiSpywareProduct"), - 1,0) | addtotals fieldname=score select_cmd, av | where score = 2 | stats count - min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*" OR Message = "*AntiSpywareProduct*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry @@ -39,7 +38,6 @@ tags: - Message - ComputerName - User - - score security_domain: endpoint automated_detection_testing: passed dataset: diff --git a/detections/endpoint/recon_using__wmi_class.yml b/detections/endpoint/recon_using__wmi_class.yml index ce456b3438..a73fd995c3 100644 --- a/detections/endpoint/recon_using__wmi_class.yml +++ b/detections/endpoint/recon_using__wmi_class.yml @@ -9,13 +9,11 @@ datamodel: description: This search is to detect a powershell script that do a recon to the targetted or compromised machine. This technique is common nowadays to know the running process, services -search: '`powershell` EventCode=4104 | eval pwsh = if(match(Message, "SELECT") OR - match(Message, "Get-WmiObject"), 1, 0) | eval recon = if(match(Message, "Win32_Bios") - OR match(Message,"Win32_OperatingSystem") OR match(Message,"Win32_Processor") OR - match(Message,"Win32_ComputerSystem") OR match(Message,"Win32_ComputerSystemProduct") - OR match(Message,"Win32_ShadowCopy"), 1,0) | addtotals fieldname=score pwsh, recon - | where score = 2 | stats count min(_time) as firstTime max(_time) as lastTime by - score EventCode Message ComputerName User | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") + AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" + OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" OR Message= "*Win32_ShadowCopy*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry @@ -36,7 +34,6 @@ tags: - Splunk Cloud required_fields: - _time - - score - EventCode - Message - ComputerName diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index adb1453850..aae0fbe682 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -10,11 +10,10 @@ description: This seearch is to detect a suspicious powershell/wmi query to reco running process and running services. This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. -search: '`powershell` EventCode=4104 | eval select_cmd = if(match(Message, "SELECT"), - 1, 0) | eval av = if(match(Message, "Win32_Service") OR match(Message,"Win32_Process"), - 1,0) | addtotals fieldname=score select_cmd, av | where score = 2 | stats count - min(_time) as firstTime max(_time) as lastTime by score EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" OR Message="*Win32_Service*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry @@ -35,7 +34,6 @@ tags: - Splunk Cloud required_fields: - _time - - score - EventCode - Message - ComputerName From f581f7a93e2b635d767e6eeacbad2d8ce70a6f85 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 15 Jun 2021 15:04:14 +0000 Subject: [PATCH 09/26] Added detection testing service results inPowershell Creating Thread Mutex --- detections/endpoint/powershell_creating_thread_mutex.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 4619e86eae..00657f2276 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -10,11 +10,9 @@ description: This search is to detect suspicious powershell script that using mu function. This function is commonly seen in some obfuscated powershell script to make sure that only one instance of there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. -search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_creating_thread_mutex_filter`' +search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. From c8ad2a742881281f5af8bbbb6fabe69e5a0e7963 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 15 Jun 2021 15:20:44 +0000 Subject: [PATCH 10/26] Added detection testing service results inPowershell Processing Stream Of Data --- .../endpoint/powershell_processing_stream_of_data.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 6e67204d90..8a5d4c1f61 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -10,11 +10,10 @@ description: this search is to detect suspicious powershell that processing comp stream data. This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated and will be deflated during execution. -search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" OR Message = "*]::Decompress*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_processing_stream_of_data_filter`' +search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" + OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. From 9c821aa984115d9185acd03fd75f5b87a1247583 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 15 Jun 2021 15:25:51 +0000 Subject: [PATCH 11/26] Added detection testing service results inPowershell Using memory As Backing Store --- .../endpoint/powershell_using_memory_as_backing_store.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index d58f45ae96..32678956f5 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -10,10 +10,9 @@ description: this search is to detect suspicious powershell script that using me stream as new object backstore. This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory to run or drop the actual payload to the compromise machine. -search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats + count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_using_memory_as_backing_store_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed From 0ca1e7f7081856b8b6496c747df2d0905795bf97 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 15 Jun 2021 15:40:48 +0000 Subject: [PATCH 12/26] Added detection testing service results inRecon AVProduct Through Pwh or WMI --- .../endpoint/recon_avproduct_through_pwh_or_wmi.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 201d522189..843a8a7465 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -9,11 +9,10 @@ datamodel: description: This search is to detect a powershell script that do a recon or checking to the av product install on the machine. This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. -search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*" OR Message = "*AntiSpywareProduct*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `recon_avproduct_through_pwh_or_wmi_filter`' +search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*" + OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. From aa4fc9ddfa854df232ef0cf3e0a150579696b9af Mon Sep 17 00:00:00 2001 From: root Date: Tue, 15 Jun 2021 15:43:44 +0000 Subject: [PATCH 13/26] Added detection testing service results inRecon Using WMI Class --- detections/endpoint/recon_using__wmi_class.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/recon_using__wmi_class.yml b/detections/endpoint/recon_using__wmi_class.yml index a73fd995c3..7d46974ce0 100644 --- a/detections/endpoint/recon_using__wmi_class.yml +++ b/detections/endpoint/recon_using__wmi_class.yml @@ -9,11 +9,11 @@ datamodel: description: This search is to detect a powershell script that do a recon to the targetted or compromised machine. This technique is common nowadays to know the running process, services -search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") - AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" - OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" OR Message= "*Win32_ShadowCopy*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` +search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") + AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" + OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" + OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry From 76023baae1ee03bcfc06c4477977824c65e132fb Mon Sep 17 00:00:00 2001 From: root Date: Tue, 15 Jun 2021 15:50:47 +0000 Subject: [PATCH 14/26] Added detection testing service results inWMI Recon Running Process Or Services --- .../endpoint/wmi_recon_running_process_or_services.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index aae0fbe682..6833b18e0e 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -10,11 +10,10 @@ description: This seearch is to detect a suspicious powershell/wmi query to reco running process and running services. This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. -search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" OR Message="*Win32_Service*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `wmi_recon_running_process_or_services_filter`' +search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" + OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. From ff8878ce3dc7579d85bcd7f58f426a9dcc00687e Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:12:14 +0200 Subject: [PATCH 15/26] Delete disable_logs_using_wevtutil.yml un-intended files to be included in this PR. this file is in rttp PR --- .../endpoint/disable_logs_using_wevtutil.yml | 45 ------------------- 1 file changed, 45 deletions(-) delete mode 100644 detections/endpoint/disable_logs_using_wevtutil.yml diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml deleted file mode 100644 index 3a1db2d2f8..0000000000 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Disable Logs Using WevtUtil -id: 236e7c8e-c9d9-11eb-a824-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: This search is to detect execution of wevtutil.exe to disable logs. - This technique was seen in several ransomware to disable the event logs to evade alerts and detections. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "wevtutil.exe" Processes.process = "*sl*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: network operator may disable audit event logs for debugging purposes. -references: -- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1070.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid - security_domain: endpoint \ No newline at end of file From 878bf692faf07f49802cc4f892f3d68d57dc012f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:13:51 +0200 Subject: [PATCH 16/26] Delete disable_logs_using_wevtutil.test.yml un-intended files. this is already in rttp PR --- tests/endpoint/disable_logs_using_wevtutil.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/disable_logs_using_wevtutil.test.yml diff --git a/tests/endpoint/disable_logs_using_wevtutil.test.yml b/tests/endpoint/disable_logs_using_wevtutil.test.yml deleted file mode 100644 index 620f570137..0000000000 --- a/tests/endpoint/disable_logs_using_wevtutil.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Disable Logs Using WevtUtil Unit Test -tests: -- name: Disable Logs Using WevtUtil - file: endpoint/disable_logs_using_wevtutil.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From c7c2b94d37a13f295fcafeb16092a971d3257f77 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:19:27 +0200 Subject: [PATCH 17/26] Delete allow_operation_with_consent_admin.yml un-intended files. this is already in rttp PR --- .../allow_operation_with_consent_admin.yml | 47 ------------------- 1 file changed, 47 deletions(-) delete mode 100644 detections/endpoint/allow_operation_with_consent_admin.yml diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml deleted file mode 100644 index 605e40bfd0..0000000000 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: Allow Operation with Consent Admin -id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: this search is to detect a potential privilege escalation attempt to do malicious task. - This registry modification is designed to allows the Consent Admin to perform an operation that - requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation - to the compromise machine. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_name = "DWORD (0x00000000)" - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `allow_operation_with_consent_admin_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4 -- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/ -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1548 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest - security_domain: endpoint \ No newline at end of file From e9e5c446f47f5b4e0b27bfb1ab204f8d41f17644 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:19:39 +0200 Subject: [PATCH 18/26] Delete clear_unallocated_sector_using_cipher_app.yml un-intended files. this is already in rttp PR --- ...ar_unallocated_sector_using_cipher_app.yml | 46 ------------------- 1 file changed, 46 deletions(-) delete mode 100644 detections/endpoint/clear_unallocated_sector_using_cipher_app.yml diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml deleted file mode 100644 index 16d2e76559..0000000000 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ /dev/null @@ -1,46 +0,0 @@ -name: Clear Unallocated Sector Using Cipher App -id: cd80a6ac-c9d9-11eb-8839-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. - This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "cipher.exe" Processes.process = "*/w:*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `clear_unallocated_sector_using_cipher_app_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator may execute this app to manage disk -references: -- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1070.004 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid - security_domain: endpoint \ No newline at end of file From 75189e2b1dc4d71b3afb42f549e8b3a9554f7e17 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:19:57 +0200 Subject: [PATCH 19/26] Delete permission_modification_using_takeown_app.yml un-intended files. this is already in rttp PR --- ...mission_modification_using_takeown_app.yml | 46 ------------------- 1 file changed, 46 deletions(-) delete mode 100644 detections/endpoint/permission_modification_using_takeown_app.yml diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml deleted file mode 100644 index bda2dc16a1..0000000000 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ /dev/null @@ -1,46 +0,0 @@ -name: Permission Modification using Takeown App -id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: This search is to detect a modification of file or directory permission using takeown.exe windows app. - This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "takeown.exe" Processes.process = "*/f*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `permission_modification_using_takeown_app_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: takeown.exe is a normal windows application that may used by network operator. -references: -- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1222 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid - security_domain: endpoint \ No newline at end of file From 6a92e68a0801204bd4b3fdd281904e768baa2405 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:20:17 +0200 Subject: [PATCH 20/26] Delete prevent_automatic_repair_mode_using_bcdedit.yml un-intended files. this is already in rttp PR --- ...nt_automatic_repair_mode_using_bcdedit.yml | 45 ------------------- 1 file changed, 45 deletions(-) delete mode 100644 detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml deleted file mode 100644 index 3be63fdfc7..0000000000 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Prevent Automatic Repair Mode using Bcdedit -id: 7742aa92-c9d9-11eb-bbfc-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: This search is to detect a suspicious bcdedit.exe execution to ignore all failures. - This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. -known_false_positives: Administrators may modify the boot configuration ignore failure during testing and debugging. -references: -- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1490 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid - security_domain: endpoint \ No newline at end of file From b198eb9a22e65782304e357ab01155418d047d39 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:20:32 +0200 Subject: [PATCH 21/26] Delete start_up_during_safe_mode_boot.yml un-intended files. this is already in rttp PR --- .../start_up_during_safe_mode_boot.yml | 44 ------------------- 1 file changed, 44 deletions(-) delete mode 100644 detections/endpoint/start_up_during_safe_mode_boot.yml diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml deleted file mode 100644 index 1310b6fb7e..0000000000 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ /dev/null @@ -1,44 +0,0 @@ -name: Start Up During Safe Mode Boot -id: c6149154-c9d8-11eb-9da7-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. - This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `start_up_during_safe_mode_boot_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: updated windows application needed in safe boot may used this registry -references: -- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365 -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1547.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest - security_domain: endpoint \ No newline at end of file From 32defb377a23b153c7f17043b3859c58d744c65d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:20:51 +0200 Subject: [PATCH 22/26] Delete start_up_during_safe_mode_boot.test.yml un-intended files. this is already in rttp PR --- .../endpoint/start_up_during_safe_mode_boot.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/start_up_during_safe_mode_boot.test.yml diff --git a/tests/endpoint/start_up_during_safe_mode_boot.test.yml b/tests/endpoint/start_up_during_safe_mode_boot.test.yml deleted file mode 100644 index 3dfc65e640..0000000000 --- a/tests/endpoint/start_up_during_safe_mode_boot.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Start Up During Safe Mode Boot Unit Test -tests: -- name: Start Up During Safe Mode Boot - file: endpoint/start_up_during_safe_mode_boot.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From 150d8c9f34402ce28ea9eb854a48eb7e1f046448 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:21:05 +0200 Subject: [PATCH 23/26] Delete prevent_automatic_repair_mode_using_bcdedit.test.yml un-intended files. this is already in rttp PR --- ...vent_automatic_repair_mode_using_bcdedit.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/prevent_automatic_repair_mode_using_bcdedit.test.yml diff --git a/tests/endpoint/prevent_automatic_repair_mode_using_bcdedit.test.yml b/tests/endpoint/prevent_automatic_repair_mode_using_bcdedit.test.yml deleted file mode 100644 index 67a2dbc45e..0000000000 --- a/tests/endpoint/prevent_automatic_repair_mode_using_bcdedit.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Prevent Automatic Repair Mode using Bcdedit Unit Test -tests: -- name: Prevent Automatic Repair Mode using Bcdedit - file: endpoint/prevent_automatic_repair_mode_using_bcdedit.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From de20af3ac5eb7e79f57ddb8051250426c7e50f69 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:21:28 +0200 Subject: [PATCH 24/26] Delete permission_modification_using_takeown_app.test.yml un-intended files. this is already in rttp PR --- ...ermission_modification_using_takeown_app.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/permission_modification_using_takeown_app.test.yml diff --git a/tests/endpoint/permission_modification_using_takeown_app.test.yml b/tests/endpoint/permission_modification_using_takeown_app.test.yml deleted file mode 100644 index 083284797e..0000000000 --- a/tests/endpoint/permission_modification_using_takeown_app.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Permission Modification using Takeown App Unit Test -tests: -- name: Permission Modification using Takeown App - file: endpoint/permission_modification_using_takeown_app.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From 9a25b289c3dd759405185159f132d60dcdcaf6cc Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:21:41 +0200 Subject: [PATCH 25/26] Delete clear_unallocated_sector_using_cipher_app.test.yml un-intended files. this is already in rttp PR --- ...lear_unallocated_sector_using_cipher_app.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/clear_unallocated_sector_using_cipher_app.test.yml diff --git a/tests/endpoint/clear_unallocated_sector_using_cipher_app.test.yml b/tests/endpoint/clear_unallocated_sector_using_cipher_app.test.yml deleted file mode 100644 index 6d6992618e..0000000000 --- a/tests/endpoint/clear_unallocated_sector_using_cipher_app.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Clear Unallocated Sector Using Cipher App Unit Test -tests: -- name: Clear Unallocated Sector Using Cipher App - file: endpoint/clear_unallocated_sector_using_cipher_app.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From a1b27f125f9c709d6e26e952c35ff140304cf2d9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 16 Jun 2021 10:22:00 +0200 Subject: [PATCH 26/26] Delete allow_operation_with_consent_admin.test.yml un-intended files. this is already in rttp PR --- .../allow_operation_with_consent_admin.test.yml | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 tests/endpoint/allow_operation_with_consent_admin.test.yml diff --git a/tests/endpoint/allow_operation_with_consent_admin.test.yml b/tests/endpoint/allow_operation_with_consent_admin.test.yml deleted file mode 100644 index d797fdc9d3..0000000000 --- a/tests/endpoint/allow_operation_with_consent_admin.test.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: Allow Operation with Consent Admin Unit Test -tests: -- name: Allow Operation with Consent Admin - file: endpoint/allow_operation_with_consent_admin.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - - - \ No newline at end of file