diff --git a/.gitignore b/.gitignore index 26dc097f54..0e3d724591 100644 --- a/.gitignore +++ b/.gitignore @@ -4,6 +4,9 @@ detections/*/.yml.example stories/*.yml.example tests/*/*.yml.example +# IDE +.vscode/ + # usual mac files .DS_Store #vim files diff --git a/bin/generate.py b/bin/generate.py index 3c2763e8e1..a4eecd7da6 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -124,11 +124,17 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen detection['risk_score'] = detection['tags']['risk_score'] if 'product' in detection['tags']: detection['product'] = detection['tags']['product'] + if (OUTPUT_PATH) == 'dist/mustang': + detection['disabled'] = 'false' + + for baseline in baselines: data_model = parse_data_models_from_search(baseline['search']) if data_model: baseline['data_model'] = data_model + if (OUTPUT_PATH) == 'dist/mustang': + baseline['disabled'] = 'false' matched_deployment = get_deployments(baseline, deployments) baseline['deployment'] = matched_deployment diff --git a/bin/jinja2_templates/analytic_stories.j2 b/bin/jinja2_templates/analytic_stories.j2 index eac6ee050f..ba45f92e02 100644 --- a/bin/jinja2_templates/analytic_stories.j2 +++ b/bin/jinja2_templates/analytic_stories.j2 @@ -39,6 +39,7 @@ description = {{ story.description }} {% if story.narrative is defined %} narrative = {{ story.narrative }} {% endif %} +product = {{ story.tags.product}} {% endfor %} #### END STORIES #### diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 351c73851d..55bfce0eb6 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -82,7 +82,11 @@ action.email.useNSSubject = 1 {% endif %} {% endif %} alert.digest_mode = 1 +{% if detection.disabled is defined %} +disabled = false +{% else %} disabled = true +{% endif %} enableSched = 1 counttype = number of events relation = greater than @@ -134,7 +138,11 @@ action.escu.how_to_implement = {{ baseline.how_to_implement }} {% else %} action.escu.how_to_implement = none {% endif %} +{% if baseline.disabled is defined %} +disabled = false +{% else %} disabled = true +{% endif %} is_visible = false search = {{ baseline.search }} diff --git a/bin/ssa-end-to-end-testing/requirements.txt b/bin/ssa-end-to-end-testing/requirements.txt index 0a8d577caa..df929bb9d2 100644 --- a/bin/ssa-end-to-end-testing/requirements.txt +++ b/bin/ssa-end-to-end-testing/requirements.txt @@ -20,4 +20,4 @@ six==1.15.0 smmap==3.0.5 toml==0.10.2 u-msgpack-python==2.7.1 -urllib3==1.26.3 +urllib3==1.26.4 diff --git a/bin/validate.py b/bin/validate.py index aebb7fe608..d0da8ab741 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -47,10 +47,10 @@ def validate_schema(REPO_PATH, type, objects, verbose): print("Error reading {0}".format(manifest_file)) error = True continue - try: - jsonschema.validate(instance=object, schema=schema) - except jsonschema.exceptions.ValidationError as json_ve: - errors.append("ERROR: {0} at:\n\t{1}".format(json.dumps(json_ve.message), manifest_file)) + + validator = jsonschema.Draft7Validator(schema, format_checker=jsonschema.FormatChecker()) + for schema_error in validator.iter_errors(object): + errors.append("ERROR: {0} at:\n\t{1}".format(json.dumps(schema_error.message), manifest_file)) error = True if type in objects: @@ -70,7 +70,7 @@ def validate_objects(REPO_PATH, objects, verbose): errors = [] for lookup in objects['lookups']: - lookup_errors = validate_lookups_content(REPO_PATH, "lookups/%s", lookup) + errors = errors + validate_lookups_content(REPO_PATH, "lookups/%s", lookup) objects_array = objects['stories'] + objects['detections'] + objects['baselines'] + objects['response_tasks'] + objects['responses'] for object in objects_array: @@ -85,12 +85,9 @@ def validate_objects(REPO_PATH, objects, verbose): for object in objects['baselines']: errors = errors + validate_baseline_search(object, objects['macros']) - for object in objects['tests']: errors = errors + validate_tests(REPO_PATH, object) - errors = lookup_errors + errors - return errors diff --git a/contentctl.py b/contentctl.py index 736bf605a0..117e17c329 100644 --- a/contentctl.py +++ b/contentctl.py @@ -109,8 +109,8 @@ def main(args): # generate arguments generate_parser.add_argument("-f", "--format", required=False, type=str, default="splunk_app", help="Format of our deployment package, defaults to `splunk_app`.\n The deployment `splunk_app` runs on product Splunk Enterprise Security and Splunk Enterprise.") - generate_parser.add_argument("-o", "--output", required=False, type=str, default="package", - help="Path where to store the deployment package, defaults to `package`") + generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu", + help="Path where to store the deployment package, defaults to `dist/escu`") generate_parser.add_argument("--product", required=False, type=str, default="ESCU", help="Type of package to create, choose between `ESCU`, or `MUSTANG`. Defaults to `ESCU`") generate_parser.set_defaults(func=generate) diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml new file mode 100644 index 0000000000..3f31a7ffa2 --- /dev/null +++ b/detections/endpoint/disable_registry_tool.yml @@ -0,0 +1,49 @@ +name: Disable Registry Tool +id: cd2cf33c-9201-11eb-a10a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies modification of registry to disable the + regedit or registry tools of windows operating system. Since registry tool is a + swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this + application to prevent the removal of their registry entry such as persistence, + file less components and defense evasion. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml new file mode 100644 index 0000000000..036ea045f8 --- /dev/null +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -0,0 +1,52 @@ +name: Disable Show Hidden Files +id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search is to idetifies a modification in registry to prevent + the user seeing all the files with hidden attributes. This event or techniques are + known on some worm and trojan spy malware that will drop hidden files on the infected + machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" + OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" + Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= + "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" + Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1564.001 + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_nam + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml new file mode 100644 index 0000000000..7c5ab7d25e --- /dev/null +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -0,0 +1,51 @@ +name: Disable Windows Behavior Monitoring +id: 79439cae-9200-11eb-a4d3-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies a modification in registry to disable the + windows denfender real time behavior monitoring. This event or technique is commonly + seen in RAT, bot, or Trojan to disable AV to evade detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows + Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= + "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" + OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time + Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml new file mode 100644 index 0000000000..b127627da0 --- /dev/null +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -0,0 +1,49 @@ +name: Disable Windows SmartScreen Protection +id: 664f0fd0-91ff-11eb-a56f-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search identifies a modification of registry to disable + the smartscreen protection of windows machine. This is windows feature provide an + early warning system against website that might engage in phishing attack or malware + distribution. This modification are seen in RAT malware to cover their tracks upon + downloading other of its component or other payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name + = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_nam + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml new file mode 100644 index 0000000000..60d544c9bb --- /dev/null +++ b/detections/endpoint/disabling_cmd_application.yml @@ -0,0 +1,48 @@ +name: Disabling CMD Application +id: ff86077c-9212-11eb-a1e6-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify modification in registry to disable cmd prompt + application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging + or deleting there samples through cmd application which is one of the tool of analyst + to traverse on directory and files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml new file mode 100644 index 0000000000..f4c03a35b8 --- /dev/null +++ b/detections/endpoint/disabling_controlpanel.yml @@ -0,0 +1,47 @@ +name: Disabling ControlPanel +id: 6ae0148e-9215-11eb-a94a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify registry modification to disable control panel + window. This technique is commonly seen in malware to prevent their artifacts , + persistence removed on the infected machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml new file mode 100644 index 0000000000..03fff72233 --- /dev/null +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -0,0 +1,52 @@ +name: Disabling Firewall with Netsh +id: 6860a62c-9203-11eb-9e05-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies suspicious firewall disabling using netsh + application. this technique is commonly seen in malware that tries to communicate + or download its component or other payload to its C2 server. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe + Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= + "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`' +how_to_implement: You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint file-system data model node. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: admin may disable firewall during testing or fixing network + problem. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml new file mode 100644 index 0000000000..59adce28fc --- /dev/null +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -0,0 +1,49 @@ +name: Disabling FolderOptions Windows Feature +id: 83776de4-921a-11eb-868a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identify registry modification to disable folder options + feature of windows to show hidden files, file extension and etc. This technique + used by malware in combination if disabling show hidden files feature to hide their + files and also to hide the file extension to lure the user base on file icons or + fake file extensions. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml new file mode 100644 index 0000000000..e77ffbd10c --- /dev/null +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -0,0 +1,50 @@ +name: Disabling NoRun Windows App +id: de81bc46-9213-11eb-adc9-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identify modification of registry to disable run application + in window start menu. this application is known to be a helpful shortcut to windows + OS user to run known application and also to execute some reg or batch script. This + technique is used malware to make cleaning of its infection more harder by preventing + known application run easily through run shortcut. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.malwarebytes.com/detections/pum-optional-norun/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml new file mode 100644 index 0000000000..f0ed94188f --- /dev/null +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -0,0 +1,50 @@ +name: Disabling SystemRestore In Registry +id: f4f837e2-91fb-11eb-8bf6-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search identifies the modification of registry related + in disabling the system restore of a machine. This event or behavior are seen in + some RAT malware to make the restore of the infected machine difficult and keep + their infection on the box. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = + "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: in some cases admin can disable systemrestore on a machine. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml new file mode 100644 index 0000000000..f1ce08549d --- /dev/null +++ b/detections/endpoint/disabling_task_manager.yml @@ -0,0 +1,49 @@ +name: Disabling Task Manager +id: dac279bc-9202-11eb-b7fb-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies modification of registry to disable the + task manager of windows operating system. this event or technique are commonly seen + in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate + their process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/dist/escu/appserver/static/alert_escu_contextualize.png b/dist/escu/appserver/static/alert_escu_contextualize.png new file mode 100644 index 0000000000..23c161b5c2 Binary files /dev/null and b/dist/escu/appserver/static/alert_escu_contextualize.png differ diff --git a/dist/escu/appserver/static/alert_escu_investigate.png b/dist/escu/appserver/static/alert_escu_investigate.png new file mode 100644 index 0000000000..23c161b5c2 Binary files /dev/null and b/dist/escu/appserver/static/alert_escu_investigate.png differ diff --git a/dist/escu/appserver/static/alerticon.png b/dist/escu/appserver/static/alerticon.png new file mode 100644 index 0000000000..c7f9d26890 Binary files /dev/null and b/dist/escu/appserver/static/alerticon.png differ diff --git a/dist/escu/appserver/static/analytic_story_details.css b/dist/escu/appserver/static/analytic_story_details.css new file mode 100644 index 0000000000..ce54b7882b --- /dev/null +++ b/dist/escu/appserver/static/analytic_story_details.css @@ -0,0 +1,187 @@ +/* .rTable { + display: table; + width: 100%; +} + +.rTableRow { + display: table-row; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; +} + +.rTableCell, .rTableHead { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; +} + +.rTableLeftCell { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; + width: 200px; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; + font-weight: bold; +} + +.rTableFoot { + display: table-footer-group; + font-weight: bold; + background-color: #ddd; +} + +.rTableBody { + display: table-row-group; +} */ + +h1 { + font-size: 24px; + font-weight: 200; + margin: 0; +} + +h3 { + padding-left: 10px; +} + +.as_title_attr_bar { + padding-left: 15%; + background-color: #eee; + height: 40px; + line-height: 40px; + margin-bottom: 7px; +} + +.as_title_attr { + float: left; + margin-right: 5%; + padding-right: 20px; + font-size: 14px; +} + +.as_search_accordion { + width: 100%; + margin-top: 10px; +} + +.as_story_details { + display: flex; + max-height: 500px; + clear: both; +} + +.as_story_details_left_col { + float: right; + width: 34%; + display: block; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_story_details_right_col { + float: left; + width: 60%; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_left_attr{ + display: inline-block; + width: 100%; +} + +.as_story_detail_left_attr_label { + float: left; + width: 30%; + padding-top: 2%; +} + +.as_story_detail_left_attr { + margin-top: 5px; + float: left; + width: 70%; +} + +.value_label { + float: left; + margin-right: 5px; + background-color: #eee; + padding: 4px; + border-radius: 6px; + margin-bottom: 5px; +} + +.as_story_detail_right_attr_label { + margin-bottom: 7px; +} + +.search_content { + display: flex; + clear: both; +} + +.search_left_panel { + float: left; + width: 70%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_right_panel { + float: left; + width: 25%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_left_attr { + margin: 10px; +} + +.search_right_attr { + margin: 10px; + display: table; +} + +.search_string{ + padding: 10px; + background-color: #ddd; + border: 1px solid #aaa; + border-radius: 2px; +} + +.data_model_tag { + background-color: #11a88b; +} + +.kill_chain_tag { + background-color: #ed8440; + color: #303841; +} + +.attack_tag { + background-color: #3863a0; + color: #eee; +} + +.heading-story { + width: 80%; + float: left; +} + +.run_story_btn { + float: right; +} \ No newline at end of file diff --git a/dist/escu/appserver/static/analytic_story_details.js b/dist/escu/appserver/static/analytic_story_details.js new file mode 100644 index 0000000000..932b4426f0 --- /dev/null +++ b/dist/escu/appserver/static/analytic_story_details.js @@ -0,0 +1,575 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/searchmanager', + 'splunkjs/mvc/searchbarview', + 'splunkjs/mvc/tableview', + 'splunk.util', + '../app/DA-ESS-ContentUpdate/js/lib/showdown.min', + '../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui', + 'css!../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui.css', + 'css!../app/DA-ESS-ContentUpdate/analytic_story_details.css', + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, mvc, SearchManager, SearchBarView, TableView, splunkUtil, showdown) { + + let tokenModel = mvc.Components.get("default"); + let renderedComponents = []; + + let templ = ` +
+