Merge pull request #1836 from splunk/ssa_insider_secure_delete

ssa_sdelete

detections/endpoint/ssa___sdelete_application_execution.yml

@@ -0,0 +1,86 @@
+name: Sdelete Application Execution
+id: fcc52b9a-4616-11ec-8454-acde48001122
+version: 1
+date: '2021-11-15'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files 
+  that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
+  meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
+search: '| from read_ssa_enriched_events()
+  | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), 
+  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), 
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), 
+  parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), 
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") 
+  AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %")
+  OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") 
+  OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") 
+  OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") 
+  OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") 
+  OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") 
+  OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") 
+  OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md 
+tags:
+  analytic_story:
+  - Information Sabotage
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest
+  - user
+  - parent_process_name
+  - parent_process
+  - process_name
+  - process
+  - process_id
+  - process_path
+  security_domain: endpoint
+  impact: 60
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Execution 
+  message: sdelete process $process_name$ executed on $dest$ attempting to permanently delete files.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+    

stories/information_sabotage.yml

@@ -0,0 +1,25 @@
+name: Information Sabotage
+id: b71ba595-ef80-4e39-8b66-887578a7a71b
+version: 1
+date: '2021-11-17'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might correlate to insider threat specially in terms of information sabotage.
+narrative: Information sabotage is the type of crime many people associate with insider threat. 
+  Where the current or former employees, contractors, or business partners intentionally exceeded 
+  or misused an authorized level of access to networks, systems, or data with the intention of harming a specific individual, 
+  the organization, or the organization's data, systems, and/or daily business operations.
+references:
+- https://insights.sei.cmu.edu/blog/insider-threat-deep-dive-it-sabotage/
+tags:
+  analytic_story: Information Sabotage
+  category:
+   - Abuse
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Splunk Behavioral Analytics
+  usecase: Security Monitoring
+  

tests/endpoint/ssa___sdelete_application_execution.test.yml

@@ -0,0 +1,10 @@
+name: Sdelete Application Execution Unit Test
+tests:
+  - name: Sdelete Application Execution
+    file: endpoint/ssa___sdelete_application_execution.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for sdelete execution command
+    attack_data:
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+        source: WinEventLog:Security