From 305a20bc54b76ca89fa055009affc76ccf98d126 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 7 Apr 2022 14:39:56 -0600 Subject: [PATCH] Hunting Changed to hunting, added renamed logic to not use the process_macro Issue #2010 --- detections/deprecated/suspicious_rundll32_rename.yml | 6 +++--- detections/endpoint/detect_html_help_renamed.yml | 6 +++--- detections/endpoint/detect_mshta_renamed.yml | 6 +++--- detections/endpoint/detect_renamed_psexec.yml | 6 +++--- .../suspicious_microsoft_workflow_compiler_rename.yml | 6 +++--- detections/endpoint/suspicious_msbuild_rename.yml | 8 ++++---- 6 files changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/deprecated/suspicious_rundll32_rename.yml b/detections/deprecated/suspicious_rundll32_rename.yml index 410cf8256e..f772449975 100644 --- a/detections/deprecated/suspicious_rundll32_rename.yml +++ b/detections/deprecated/suspicious_rundll32_rename.yml @@ -1,7 +1,7 @@ name: Suspicious Rundll32 Rename id: 7360137f-abad-473e-8189-acbdaa34d114 -version: 4 -date: '2022-02-01' +version: 5 +date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: @@ -13,7 +13,7 @@ description: The following hunting analytic identifies renamed instances of rund name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest + as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=RUNDLL32.exe AND Processes.process_name!=rundll32.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 0a9704fd49..ba7bbab21e 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -1,7 +1,7 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 -version: 3 -date: '2021-09-16' +version: 4 +date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: @@ -18,7 +18,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest + as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=hh.exe AND Processes.original_file_name=HH.EXE by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index f302aeee8a..3bc653c8f0 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -1,7 +1,7 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 2 -date: '2021-09-16' +version: 3 +date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: @@ -12,7 +12,7 @@ description: The following analytic identifies renamed instances of mshta.exe ex binary. Further analysis should be performed to review the executed content and validation it is the real mshta. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_mshta` by Processes.dest + as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=mshta.exe AND Processes.original_file_name=MSHTA.EXE by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 08c657f411..cba97a20e6 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,7 +1,7 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 3 -date: '2021-09-16' +version: 4 +date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: @@ -12,7 +12,7 @@ description: The following analytic identifies renamed instances of `PsExec.exe` During triage, validate this is the legitimate version of `PsExec` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_psexec` by Processes.dest + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!=psexec.exe OR Processes.process_name!=psexec64.exe) AND Processes.original_file_name=psexec.c by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 9fa6a8b73e..777e166849 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -1,7 +1,7 @@ name: Suspicious microsoft workflow compiler rename id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 3 -date: '2021-09-20' +version: 4 +date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: @@ -13,7 +13,7 @@ description: The following analytic identifies a renamed instance of microsoft.w In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler` + as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=microsoft.workflow.compiler.exe AND Processes.original_file_name=Microsoft.Workflow.Compiler.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index 7f283e8b1f..b9f39f58d4 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -1,9 +1,9 @@ name: Suspicious MSBuild Rename id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-12' +version: 3 +date: '2022-04-07' author: Michael Haag, Splunk -type: TTP +type: Hunting datamodel: - Endpoint description: The following analytic identifies renamed instances of msbuild.exe executing. @@ -11,7 +11,7 @@ description: The following analytic identifies renamed instances of msbuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msbuild` by Processes.dest + as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=msbuild.exe AND Processes.original_file_name=MSBuild.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`