WhisperGateIsOpen

detections/endpoint/powershell_windows_defender_exclusion_commands.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Remcos
   - Windows Defense Evasion Tactics
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/suspicious_process_file_path.yml

@@ -18,9 +18,11 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*"
   OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path
   = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path
-  = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" by Processes.parent_process_name
-  Processes.parent_process Processes.process_path Processes.dest Processes.user |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" 
+  by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
   | `suspicious_process_file_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -33,6 +35,7 @@ tags:
   analytic_story:
   - XMRig
   - Remcos
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/windows_defender_exclusion_registry_entry.yml

@@ -12,11 +12,17 @@ description: This analytic will detect a suspicious process that modify a regist
   excluding folder path, file path, process, extensions and etc. from its real time
   or schedule scan to execute their malicious code. This is a good indicator for a
   defense evasion and to look further for events after this behavior.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows
-  Defender\\Exclusions\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `windows_defender_exclusion_registry_entry_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `windows_defender_exclusion_registry_entry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

stories/whispergate.yml

@@ -0,0 +1,24 @@
+name: WhisperGate
+id: 0150e6e5-3171-442e-83f8-1ccd8599569b
+version: 1
+date: '2022-01-19'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Destructive malware targeting Ukrainian organizations also known as the "whispergate". This analytic 
+  story looks for suspicious process execution, commandlines, downloads, dns query and many more.
+narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting 
+  multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, 
+  overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques.
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
+tags:
+  analytic_story: WhisperGate
+  category:
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection