Merge pull request #2853 from splunk/njrat2

njrat2

detections/endpoint/disable_registry_tool.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 100
   impact: 40

detections/endpoint/disabling_cmd_application.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/disabling_task_manager.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 60
   impact: 70

detections/endpoint/windows_abused_web_services.yml

@@ -0,0 +1,67 @@
+name: Windows Abused Web Services
+id: 01f0aef4-8591-4daa-a53d-0ed49823b681
+version: 1
+date: '2023-09-20'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 22
+description: This analytic detects a suspicious process making a DNS query via known,
+  abused text-paste web services, VoIP, internet via secure tunneling,instant messaging, and digital distribution
+  platforms used to download external files. This technique is abused by adversaries,
+  malware actors, and red teams to download a malicious file on the target host. This
+  is a good TTP indicator for possible initial access techniques. A user will experience
+  false positives if the following instant messaging is allowed or common applications
+  like telegram or discord are allowed in the corporate network.
+search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*",""*textbin*"", "*ngrok.io*", "*discord*", "*duckdns.org*", "*pasteio.com*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_abused_web_services_filter`'
+how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query.
+  We suggest you run this detection at least once a day over the last 14 days.
+known_false_positives: Noise and false positive can be seen if the following instant
+  messaging is allowed to use within corporate network. In this case, a filter is
+  needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: a network connection on known abused web services from $dest$
+  mitre_attack_id:
+  - T1102
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 36
+  required_fields:
+  - _time
+  - Image
+  - QueryName
+  - QueryStatus
+  - process_name
+  - QueryResults
+  - Computer
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_admin_permission_discovery.yml

@@ -0,0 +1,74 @@
+name: Windows Admin Permission Discovery
+id: e08620cb-9488-4052-832d-97bcc0afd414
+version: 1
+date: '2023-09-19'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 11
+description: This analytic is developed to identify suspicious file creation in the root drive (C:\). 
+  This tactic was observed in NjRAT as a means to ascertain whether its malware instance running on 
+  the compromised host possesses administrative privileges.
+  The methodology involves an attempt to create a 'win.dat' file in the C:\ directory. 
+  If this file is successfully created, it serves as an indicator that the process indeed holds administrative privileges.
+  This anomaly detection mechanism serves as a valuable pivot point for detecting NjRAT and other malware strains employing 
+  similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets.
+search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem 
+  where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") 
+  by Filesystem.dest Filesystem.file_create_time Filesystem.process_id Filesystem.process_guiid Filesystem.file_name Filesystem.file_path Filesystem.user 
+  | `drop_dm_object_name(Filesystem)` 
+  | eval dropped_file_path = split(file_path, "\\") 
+  | eval dropped_file_path_split_count = mvcount(dropped_file_path) 
+  | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2  
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_admin_permission_discovery_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that 
+  include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: administrator is capable of dropping files in root C drive.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A file was created in root drive C:/ on host - $dest$
+  mitre_attack_id:
+  - T1069.001
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_id
+    type: Process
+    role:
+    - Attacker
+  - name: file_name
+    type: File Name
+    role:
+    - Other
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

detections/endpoint/windows_delete_or_modify_system_firewall.yml

@@ -0,0 +1,69 @@
+name: Windows Delete or Modify System Firewall
+id: b188d11a-eba7-419d-b8b6-cc265b4f2c4f
+version: 1
+date: '2023-09-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon Event ID 1
+description: This analytic identifies potentially malicious 'netsh' processes that manipulate firewall configurations. 
+  This behavior has been observed in the NJRAT malware, which deletes its added firewall rules as part of its cleanup process. 
+  Leveraging this anomaly detection can be a valuable approach for detecting malware, such as NJRAT, 
+  that makes alterations to firewall configurations as a component of its malicious activities.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where `process_netsh` Processes.process = "* firewall *" Processes.process = "* delete *"
+  by Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_delete_or_modify_system_firewall_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Administrator may modify or delete firewall configuration.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A $process_name$ deleted a firewall configuration on $dest$
+  mitre_attack_id:
+  - T1562
+  - T1562.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 36
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml

@@ -0,0 +1,78 @@
+name: Windows Disable or Modify Tools Via Taskkill
+id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0
+version: 1
+date: '2023-09-13'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon Event ID 1
+description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe.
+  This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate
+  other processes whether they be security products or other legitimate applications as part of their malicious activities. 
+  Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*")
+  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid  Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_disable_or_modify_tools_via_taskkill_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Network administrator can use this application to kill process during audit or investigation.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A taskkill process to terminate process is executed on host- $dest$
+  mitre_attack_id:
+  - T1562
+  - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 36
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill/taskkill_im.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_executable_in_loaded_modules.yml

@@ -0,0 +1,65 @@
+name: Windows Executable in Loaded Modules
+id: 3e27af56-fcf0-4113-988d-24969b062be7
+version: 1
+date: '2023-09-12'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 7
+description: This analytic identifies potentially malicious 'ImageLoaded' events, particularly when they involve executable files. 
+  This behavior was observed in NjRAT instances, where, during each instance of loading a module from its C2 server onto the compromised host, 
+  Sysmon recorded the path of the actual Image or Process as an 'ImageLoaded' event, rather than the typical tracking of dynamically loaded DLL modules in memory.
+  This event holds significance because it tracks processes that load modules and libraries, which are typically in the .dll format rather than .exe. 
+  Leveraging this 'Time-To-Perform' (TTP) detection method can prove invaluable for the identification of NjRAT malware or 
+  other malicious software instances that introduce executable files as modules within a targeted host.
+search: '`sysmon` EventCode=7 ImageLoaded= *.exe
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH 
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_executable_in_loaded_modules_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. 
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown.
+references:
+  - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: An executable $Imageloaded$ loaded by $Image$ on $dest$
+  mitre_attack_id:
+  - T1129
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 64
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded 
+  - Signed 
+  - SignatureStatus 
+  - OriginalFileName 
+  - process_name 
+  - Computer 
+  - EventCode 
+  - ProcessId 
+  - Hashes 
+  - IMPHASH 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_fileless_storage_via_registry.yml

@@ -0,0 +1,66 @@
+name: Windows Njrat Fileless Storage via Registry
+id: a5fffbbd-271f-4980-94ed-4fbf17f0af1c
+version: 1
+date: '2023-09-14'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
+description: The following analytic identifies a suspicious registry modification associated with NjRat, 
+  a telltale sign of its fileless technique. NjRat employs this method to manage its keylogs and execute downloaded DLL module plugins discreetly on the compromised host. 
+  This approach is particularly effective at evading conventional file-based detection systems, as it stores indicators of compromise (IOCs) in the registry. 
+  Leveraging this TTP (Tactics, Techniques, and Procedures) detection can significantly enhance the identification of NjRAT infections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\[kl]" OR  Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*")
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name Registry.registry_value_name
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_njrat_fileless_storage_via_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: unknown
+references:
+  - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: a suspicious registry entry related to NjRAT keylloging registry in $dest$
+  mitre_attack_id:
+  - T1027.011
+  - T1027
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 100
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.011/njrat_fileless_registry_entry/njrat_registry.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml

@@ -0,0 +1,67 @@
+name: Windows Modify Registry With MD5 Reg Key Name
+id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8
+version: 1
+date: '2023-09-25'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
+description: This analytic is designed to identify potentially malicious registry modification characterized by MD5-like registry key names. 
+  This technique has been notably observed in NjRAT malware, which employs such registries for fileless storage of keylogs and .DLL plugins. 
+  Detecting this tactic serves as an effective means of identifying possible NjRAT malware instances that create or modify registries as 
+  part of their malicious activities.
+search: '| tstats `security_content_summariesonly`  count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where  Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data"
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | eval dropped_reg_path = split(registry_path, "\\") 
+  | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) 
+  | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5")
+  | where validation_result = "md5" AND dropped_reg_path_split_count <= 5
+  | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_with_md5_reg_key_name_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that 
+  include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: unknown
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A md5 registry value name $registry_value_name$ is created on $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 36
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_time_based_evasion.yml

@@ -0,0 +1,69 @@
+name: Windows Time Based Evasion
+id: 34502357-deb1-499a-8261-ffe144abf561
+version: 1
+date: '2023-09-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 1
+description: This analytic is designed to detect potentially malicious processes that initiate a ping delay using an invalid IP address. 
+  This evasion technique was observed in NJRAT, where the malware employed ping commands as a means to introduce a time delay before self-deletion on the compromised host. 
+  Identifying this (TTP) behavior can serve as a valuable indicator for detecting NJRAT infections or other malware that employ time delays as 
+  evasion tactics.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name = "ping.exe" Processes.parent_process = "* ping 0 -n *" OR Processes.process = "* ping 0 -n *"
+  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_time_based_evasion_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: unknown
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: A $process_name$ did a suspicious ping to invalid IP address on $dest$
+  mitre_attack_id:
+  - T1497
+  - T1497.003
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 36
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml

@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Chaos Ransomware
+  - NjRAT
   asset_type: Endpoint
   confidence: 80
   impact: 80