diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 92db5125fe..64d5484233 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 100 impact: 40 diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 817240a760..f76ee91f89 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 82c83ff3ff..c54d46907b 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index f1fca5a4c6..19e51f98d7 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 60 impact: 70 diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/endpoint/windows_abused_web_services.yml new file mode 100644 index 0000000000..e3578a6827 --- /dev/null +++ b/detections/endpoint/windows_abused_web_services.yml @@ -0,0 +1,67 @@ +name: Windows Abused Web Services +id: 01f0aef4-8591-4daa-a53d-0ed49823b681 +version: 1 +date: '2023-09-20' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 22 +description: This analytic detects a suspicious process making a DNS query via known, + abused text-paste web services, VoIP, internet via secure tunneling,instant messaging, and digital distribution + platforms used to download external files. This technique is abused by adversaries, + malware actors, and red teams to download a malicious file on the target host. This + is a good TTP indicator for possible initial access techniques. A user will experience + false positives if the following instant messaging is allowed or common applications + like telegram or discord are allowed in the corporate network. +search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*",""*textbin*"", "*ngrok.io*", "*discord*", "*duckdns.org*", "*pasteio.com*") + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_abused_web_services_filter`' +how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. + We suggest you run this detection at least once a day over the last 14 days. +known_false_positives: Noise and false positive can be seen if the following instant + messaging is allowed to use within corporate network. In this case, a filter is + needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a network connection on known abused web services from $dest$ + mitre_attack_id: + - T1102 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults + - Computer + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml new file mode 100644 index 0000000000..c333138174 --- /dev/null +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -0,0 +1,74 @@ +name: Windows Admin Permission Discovery +id: e08620cb-9488-4052-832d-97bcc0afd414 +version: 1 +date: '2023-09-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 11 +description: This analytic is developed to identify suspicious file creation in the root drive (C:\). + This tactic was observed in NjRAT as a means to ascertain whether its malware instance running on + the compromised host possesses administrative privileges. + The methodology involves an attempt to create a 'win.dat' file in the C:\ directory. + If this file is successfully created, it serves as an indicator that the process indeed holds administrative privileges. + This anomaly detection mechanism serves as a valuable pivot point for detecting NjRAT and other malware strains employing + similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") + by Filesystem.dest Filesystem.file_create_time Filesystem.process_id Filesystem.process_guiid Filesystem.file_name Filesystem.file_path Filesystem.user + | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") + | eval dropped_file_path_split_count = mvcount(dropped_file_path) + | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_admin_permission_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that + include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: administrator is capable of dropping files in root C drive. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A file was created in root drive C:/ on host - $dest$ + mitre_attack_id: + - T1069.001 + observable: + - name: user + type: User + role: + - Victim + - name: process_id + type: Process + role: + - Attacker + - name: file_name + type: File Name + role: + - Other + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml new file mode 100644 index 0000000000..5b81bcb763 --- /dev/null +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -0,0 +1,69 @@ +name: Windows Delete or Modify System Firewall +id: b188d11a-eba7-419d-b8b6-cc265b4f2c4f +version: 1 +date: '2023-09-08' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon Event ID 1 +description: This analytic identifies potentially malicious 'netsh' processes that manipulate firewall configurations. + This behavior has been observed in the NJRAT malware, which deletes its added firewall rules as part of its cleanup process. + Leveraging this anomaly detection can be a valuable approach for detecting malware, such as NJRAT, + that makes alterations to firewall configurations as a component of its malicious activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_netsh` Processes.process = "* firewall *" Processes.process = "* delete *" + by Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_delete_or_modify_system_firewall_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrator may modify or delete firewall configuration. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A $process_name$ deleted a firewall configuration on $dest$ + mitre_attack_id: + - T1562 + - T1562.004 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml new file mode 100644 index 0000000000..593aba2a37 --- /dev/null +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -0,0 +1,78 @@ +name: Windows Disable or Modify Tools Via Taskkill +id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 +version: 1 +date: '2023-09-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon Event ID 1 +description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe. + This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate + other processes whether they be security products or other legitimate applications as part of their malicious activities. + Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_or_modify_tools_via_taskkill_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Network administrator can use this application to kill process during audit or investigation. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A taskkill process to terminate process is executed on host- $dest$ + mitre_attack_id: + - T1562 + - T1562.001 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill/taskkill_im.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_executable_in_loaded_modules.yml b/detections/endpoint/windows_executable_in_loaded_modules.yml new file mode 100644 index 0000000000..092578b463 --- /dev/null +++ b/detections/endpoint/windows_executable_in_loaded_modules.yml @@ -0,0 +1,65 @@ +name: Windows Executable in Loaded Modules +id: 3e27af56-fcf0-4113-988d-24969b062be7 +version: 1 +date: '2023-09-12' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 7 +description: This analytic identifies potentially malicious 'ImageLoaded' events, particularly when they involve executable files. + This behavior was observed in NjRAT instances, where, during each instance of loading a module from its C2 server onto the compromised host, + Sysmon recorded the path of the actual Image or Process as an 'ImageLoaded' event, rather than the typical tracking of dynamically loaded DLL modules in memory. + This event holds significance because it tracks processes that load modules and libraries, which are typically in the .dll format rather than .exe. + Leveraging this 'Time-To-Perform' (TTP) detection method can prove invaluable for the identification of NjRAT malware or + other malicious software instances that introduce executable files as modules within a targeted host. +search: '`sysmon` EventCode=7 ImageLoaded= *.exe + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_executable_in_loaded_modules_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown. +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 80 + impact: 80 + message: An executable $Imageloaded$ loaded by $Image$ on $dest$ + mitre_attack_id: + - T1129 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - Image + - ImageLoaded + - Signed + - SignatureStatus + - OriginalFileName + - process_name + - Computer + - EventCode + - ProcessId + - Hashes + - IMPHASH + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_fileless_storage_via_registry.yml b/detections/endpoint/windows_fileless_storage_via_registry.yml new file mode 100644 index 0000000000..ac41e4b87e --- /dev/null +++ b/detections/endpoint/windows_fileless_storage_via_registry.yml @@ -0,0 +1,66 @@ +name: Windows Njrat Fileless Storage via Registry +id: a5fffbbd-271f-4980-94ed-4fbf17f0af1c +version: 1 +date: '2023-09-14' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification associated with NjRat, + a telltale sign of its fileless technique. NjRat employs this method to manage its keylogs and execute downloaded DLL module plugins discreetly on the compromised host. + This approach is particularly effective at evading conventional file-based detection systems, as it stores indicators of compromise (IOCs) in the registry. + Leveraging this TTP (Tactics, Techniques, and Procedures) detection can significantly enhance the identification of NjRAT infections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\[kl]" OR Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name Registry.registry_value_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_njrat_fileless_storage_via_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 100 + impact: 100 + message: a suspicious registry entry related to NjRAT keylloging registry in $dest$ + mitre_attack_id: + - T1027.011 + - T1027 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.011/njrat_fileless_registry_entry/njrat_registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml new file mode 100644 index 0000000000..360ef3d78d --- /dev/null +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -0,0 +1,67 @@ +name: Windows Modify Registry With MD5 Reg Key Name +id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 +version: 1 +date: '2023-09-25' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: This analytic is designed to identify potentially malicious registry modification characterized by MD5-like registry key names. + This technique has been notably observed in NjRAT malware, which employs such registries for fileless storage of keylogs and .DLL plugins. + Detecting this tactic serves as an effective means of identifying possible NjRAT malware instances that create or modify registries as + part of their malicious activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | eval dropped_reg_path = split(registry_path, "\\") + | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) + | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") + | where validation_result = "md5" AND dropped_reg_path_split_count <= 5 + | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_with_md5_reg_key_name_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that + include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A md5 registry value name $registry_value_name$ is created on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml new file mode 100644 index 0000000000..a9dc9ec64a --- /dev/null +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -0,0 +1,69 @@ +name: Windows Time Based Evasion +id: 34502357-deb1-499a-8261-ffe144abf561 +version: 1 +date: '2023-09-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 1 +description: This analytic is designed to detect potentially malicious processes that initiate a ping delay using an invalid IP address. + This evasion technique was observed in NJRAT, where the malware employed ping commands as a means to introduce a time delay before self-deletion on the compromised host. + Identifying this (TTP) behavior can serve as a valuable indicator for detecting NJRAT infections or other malware that employ time delays as + evasion tactics. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "ping.exe" Processes.parent_process = "* ping 0 -n *" OR Processes.process = "* ping 0 -n *" + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_time_based_evasion_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: unknown +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: A $process_name$ did a suspicious ping to invalid IP address on $dest$ + mitre_attack_id: + - T1497 + - T1497.003 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index 9f5626715e..8ed17315dd 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Chaos Ransomware + - NjRAT asset_type: Endpoint confidence: 80 impact: 80