From b3d34a5bef9db6308eee3a9581bdc7f8d02e74ea Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 19 Sep 2023 10:43:13 +0200 Subject: [PATCH 01/17] njrat2 --- ...ndows_delete_or_modify_system_firewall.yml | 64 ++++++++++++++++ ...s_disable_or_modify_tools_via_taskkill.yml | 73 +++++++++++++++++++ .../windows_fileless_storage_via_registry.yml | 66 +++++++++++++++++ ...ed_module_executable_in_loaded_modules.yml | 65 +++++++++++++++++ .../endpoint/windows_time_based_evasion.yml | 63 ++++++++++++++++ ..._execution_malicious_url_shortcut_file.yml | 1 + 6 files changed, 332 insertions(+) create mode 100644 detections/endpoint/windows_delete_or_modify_system_firewall.yml create mode 100644 detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml create mode 100644 detections/endpoint/windows_fileless_storage_via_registry.yml create mode 100644 detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml create mode 100644 detections/endpoint/windows_time_based_evasion.yml diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml new file mode 100644 index 0000000000..a5487b6bd7 --- /dev/null +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -0,0 +1,64 @@ +name: Windows Delete or Modify System Firewall +id: b188d11a-eba7-419d-b8b6-cc265b4f2c4f +version: 1 +date: '2023-09-08' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon Event ID 1 +description: This analytic identifies potentially malicious 'netsh' processes that manipulate firewall configurations. + This behavior has been observed in the NJRAT malware, which deletes its added firewall rules as part of its cleanup process. + Leveraging this anomaly detection can be a valuable approach for detecting malware, such as NJRAT, + that makes alterations to firewall configurations as a component of its malicious activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "netsh.exe" Processes.process = "* firewall *" Processes.process = "* delete *" + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_delete_or_modify_system_firewall_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator may modify or delete firewall configuration. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a $process_name$ delete firewall configuration in $dest$ + mitre_attack_id: + - T1562 + - T1562.004 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml new file mode 100644 index 0000000000..4870979efd --- /dev/null +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -0,0 +1,73 @@ +name: Windows Disable or Modify Tools Via Taskkill +id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 +version: 1 +date: '2023-09-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon Event ID 1 +description: This analytic is designed to identify potentially malicious processes that terminate other processes using 'taskkill.exe'. + This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate + other processes—whether they be security products or other legitimate applications—as part of their malicious activities. + Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_or_modify_tools_via_taskkill_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: network administrator can use this application to kill process during audit or investigation. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a taskkill process to terminate process is executed in $dest$ + mitre_attack_id: + - T1562 + - T1562.001 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill/taskkill_im.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_fileless_storage_via_registry.yml b/detections/endpoint/windows_fileless_storage_via_registry.yml new file mode 100644 index 0000000000..8bb082b93a --- /dev/null +++ b/detections/endpoint/windows_fileless_storage_via_registry.yml @@ -0,0 +1,66 @@ +name: Windows Njrat Fileless Storage via Registry +id: a5fffbbd-271f-4980-94ed-4fbf17f0af1c +version: 1 +date: '2023-09-14' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of a suspicious registry modification associated with NjRat, + a telltale sign of its fileless technique. NjRat employs this method to manage its keylogs and execute downloaded DLL module plugins discreetly on the compromised host. + This approach is particularly effective at evading conventional file-based detection systems, as it stores indicators of compromise (IOCs) in the registry. + Leveraging this TTP (Tactics, Techniques, and Procedures) detection can significantly enhance the identification of NjRAT infections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\[kl]" OR Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name Registry.registry_value_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_njrat_fileless_storage_via_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 100 + impact: 100 + message: a suspicious registry entry related to NjRAT keylloging registry in $dest$ + mitre_attack_id: + - T1027.011 + - T1027 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.011/njrat_fileless_registry_entry/njrat_registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml b/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml new file mode 100644 index 0000000000..16d00138d0 --- /dev/null +++ b/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml @@ -0,0 +1,65 @@ +name: Windows Shared Module Executable in loaded Modules +id: 3e27af56-fcf0-4113-988d-24969b062be7 +version: 1 +date: '2023-09-12' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 7 +description: This analytic identifies potentially malicious 'ImageLoaded' events, particularly when they involve executable files. + This behavior was observed in NjRAT instances, where, during each instance of loading a module from its C2 server onto the compromised host, + Sysmon recorded the path of the actual Image or Process as an 'ImageLoaded' event, rather than the typical tracking of dynamically loaded DLL modules in memory. + This event holds significance because it tracks processes that load modules and libraries, which are typically in the .dll format rather than .exe. + Leveraging this 'Time-To-Perform' (TTP) detection method can prove invaluable for the identification of NjRAT malware or + other malicious software instances that introduce executable files as modules within a targeted host. +search: '`sysmon` EventCode=7 ImageLoaded= *.exe + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_shared_module_executable_in_loaded_modules_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown. +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 80 + impact: 80 + message: an executable as Imageloaded by $Image$ in $dest$ + mitre_attack_id: + - T1129 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - Image + - ImageLoaded + - Signed + - SignatureStatus + - OriginalFileName + - process_name + - Computer + - EventCode + - ProcessId + - Hashes + - IMPHASH + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml new file mode 100644 index 0000000000..aa19c7bbfb --- /dev/null +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -0,0 +1,63 @@ +name: Windows Time Based Evasion +id: 34502357-deb1-499a-8261-ffe144abf561 +version: 1 +date: '2023-09-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 1 +description: This analytic is designed to detect potentially malicious processes that initiate a ping delay using an invalid IP address. + This evasion technique was observed in NJRAT, where the malware employed ping commands as a means to introduce a time delay before self-deletion on the compromised host. + Identifying this (TTP) behavior can serve as a valuable indicator for detecting NJRAT infections or other malware that employ time delays as + evasion tactics. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "ping.exe" Processes.parent_process = "* ping 0 -n *" OR Processes.process = "* ping 0 -n *" + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_time_based_evasion_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a $process_name$ did a suspicious ping to invalid ip address in $dest$ + mitre_attack_id: + - T1497 + - T1497.003 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index 9f5626715e..8ed17315dd 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Chaos Ransomware + - NjRAT asset_type: Endpoint confidence: 80 impact: 80 From 677b3313fa99b0c20f65e5b100c3e286fa688e18 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:52:03 +0200 Subject: [PATCH 02/17] Update windows_time_based_evasion.yml --- detections/endpoint/windows_time_based_evasion.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index aa19c7bbfb..00b5693c1e 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -55,6 +55,7 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id + security_domain: endpoint tests: - name: True Positive Test attack_data: From 36f93918576cfd813103dd1d3f1d84936b5d116c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:52:57 +0200 Subject: [PATCH 03/17] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../endpoint/windows_disable_or_modify_tools_via_taskkill.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index 4870979efd..b89477b392 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -7,7 +7,7 @@ status: production type: Anomaly data_source: - Sysmon Event ID 1 -description: This analytic is designed to identify potentially malicious processes that terminate other processes using 'taskkill.exe'. +description: This analytic is designed to identify potentially malicious processes that terminate other processes using "taskkill.exe". This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate other processes—whether they be security products or other legitimate applications—as part of their malicious activities. Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. From d6c314af41da560e5e67e0f9e9ce7a556509cb0f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:55:21 +0200 Subject: [PATCH 04/17] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../endpoint/windows_disable_or_modify_tools_via_taskkill.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index b89477b392..14a5c89312 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -7,7 +7,7 @@ status: production type: Anomaly data_source: - Sysmon Event ID 1 -description: This analytic is designed to identify potentially malicious processes that terminate other processes using "taskkill.exe". +description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe. This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate other processes—whether they be security products or other legitimate applications—as part of their malicious activities. Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. From 6db976f90c31b820b233fbe56831cb6a9a1c866a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:59:23 +0200 Subject: [PATCH 05/17] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../windows_disable_or_modify_tools_via_taskkill.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index 14a5c89312..c9a8faee16 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -7,9 +7,9 @@ status: production type: Anomaly data_source: - Sysmon Event ID 1 -description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe. - This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate - other processes—whether they be security products or other legitimate applications—as part of their malicious activities. +description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe. + This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate + other processes whether they be security products or other legitimate applications as part of their malicious activities. Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") From 82b16516681d3376a5b09c13b4d95bf21bc3bea8 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 11:38:39 +0200 Subject: [PATCH 06/17] Update windows_fileless_storage_via_registry.yml --- detections/endpoint/windows_fileless_storage_via_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_fileless_storage_via_registry.yml b/detections/endpoint/windows_fileless_storage_via_registry.yml index 8bb082b93a..ac41e4b87e 100644 --- a/detections/endpoint/windows_fileless_storage_via_registry.yml +++ b/detections/endpoint/windows_fileless_storage_via_registry.yml @@ -9,7 +9,7 @@ data_source: - Sysmon EventID 12 - Sysmon EventID 13 - Sysmon EventID 14 -description: The following analytic identifies a suspicious registry modification of a suspicious registry modification associated with NjRat, +description: The following analytic identifies a suspicious registry modification associated with NjRat, a telltale sign of its fileless technique. NjRat employs this method to manage its keylogs and execute downloaded DLL module plugins discreetly on the compromised host. This approach is particularly effective at evading conventional file-based detection systems, as it stores indicators of compromise (IOCs) in the registry. Leveraging this TTP (Tactics, Techniques, and Procedures) detection can significantly enhance the identification of NjRAT infections. From 71e6ae840674361ef487e33f0c6016bba20e8a67 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 21 Sep 2023 10:56:06 +0200 Subject: [PATCH 07/17] njrat2 --- detections/endpoint/disable_registry_tool.yml | 1 + .../endpoint/disabling_cmd_application.yml | 1 + .../disabling_systemrestore_in_registry.yml | 1 + .../endpoint/disabling_task_manager.yml | 1 + .../endpoint/windows_abused_web_services.yml | 67 +++++++++++++++++ .../windows_admin_permission_discovery.yml | 74 +++++++++++++++++++ 6 files changed, 145 insertions(+) create mode 100644 detections/endpoint/windows_abused_web_services.yml create mode 100644 detections/endpoint/windows_admin_permission_discovery.yml diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 92db5125fe..64d5484233 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 100 impact: 40 diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 817240a760..f76ee91f89 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 82c83ff3ff..c54d46907b 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index f1fca5a4c6..19e51f98d7 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 60 impact: 70 diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/endpoint/windows_abused_web_services.yml new file mode 100644 index 0000000000..e3578a6827 --- /dev/null +++ b/detections/endpoint/windows_abused_web_services.yml @@ -0,0 +1,67 @@ +name: Windows Abused Web Services +id: 01f0aef4-8591-4daa-a53d-0ed49823b681 +version: 1 +date: '2023-09-20' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 22 +description: This analytic detects a suspicious process making a DNS query via known, + abused text-paste web services, VoIP, internet via secure tunneling,instant messaging, and digital distribution + platforms used to download external files. This technique is abused by adversaries, + malware actors, and red teams to download a malicious file on the target host. This + is a good TTP indicator for possible initial access techniques. A user will experience + false positives if the following instant messaging is allowed or common applications + like telegram or discord are allowed in the corporate network. +search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*",""*textbin*"", "*ngrok.io*", "*discord*", "*duckdns.org*", "*pasteio.com*") + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_abused_web_services_filter`' +how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. + We suggest you run this detection at least once a day over the last 14 days. +known_false_positives: Noise and false positive can be seen if the following instant + messaging is allowed to use within corporate network. In this case, a filter is + needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a network connection on known abused web services from $dest$ + mitre_attack_id: + - T1102 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults + - Computer + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml new file mode 100644 index 0000000000..0a9e36204a --- /dev/null +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -0,0 +1,74 @@ +name: Windows Admin Permission Discovery +id: e08620cb-9488-4052-832d-97bcc0afd414 +version: 1 +date: '2023-09-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 11 +description: This analytic is developed to identify suspicious file creation in the root drive (C:\). + This tactic was observed in NjRAT as a means to ascertain whether its malware instance running on + the compromised host possesses administrative privileges. + The methodology involves an attempt to create a 'win.dat' file in the C:\ directory. + If this file is successfully created, it serves as an indicator that the process indeed holds administrative privileges. + This anomaly detection mechanism serves as a valuable pivot point for detecting NjRAT and other malware strains employing + similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") + | eval dropped_file_path_split_count = mvcount(dropped_file_path) + | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_admin_permission_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that + include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: administrator is capable of dropping files in root C drive. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a file was created in root drive c in $dest$ + mitre_attack_id: + - T1069.001 + observable: + - name: user + type: User + role: + - Victim + - name: process_id + type: Process + role: + - Attacker + - name: file_name + type: File Name + role: + - Other + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 4e213c100d2b5c32a6320ca76018ec204c302b06 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Sep 2023 18:05:49 +0200 Subject: [PATCH 08/17] njrat2 --- ..._modify_registry_with_md5_reg_key_name.yml | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml new file mode 100644 index 0000000000..718b0583bf --- /dev/null +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -0,0 +1,67 @@ +name: 'Windows Modify Registry With MD5 Reg Key Name' +id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 +version: 1 +date: '2023-09-25' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: This analytic is designed to identify potentially malicious registry modification characterized by MD5-like registry key names. + This technique has been notably observed in NjRAT malware, which employs such registries for fileless storage of keylogs and .DLL plugins. + Detecting this tactic serves as an effective means of identifying possible NjRAT malware instances that create or modify registries as + part of their malicious activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | eval dropped_reg_path = split(registry_path, "\\") + | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) + | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"good","bad") + | where validation_result = "good" AND dropped_reg_path_split_count <= 5 + | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_with_md5_reg_key_name_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that + include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a md5 registry value name is created in $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 9c341bc954e9f5622359c9624de2402d692548a4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Sep 2023 18:09:25 +0200 Subject: [PATCH 09/17] njrat2 --- .../endpoint/windows_modify_registry_with_md5_reg_key_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 718b0583bf..6eb7bec4a7 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim | `drop_dm_object_name(Registry)` | eval dropped_reg_path = split(registry_path, "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) - | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"good","bad") + | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") | where validation_result = "good" AND dropped_reg_path_split_count <= 5 | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` From 648df38a1a94792c1d28acf176b5e7789023a482 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Sep 2023 18:11:06 +0200 Subject: [PATCH 10/17] njrat2 --- .../endpoint/windows_modify_registry_with_md5_reg_key_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 6eb7bec4a7..16744a0ce7 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim | eval dropped_reg_path = split(registry_path, "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") - | where validation_result = "good" AND dropped_reg_path_split_count <= 5 + | where validation_result = "md5" AND dropped_reg_path_split_count <= 5 | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` From 2076a91d12756c94b7e0cf20025f478f31268e32 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 14:56:11 -0700 Subject: [PATCH 11/17] adding dest --- detections/endpoint/windows_admin_permission_discovery.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml index 0a9e36204a..c333138174 100644 --- a/detections/endpoint/windows_admin_permission_discovery.yml +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -16,7 +16,7 @@ description: This analytic is developed to identify suspicious file creation in similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets. search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + by Filesystem.dest Filesystem.file_create_time Filesystem.process_id Filesystem.process_guiid Filesystem.file_name Filesystem.file_path Filesystem.user | `drop_dm_object_name(Filesystem)` | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) @@ -35,7 +35,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a file was created in root drive c in $dest$ + message: A file was created in root drive C:/ on host - $dest$ mitre_attack_id: - T1069.001 observable: From 67b6e4749fe29395644ef8183938c9d73bf0eaec Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 14:57:04 -0700 Subject: [PATCH 12/17] Update windows_delete_or_modify_system_firewall.yml --- .../endpoint/windows_delete_or_modify_system_firewall.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml index a5487b6bd7..ff8d9b2fa2 100644 --- a/detections/endpoint/windows_delete_or_modify_system_firewall.yml +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a $process_name$ delete firewall configuration in $dest$ + message: A $process_name$ deleted a firewall configuration on $dest$ mitre_attack_id: - T1562 - T1562.004 From d3e104c3f3a2ab30a3fc27753e8bf980855d09b5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 14:58:14 -0700 Subject: [PATCH 13/17] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../endpoint/windows_disable_or_modify_tools_via_taskkill.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index c9a8faee16..d5ae1d6cff 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a taskkill process to terminate process is executed in $dest$ + message: A taskkill process to terminate process is executed on host- $dest$ mitre_attack_id: - T1562 - T1562.001 From d0e387f41a3d2bceaba30e5775ee0c248b65fd0b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:37:28 -0700 Subject: [PATCH 14/17] Update windows_delete_or_modify_system_firewall.yml updates to text and spl --- ...ndows_delete_or_modify_system_firewall.yml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml index ff8d9b2fa2..5b81bcb763 100644 --- a/detections/endpoint/windows_delete_or_modify_system_firewall.yml +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -12,17 +12,22 @@ description: This analytic identifies potentially malicious 'netsh' processes th Leveraging this anomaly detection can be a valuable approach for detecting malware, such as NJRAT, that makes alterations to firewall configurations as a component of its malicious activities. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "netsh.exe" Processes.process = "* firewall *" Processes.process = "* delete *" - by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + where `process_netsh` Processes.process = "* firewall *" Processes.process = "* delete *" + by Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_delete_or_modify_system_firewall_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator may modify or delete firewall configuration. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrator may modify or delete firewall configuration. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat tags: From c5e942e24ada678c65427d4efc3eee153a168959 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:38:24 -0700 Subject: [PATCH 15/17] Update windows_disable_or_modify_tools_via_taskkill.yml how to implement --- ...ndows_disable_or_modify_tools_via_taskkill.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index d5ae1d6cff..593aba2a37 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -18,11 +18,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_or_modify_tools_via_taskkill_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -known_false_positives: network administrator can use this application to kill process during audit or investigation. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Network administrator can use this application to kill process during audit or investigation. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat tags: From 0bde5c7afecda3b93aa7c84366a190575567ee28 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:40:05 -0700 Subject: [PATCH 16/17] Update windows_modify_registry_with_md5_reg_key_name.yml --- .../windows_modify_registry_with_md5_reg_key_name.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 16744a0ce7..360ef3d78d 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -1,4 +1,4 @@ -name: 'Windows Modify Registry With MD5 Reg Key Name' +name: Windows Modify Registry With MD5 Reg Key Name id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 version: 1 date: '2023-09-25' @@ -36,7 +36,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a md5 registry value name is created in $dest$ + message: A md5 registry value name $registry_value_name$ is created on $dest$ mitre_attack_id: - T1112 observable: From 631ecd41221c4dec51a8a650cb9dffac134ac8d5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:51:03 -0700 Subject: [PATCH 17/17] updating sutffff --- ...l => windows_executable_in_loaded_modules.yml} | 6 +++--- .../endpoint/windows_time_based_evasion.yml | 15 ++++++++++----- 2 files changed, 13 insertions(+), 8 deletions(-) rename detections/endpoint/{windows_shared_module_executable_in_loaded_modules.yml => windows_executable_in_loaded_modules.yml} (93%) diff --git a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml b/detections/endpoint/windows_executable_in_loaded_modules.yml similarity index 93% rename from detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml rename to detections/endpoint/windows_executable_in_loaded_modules.yml index 16d00138d0..092578b463 100644 --- a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml +++ b/detections/endpoint/windows_executable_in_loaded_modules.yml @@ -1,4 +1,4 @@ -name: Windows Shared Module Executable in loaded Modules +name: Windows Executable in Loaded Modules id: 3e27af56-fcf0-4113-988d-24969b062be7 version: 1 date: '2023-09-12' @@ -18,7 +18,7 @@ search: '`sysmon` EventCode=7 ImageLoaded= *.exe | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_shared_module_executable_in_loaded_modules_filter`' + | `windows_executable_in_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown. @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: an executable as Imageloaded by $Image$ in $dest$ + message: An executable $Imageloaded$ loaded by $Image$ on $dest$ mitre_attack_id: - T1129 observable: diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 00b5693c1e..a9dc9ec64a 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_time_based_evasion_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: unknown references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat @@ -31,7 +36,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a $process_name$ did a suspicious ping to invalid ip address in $dest$ + message: A $process_name$ did a suspicious ping to invalid IP address on $dest$ mitre_attack_id: - T1497 - T1497.003