From 338f22f7e2bb199b73fce720bec8051c8af2df3a Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 18 Jan 2022 13:13:30 +0100 Subject: [PATCH] fixed more detections --- .../application/use_cases/content_changer.py | 14 +++++++++++++- .../7zip_commandline_to_smb_share_path.yml | 2 +- ...allow_file_and_printing_sharing_in_firewall.yml | 9 +++++++++ .../create_remote_thread_in_shell_application.yml | 2 +- detections/endpoint/detect_exchange_web_shell.yml | 2 +- .../endpoint/disable_logs_using_wevtutil.yml | 4 ++-- detections/endpoint/drop_icedid_license_dat.yml | 2 +- .../icedid_exfiltrated_archived_file_creation.yml | 2 +- .../office_application_drop_executable.yml | 2 +- ...ffice_product_spawning_rundll32_with_no_dll.yml | 2 +- .../permission_modification_using_takeown_app.yml | 2 +- .../powershell_disable_security_monitoring.yml | 6 ++++++ ...hell_remote_thread_to_known_windows_process.yml | 2 +- detections/endpoint/processes_launching_netsh.yml | 4 ++-- .../rundll32_create_remote_thread_to_a_process.yml | 2 +- .../rundll32_createremotethread_in_browser.yml | 2 +- detections/endpoint/rundll32_dnsquery.yml | 2 +- .../rundll32_process_creating_exe_dll_files.yml | 2 +- detections/endpoint/ryuk_wake_on_lan_command.yml | 4 ++-- .../schtasks_scheduling_job_on_remote_system.yml | 6 ++---- .../endpoint/shim_database_file_creation.yml | 9 ++++----- detections/endpoint/silentcleanup_uac_bypass.yml | 3 +-- .../endpoint/single_letter_process_on_endpoint.yml | 4 ++-- .../endpoint/sqlite_module_in_temp_folder.yml | 2 +- .../suspicious_icedid_rundll32_cmdline.yml | 2 +- ...suspicious_image_creation_in_appdata_folder.yml | 2 +- ..._process_dns_query_known_abuse_web_services.yml | 2 +- .../endpoint/suspicious_rundll32_plugininit.yml | 2 +- .../suspicious_wav_file_in_appdata_folder.yml | 2 +- .../endpoint/uninstall_app_using_msiexec.yml | 2 +- 30 files changed, 63 insertions(+), 40 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py b/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py index cae5dc5778..ed7361ebd1 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py @@ -119,4 +119,16 @@ class ContentChanger: if observable['type'] == 'Parent Process': observable['type'] = 'Process' if observable['type'] == 'user': - observable['type'] = 'User' \ No newline at end of file + observable['type'] = 'User' + if observable['type'] == 'process name': + observable['type'] = 'Process' + + def fix_context(self, objects : list) -> None: + for obj in objects: + if 'context' in obj['tags']: + new_context = [] + for context in obj['tags']['context']: + if ':' not in context: + continue + new_context.append(context) + obj['tags']['context'] = new_context \ No newline at end of file diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index fb59e27aad..f5f0c33ddc 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -51,7 +51,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 1f33960e3f..34d6d45ad9 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -30,13 +30,22 @@ tags: analytic_story: - Ransomware automated_detection_testing: passed + context: + - Source:Endpoint + - Stage:Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log kill_chain_phases: - Exploitation + message: '' mitre_attack_id: - T1562.007 - T1562 + observable: + - name: user + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 0c1676dddd..0d18ade547 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -44,7 +44,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index b817b189b7..70c5482286 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -55,7 +55,7 @@ tags: confidence: 90 context: - Source:Endpoint - - Stage:Exploitation + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log impact: 90 diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 75b0894908..b7edb69fb7 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -29,8 +29,8 @@ tags: automated_detection_testing: passed confidence: 80 context: - - Source: Endpoint - - Stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log impact: 30 diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index b9ae9a01c9..3115fce20f 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -43,7 +43,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 1fef337e1d..cd71778e89 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -43,7 +43,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index d567b0478f..7f2b460fdd 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -56,7 +56,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index 78f1af52c7..030cd6fefa 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -59,7 +59,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 0988660a99..6ee9748eb2 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -46,7 +46,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index ba2969f3f8..8a38a9b131 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -37,9 +37,15 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation + message: '' mitre_attack_id: - T1562.001 - T1562 + observable: + - name: ComputerName + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 243c081dcc..f53179b34b 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -47,7 +47,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 287cd7eae1..2d30911282 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -38,8 +38,8 @@ tags: - CIS 8 confidence: 70 context: - - source:endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log impact: 60 diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 7c6539ac4b..29eb7b7c1f 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -44,7 +44,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 3806931450..13e8700d34 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -45,7 +45,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index 0ed3db0736..f5165a5413 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -46,7 +46,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index 1c8c920a17..830695b645 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -44,7 +44,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index da385a07ff..c6d5e44485 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -35,8 +35,8 @@ tags: automated_detection_testing: passed confidence: 90 context: - - source:endpoint - - stage: Execution + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log impact: 70 diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index d03c8cc9df..616effd88d 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -35,10 +35,8 @@ tags: - CIS 3 confidence: 90 context: - - source:endpoint - - stage: Execution - - Persistence - - Privilege Escalation + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log impact: 70 diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index a29923fe90..81b569a62f 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -32,9 +32,8 @@ tags: - CIS 8 confidence: 80 context: - - source:endpoint - - stage: Privilege Escalation - - Persistence + - Source:Endpoint + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log impact: 70 @@ -52,9 +51,9 @@ tags: role: - Victim - name: file_path - type: file path + type: File role: - - Others + - Other product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index 4725181ded..fb498fe458 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -29,10 +29,9 @@ tags: confidence: 90 context: - Source:Endpoint - - Stage:Persistence, + - Stage:Persistence - Stage:Privilege Escalation - Stage:Defense Evasion - - Scope:Incoming dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log impact: 70 diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 9624097195..3cf1ee88fc 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -31,8 +31,8 @@ tags: - CIS 2 confidence: 90 context: - - source:endpoint - - stage: Execution + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon.log impact: 70 diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index 226933d985..5d2d5ac04c 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -44,7 +44,7 @@ tags: role: - Victim - name: SourceImage - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 18a92098c5..3fe35b0555 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -47,7 +47,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index d9aa3435e2..74dda81512 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -52,7 +52,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index f5cd7e914e..b87bd1a983 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -48,7 +48,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index 28336bad71..8c2642ec09 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -47,7 +47,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 3bdc1e99b8..3804ef7314 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -51,7 +51,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index b3a0de7b05..2d1e7448ce 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -46,7 +46,7 @@ tags: role: - Victim - name: process_name - type: process name + type: Process role: - Attacker product: