admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-03-03 04:28:37 -08:00
committed by GitHub
parent 32569d2931 2861d04434
commit 33f8071c5c
305 changed files with 21804 additions and 14296 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/baseline_of_blocked_outbound_traffic_from_aws.yml
+1 -1
View File
@@ -27,7 +27,7 @@ tags:
analytic_story:
- AWS Network ACL Activity
- Suspicious AWS Traffic
- Command and Control
- Command And Control
detections:
- Detect Spike in blocked Outbound Traffic from your AWS
product:
baselines/baseline_of_dns_query_length___mltk.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
analytic_story:
- Hidden Cobra Malware
- Suspicious DNS Traffic
- Command and Control
- Command And Control
detections:
- DNS Query Length Outliers - MLTK
product:
baselines/count_of_unique_ips_connecting_to_ports.yml
+1 -1
View File
@@ -19,7 +19,7 @@ tags:
analytic_story:
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- Command and Control
- Command And Control
detections:
- Prohibited Network Traffic Allowed
product:
bin/contentctl_project/contentctl_core/application/factory/ba_factory.py
+31 -30
View File
@@ -25,6 +25,7 @@ class BAFactoryInputDto:
basic_builder: BasicBuilder
detection_builder: DetectionBuilder
director: Director
attack_enrichment: dict
@dataclass(frozen=True)
class BAFactoryOutputDto:
@@ -75,43 +76,43 @@ class BAFactory():
progress_percent = ((index+1)/len(files_with_ssa)) * 100
try:
type_string = "UNKNOWN TYPE"
if type == SecurityContentType.detections:
type_string = "Detections"
self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], {}, [], [])
detection = self.input_dto.detection_builder.getObject()
Utils.add_id(self.ids, detection, file)
#try:
type_string = "UNKNOWN TYPE"
if type == SecurityContentType.detections:
type_string = "Detections"
self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], self.input_dto.attack_enrichment, [], [])
detection = self.input_dto.detection_builder.getObject()
Utils.add_id(self.ids, detection, file)
tag_and_nist_errors = []
if detection.tags.cis20 == None:
error = TypeError(f"Detection Tags missing cis20 field")
tag_and_nist_errors.append(ErrorWrapper(error, loc="cis20"))
tag_and_nist_errors = []
if detection.tags.nist == None:
error = TypeError(f"Detection Tags missing nist field")
tag_and_nist_errors.append(ErrorWrapper(error, loc="nist"))
if detection.tags.cis20 == None:
error = TypeError(f"Detection Tags missing cis20 field")
tag_and_nist_errors.append(ErrorWrapper(error, loc="cis20"))
if detection.tags.nist == None:
error = TypeError(f"Detection Tags missing nist field")
tag_and_nist_errors.append(ErrorWrapper(error, loc="nist"))
if len(tag_and_nist_errors) > 0:
raise ValidationError( tag_and_nist_errors , DetectionTags)
if len(tag_and_nist_errors) > 0:
raise ValidationError( tag_and_nist_errors , DetectionTags)
if not detection.deprecated and not detection.experimental:
self.output_dto.detections.append(detection)
else:
raise(Exception(f"Unsupported content type: [{type}]"))
if detection.status == "production":
self.output_dto.detections.append(detection)
else:
raise(Exception(f"Unsupported content type: [{type}]"))
if (sys.stdout.isatty() and sys.stdin.isatty() and sys.stderr.isatty()) or not already_ran:
already_ran = True
print(f"\r{f'{type_string} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...", end="", flush=True)
if (sys.stdout.isatty() and sys.stdin.isatty() and sys.stderr.isatty()) or not already_ran:
already_ran = True
print(f"\r{f'{type_string} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...", end="", flush=True)
except ValidationError as e:
validation_errors.append((pathlib.Path(file), e))
except Exception as e:
print(f"Unknown exception caught while Creating BA Security Content: {str(e)}")
sys.exit(1)
# except ValidationError as e:
# validation_errors.append((pathlib.Path(file), e))
# except Exception as e:
# print(f"Unknown exception caught while Creating BA Security Content: {str(e)}")
# sys.exit(1)
bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py
+1 -1
View File
@@ -149,7 +149,7 @@ class NewContentQuestions():
'Unauthorized Software',
'Best Practices',
'Cloud Security',
'Command and Control',
'Command And Control',
'Lateral Movement',
'Ransomware',
'Privilege Escalation'
bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py
+2 -2
View File
@@ -90,7 +90,7 @@ class ContentChanger:
def fix_wrong_kill_chain_phases(self, objects : list) -> None:
valid_kill_chain_phases = [
'Reconnaissance', 'Weaponization', 'Delivery',
'Exploitation', 'Installation', 'Command and Control',
'Exploitation', 'Installation', 'Command And Control',
'Actions on Objectives']
for obj in objects:
if 'kill_chain_phases' in obj['tags']:
@@ -196,4 +196,4 @@ class ContentChanger:
for obj in objects:
if 'Command & Control' in obj['tags']['analytic_story']:
obj['tags']['analytic_story'].remove('Command & Control')
obj['tags']['analytic_story'].append('Command and Control')
obj['tags']['analytic_story'].append('Command And Control')
bin/contentctl_project/contentctl_core/application/use_cases/convert.py
-3
View File
@@ -24,6 +24,3 @@ class Convert:
yml_output = YmlOutput()
yml_output.writeDetections(sigma_converter_output_dto.detections, input_dto.output_path)
file_name = sigma_converter_output_dto.detections[0].file_path
print('Converted Sigma detection to: ' + input_dto.output_path + '/' + file_name)
bin/contentctl_project/contentctl_core/domain/constants/constants.py
+43 -23
View File
@@ -11,10 +11,10 @@ ATTACK_TACTICS_KILLCHAIN_MAPPING = {
"Discovery": "Exploitation",
"Lateral Movement": "Exploitation",
"Collection": "Exploitation",
"Command and Control": "Command and Control",
"Command And Control": "Command and Control",
"Exfiltration": "Actions On Objectives",
"Impact": "Actions On Objectives"
"Command And Control": "Command And Control",
"Command And Control": "Command And Control",
"Exfiltration": "Actions on Objectives",
"Impact": "Actions on Objectives"
}
SES_CONTEXT_MAPPING = {
@@ -74,7 +74,7 @@ SES_KILL_CHAIN_MAPPINGS = {
"Delivery": 3,
"Exploitation": 4,
"Installation": 5,
"Command & Control": 6,
"Command And Control": 6,
"Actions on Objectives": 7
}
@@ -93,23 +93,43 @@ SES_OBSERVABLE_ROLE_MAPPING = {
}
SES_OBSERVABLE_TYPE_MAPPING = {
"Other": -1,
"Unknown": 0,
"Device": 1,
"Container": 2,
"Endpoint": 3,
"Hostname": 4,
"IP Address": 5,
"User": 6,
"Username": 7,
"Email": 8,
"Email Address": 9,
"URL": 10,
"URL Domain": 11,
"File": 12,
"File Name": 13,
"File Hash": 14,
"Process": 15,
"Process Name": 16,
"Location": 17
"Hostname": 1,
"IP Address": 2,
"MAC Address": 3,
"User Name": 4,
"Email Address": 5,
"URL String": 6,
"File Name": 7,
"File Hash": 8,
"Process Name": 9,
"Ressource UID": 10,
"Endpoint": 20,
"User": 21,
"Email": 22,
"Uniform Resource Locator": 23,
"File": 24,
"Process": 25,
"Geo Location": 26,
"Container": 27,
"Registry Key": 28,
"Registry Value": 29,
"Other": 99
}
SES_ATTACK_TACTICS_ID_MAPPING = {
"Reconnaissance": "TA0043",
"Resource_Development": "TA0042",
"Initial_Access": "TA0001",
"Execution": "TA0002",
"Persistence": "TA0003",
"Privilege_Escalation": "TA0004",
"Defense_Evasion": "TA0005",
"Credential_Access": "TA0006",
"Discovery": "TA0007",
"Lateral_Movement": "TA0008",
"Collection": "TA0009",
"Command_and_Control": "TA0011",
"Exfiltration": "TA0010",
"Impact": "TA0040"
}
bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py
+14 -12
View File
@@ -41,9 +41,11 @@ class DetectionTags(BaseModel):
risk_level_id: int = None
risk_level: str = None
observable_str: str = None
evidence_str: str = None
kill_chain_phases_id: list = None
research_site_url: str = None
event_schema: str = None
mappings: list = None
@validator('cis20')
@@ -109,19 +111,19 @@ class DetectionTags(BaseModel):
raise ValueError('Mitre Attack ID are not following the pattern Txxxx: ' + values["name"])
return v
@validator('observable')
def tags_observable(cls,v,values):
valid_roles = SES_OBSERVABLE_ROLE_MAPPING.keys()
valid_types = SES_OBSERVABLE_TYPE_MAPPING.keys()
# @validator('observable')
# def tags_observable(cls,v,values):
# valid_roles = SES_OBSERVABLE_ROLE_MAPPING.keys()
# valid_types = SES_OBSERVABLE_TYPE_MAPPING.keys()
for value in v:
if value['type'] in valid_types:
for role in value['role']:
if role not in valid_roles:
raise ValueError('Observable role ' + role + ' not valid for ' + values["name"] + '. valid options are ' + str(valid_roles))
else:
raise ValueError('Observable type ' + value['type'] + ' not valid for ' + values["name"] + '. valid options are ' + str(valid_types))
return v
# for value in v:
# if value['type'] in valid_types:
# for role in value['role']:
# if role not in valid_roles:
# raise ValueError('Observable role ' + role + ' not valid for ' + values["name"] + '. valid options are ' + str(valid_roles))
# else:
# raise ValueError('Observable type ' + value['type'] + ' not valid for ' + values["name"] + '. valid options are ' + str(valid_types))
# return v
@validator('product')
def tags_product(cls, v, values):
bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py
+19 -13
View File
@@ -17,9 +17,9 @@ class FindingReportObject():
else:
detection.tags.confidence_id = 3
detection.tags.context_ids = list()
for context in detection.tags.context:
detection.tags.context_ids.append(SES_CONTEXT_MAPPING[context])
# detection.tags.context_ids = list()
# for context in detection.tags.context:
# detection.tags.context_ids.append(SES_CONTEXT_MAPPING[context])
if detection.tags.impact < 20:
detection.tags.impact_id = 1
@@ -32,9 +32,10 @@ class FindingReportObject():
else:
detection.tags.impact_id = 5
detection.tags.kill_chain_phases_id = list()
detection.tags.kill_chain_phases_id = dict()
for kill_chain_phase in detection.tags.kill_chain_phases:
detection.tags.kill_chain_phases_id.append(SES_KILL_CHAIN_MAPPINGS[kill_chain_phase])
detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase]
if detection.tags.risk_score < 20:
detection.tags.risk_level_id = 0
@@ -53,22 +54,27 @@ class FindingReportObject():
detection.tags.risk_level = "Critical"
observable_str = "["
for i in range(len(detection.tags.observable)):
role_list = []
for role in detection.tags.observable[i]["role"]:
role_list.append(str(SES_OBSERVABLE_ROLE_MAPPING[role]))
observable_str = observable_str + 'create_map("name", "' + detection.tags.observable[i]["name"] + '", "role_ids", [' + ",".join(role_list) + '], "type_id", ' + str(SES_OBSERVABLE_TYPE_MAPPING[detection.tags.observable[i]["type"]]) + ', "value", ' + detection.tags.observable[i]["name"] + ')'
if not i == len(detection.tags.observable):
for i in range(len(detection.tags.observable)):
observable_str = observable_str + 'create_map("name", "' + detection.tags.observable[i]["name"] + '", "type_id", ' + str(SES_OBSERVABLE_TYPE_MAPPING[detection.tags.observable[i]["type"]]) + ', "value", ' + detection.tags.observable[i]["name"].replace(".", "_") + ')'
if not i == (len(detection.tags.observable) - 1):
observable_str = observable_str + ', '
observable_str = observable_str + ']'
detection.tags.observable_str = observable_str
evidence_str = "create_map("
for i in range(len(detection.tags.observable)):
evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_")
if not i == (len(detection.tags.observable) - 1):
evidence_str = evidence_str + ', '
evidence_str = evidence_str + ')'
detection.tags.evidence_str = evidence_str
j2_env = Environment(
loader=FileSystemLoader(os.path.join(os.path.dirname(__file__), 'templates')),
trim_blocks=True)
template = j2_env.get_template('finding_report.j2')
body = template.render(detection=detection)
body = template.render(detection=detection, attack_tactics_id_mapping=SES_ATTACK_TACTICS_ID_MAPPING)
return body
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
+11 -7
View File
@@ -40,9 +40,9 @@ class ObjToYmlAdapter(Adapter):
obj.tags.research_site_url = research_site_url
# add ocsf schema tag
obj.tags.event_schema = 'cim'
obj.tags.event_schema = 'ocsf'
#body = FindingReportObject.writeFindingReport(obj)
body = FindingReportObject.writeFindingReport(obj)
if obj.test:
test_dict = {
@@ -59,10 +59,12 @@ class ObjToYmlAdapter(Adapter):
# remove unncessary fields
YmlWriter.writeYmlFile(file_path, obj.dict(
exclude_none=True,
include =
{
"name": True,
"id": True,
"eventSchema": True,
"version": True,
"description": True,
"search": True,
@@ -75,6 +77,7 @@ class ObjToYmlAdapter(Adapter):
"cis20" : True,
"nist": True,
"kill_chain_phases": True,
"mappings": True,
"mitre_attack_id": True,
"risk_severity": True,
"risk_score": True,
@@ -107,12 +110,13 @@ class ObjToYmlAdapter(Adapter):
))
# Add Finding Report Object
#with open(file_path, 'r') as file:
# data = file.read().replace('--body--', body)
with open(file_path, 'r') as file:
data = file.read().replace('--finding_report--', body)
f = open(file_path, "w")
f.write(data)
f.close()
#f = open(file_path, "w")
#f.write(data)
#f.close()
def writeObjectNewContent(self, object: dict, type: SecurityContentType) -> None:
if type == SecurityContentType.detections:
bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2
+44 -11
View File
@@ -1,11 +1,44 @@
create_map("category_id", 101, "class_id", 101000, "detection_start_time", start_time,
"detection_end_time", end_time, "device_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.device_entities.device.uid"), "string", null), "type_id", 0)],
"disposition_id", 1, "end_time", end_time, "event_id", 10100001, "event_time", timestamp,
"finding", create_map("confidence", {{ detection.tags.confidence }}, "confidence_id", {{ detection.tags.confidence_id }},
"context_ids", {{ detection.tags.context_ids }}, "impact", {{ detection.tags.impact }}, "impact_id", {{ detection.tags.impact_id }},
"kill_chain_phase", {{ detection.tags.kill_chain_phases[0] }}, "kill_chain_phase_id", {{ detection.tags.kill_chain_phases_id[0] }},
"risk_level", {{ detection.tags.risk_level }}, "risk_level_id", {{ detection.tags.risk_level_id }}, "type_id", 1, "ref_event_uid", event_id),
"message", {{ detection.tags.message }}, "metadata", create_map("log_name", {{ detection.datamodel[0] }}, "version",
"1.0.0"), "observables", {{ detection.tags.observables_str }}, "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")),
"rule", create_map("name", "{{ detection.name }}", "uid", "{{ detection.id }}", "version", "1"), "start_time", start_time, "time", start_time,
"user_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.user_entities.user.uid"),"string", null))])
| eval body=create_map(
"activity_id", 1,
"analytic_stories", [{%- for story in detection.tags.analytic_story %}"{{story}}"{% if not loop.last %}, {% endif %}{%- endfor -%}],
"cis_csc", [{%- for cis in detection.tags.cis20 %}create_map("control", "{{cis}}", "version", 7){% if not loop.last %}, {% endif %}{%- endfor -%}],
"category_uid", 2,
"class_name", "Detection Report",
"class_uid", 102001,
"confidence", {{ detection.tags.confidence }},
"confidence_id", {{ detection.tags.confidence_id }},
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"duration", 0,
"time", timestamp,
"evidence", {{ detection.tags.evidence_str }},
"impact", {{ detection.tags.impact }},
"impact_id", {{ detection.tags.impact_id }},
"kill_chain", [{%- for kill_chain_phase in detection.tags.kill_chain_phases %}create_map("phase", "{{kill_chain_phase}}", "phase_id", {{detection.tags.kill_chain_phases_id[kill_chain_phase]}}){% if not loop.last %}, {% endif %}{%- endfor -%}],
"attacks", [{%- for enrichment in detection.tags.mitre_attack_enrichments %}create_map("tactics", [{%- for tactic in enrichment.mitre_attack_tactics %}create_map("name", "{{tactic}}", "uid", "{{attack_tactics_id_mapping[tactic|replace(" ", "_")]}}"){% if not loop.last %}, {% endif %}{%- endfor -%}], "technique", create_map("name", "{{ enrichment.mitre_attack_technique }}", "uid", "{{ enrichment.mitre_attack_id }}"), "version", "12.1"){% if not loop.last %}, {% endif %}{%- endfor -%}],
"message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", process_user_name, "."),
"metadata", create_map(
"product", create_map(
"name", "Behavioral Analytic Service",
"vendor_name", "Splunk"
),
"version", "1.0.0"
),
"nist", [{%- for nist in detection.tags.nist %}"{{nist}}"{% if not loop.last %}, {% endif %}{%- endfor -%}],
"observables", {{ detection.tags.observable_str }},
"risk_level", "{{ detection.tags.risk_level }}",
"risk_level_id", {{ detection.tags.risk_level_id }},
"risk_score", {{ detection.tags.risk_score }},
"severity_id", {{ detection.tags.impact_id }},
"type_uid", 10200101,
"users", [
create_map(
"name", process_user_name, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
]
)
| into write_ba_finding_events();
bin/contentctl_project/contentctl_infrastructure/adapter/yml_output.py
+6 -1
View File
@@ -11,6 +11,7 @@ class YmlOutput():
for obj in objects:
file_path = obj.file_path
YmlWriter.writeYmlFile(os.path.join(output_path, file_path), obj.dict(
exclude_none=True,
include =
{
"name": True,
@@ -30,13 +31,17 @@ class YmlOutput():
{
"analytic_story": True,
"asset_type": True,
"atomic_guid": True,
"confidence": True,
"impact": True,
"drilldown_search": True,
"mappings": True,
"message": True,
"mitre_attack_id": True,
"atomic_guid": True,
"kill_chain_phases:": True,
"observable": True,
"product": True,
"required_fields": True,
"risk_score": True,
"security_domain": True
},
bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py
+50 -38
View File
@@ -8,28 +8,16 @@ from sigma.types import SigmaCompareExpression
from sigma.exceptions import SigmaFeatureNotSupportedByBackendError
from sigma.pipelines.splunk.splunk import splunk_sysmon_process_creation_cim_mapping, splunk_windows_registry_cim_mapping, splunk_windows_file_event_cim_mapping
from bin.contentctl_project.contentctl_core.domain.entities.detection import Detection
from typing import ClassVar, Dict, List, Optional, Pattern, Tuple
class SplunkDeferredRegularExpression(DeferredTextQueryExpression):
template = 'regex {field}{op}"{value}"'
operators = {
True: "!=",
False: "=",
}
default_field = "_raw"
class SplunkDeferredCIDRExpression(DeferredTextQueryExpression):
template = 'where {op}cidrmatch("{value}", {field})'
operators = {
True: "NOT ",
False: "",
}
default_field = "_raw"
class SplunkBABackend(TextQueryBackend):
"""Splunk SPL backend."""
precedence: ClassVar[Tuple[ConditionItem, ConditionItem, ConditionItem]] = (ConditionNOT, ConditionOR, ConditionAND)
group_expression : ClassVar[str] = "({expr})"
parenthesize : bool = True
or_token : ClassVar[str] = "OR"
and_token : ClassVar[str] = "AND"
@@ -45,7 +33,7 @@ class SplunkBABackend(TextQueryBackend):
wildcard_single : ClassVar[str] = "%"
add_escaped : ClassVar[str] = "\\"
re_expression : ClassVar[str] = "{regex}"
re_expression : ClassVar[str] = "match_regex({field}, /(?i){regex}/)=true"
re_escape_char : ClassVar[str] = "\\"
re_escape : ClassVar[Tuple[str]] = ('"',)
@@ -72,29 +60,19 @@ class SplunkBABackend(TextQueryBackend):
unbound_value_num_expression : ClassVar[str] = '{value}'
unbound_value_re_expression : ClassVar[str] = '{value}'
deferred_start : ClassVar[str] = "\n| "
deferred_separator : ClassVar[str] = "\n| "
deferred_start : ClassVar[str] = " "
deferred_separator : ClassVar[str] = " OR "
deferred_only_query : ClassVar[str] = "*"
wildcard_match_expression : ClassVar[Optional[str]] = "like({field}, {value})"
def __init__(self, processing_pipeline: Optional["sigma.processing.pipeline.ProcessingPipeline"] = None, collect_errors: bool = False, min_time : str = "-30d", max_time : str = "now", **kwargs):
def __init__(self, processing_pipeline: Optional["sigma.processing.pipeline.ProcessingPipeline"] = None, collect_errors: bool = False, min_time : str = "-30d", max_time : str = "now", detection : Detection = None, field_mapping: dict = None, **kwargs):
super().__init__(processing_pipeline, collect_errors, **kwargs)
self.min_time = min_time or "-30d"
self.max_time = max_time or "now"
def convert_condition_field_eq_val_re(self, cond : ConditionFieldEqualsValueExpression, state : "sigma.conversion.state.ConversionState") -> SplunkDeferredRegularExpression:
"""Defer regular expression matching to pipelined regex command after main search expression."""
if cond.parent_condition_chain_contains(ConditionOR):
raise SigmaFeatureNotSupportedByBackendError("ORing regular expressions is not yet supported by Splunk backend", source=cond.source)
return SplunkDeferredRegularExpression(state, cond.field, super().convert_condition_field_eq_val_re(cond, state)).postprocess(None, cond)
def convert_condition_field_eq_val_cidr(self, cond : ConditionFieldEqualsValueExpression, state : "sigma.conversion.state.ConversionState") -> SplunkDeferredCIDRExpression:
"""Defer CIDR network range matching to pipelined where cidrmatch command after main search expression."""
if cond.parent_condition_chain_contains(ConditionOR):
raise SigmaFeatureNotSupportedByBackendError("ORing CIDR matching is not yet supported by Splunk backend", source=cond.source)
return SplunkDeferredCIDRExpression(state, cond.field, super().convert_condition_field_eq_val_cidr(cond, state)).postprocess(None, cond)
self.detection = detection
self.field_mapping = field_mapping
def finalize_query_data_model(self, rule: SigmaRule, query: str, index: int, state: ConversionState) -> str:
@@ -103,15 +81,49 @@ class SplunkBABackend(TextQueryBackend):
except KeyError:
raise SigmaFeatureNotSupportedByBackendError("No fields specified by processing pipeline")
fields_input_parsing = ''
for count, value in enumerate(fields):
fields_input_parsing = fields_input_parsing + value + '=ucast(map_get(input_event, "' + value + '"), "string", null)'
if not count == len(fields) - 1:
fields_input_parsing = fields_input_parsing + ', '
# fields_input_parsing = ''
# for count, value in enumerate(fields):
# fields_input_parsing = fields_input_parsing + value + '=ucast(map_get(input_event, "' + value + '"), "string", null)'
# if not count == len(fields) - 1:
# fields_input_parsing = fields_input_parsing + ', '
return f"""| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)),
{fields_input_parsing} | where {query} | output tbd
detection_str = """
| from read_ba_enriched_events()
| eval timestamp = ucast(map_get(input_event,"time"),"long", null)
| eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>", null)
| eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null)
""".replace("\n", " ")
parsed_fields = []
for field in self.field_mapping["mapping"].keys():
mapped_field = self.field_mapping["mapping"][field]
parent = 'input_event'
i = 1
values = mapped_field.split('.')
for val in values:
if parent == "input_event":
new_val = val
else:
new_val = parent + '_' + val
if new_val in parsed_fields:
parent = new_val
i = i + 1
continue
if i == len(values):
parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "string", null) '
else:
parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "map<string, any>", null) '
detection_str = detection_str + parser_str
parsed_fields.append(new_val)
parent = new_val
i = i + 1
detection_str = detection_str + "| where " + query
detection_str = detection_str.replace("\\\\\\\\", "\\\\")
return detection_str
def finalize_output_data_model(self, queries: List[str]) -> List[str]:
return queries
bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py
+9 -12
View File
@@ -66,6 +66,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
def addRBA(self) -> None:
if self.security_content_obj:
risk_objects = []
risk_object_user_types = {'user', 'username', 'email address'}
risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'}
@@ -74,20 +75,16 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
for entity in self.security_content_obj.tags.observable:
risk_object = dict()
if entity['type'].lower() in risk_object_user_types:
for r in entity['role']:
if 'attacker' == r.lower() or 'victim' ==r.lower():
risk_object['risk_object_type'] = 'user'
risk_object['risk_object_field'] = entity['name']
risk_object['risk_score'] = self.security_content_obj.tags.risk_score
risk_objects.append(risk_object)
risk_object['risk_object_type'] = 'user'
risk_object['risk_object_field'] = entity['name']
risk_object['risk_score'] = self.security_content_obj.tags.risk_score
risk_objects.append(risk_object)
elif entity['type'].lower() in risk_object_system_types:
for r in entity['role']:
if 'attacker' == r.lower() or 'victim' ==r.lower():
risk_object['risk_object_type'] = 'system'
risk_object['risk_object_field'] = entity['name']
risk_object['risk_score'] = self.security_content_obj.tags.risk_score
risk_objects.append(risk_object)
risk_object['risk_object_type'] = 'system'
risk_object['risk_object_field'] = entity['name']
risk_object['risk_score'] = self.security_content_obj.tags.risk_score
risk_objects.append(risk_object)
else:
risk_object['threat_object_field'] = entity['name']
risk_object['threat_object_type'] = entity['type'].lower()
bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py
+214 -98
View File
@@ -1,7 +1,9 @@
import os
import sys
import copy
from dataclasses import dataclass
from jinja2 import Environment, FileSystemLoader
from sigma.processing.conditions import LogsourceCondition
from sigma.processing.transformations import AddConditionTransformation, FieldMappingTransformation, DetectionItemFailureTransformation, RuleFailureTransformation, SetStateTransformation
@@ -16,14 +18,17 @@ from bin.contentctl_project.contentctl_infrastructure.builder.yml_reader import
from bin.contentctl_project.contentctl_core.domain.entities.detection import Detection
from bin.contentctl_project.contentctl_core.domain.entities.data_source import DataSource
from bin.contentctl_project.contentctl_infrastructure.builder.backend_splunk_ba import SplunkBABackend
from bin.contentctl_project.contentctl_core.application.factory.utils.utils import Utils
from bin.contentctl_project.contentctl_core.domain.constants.constants import *
@dataclass(frozen=True)
class SigmaConverterInputDto:
data_model: SigmaConverterTarget
detection_path: str
detection_folder : str
input_path: str
log_source: str
cim_to_ocsf: bool
@dataclass(frozen=True)
@@ -40,115 +45,177 @@ class SigmaConverter():
def execute(self, input_dto: SigmaConverterInputDto) -> None:
detection = self.read_detection(input_dto.detection_path)
data_source = self.load_data_source(input_dto.input_path, detection.data_source[0])
if not data_source:
print("ERROR: Didn't find data source with name: " + detection.data_source[0] + " for detection " + detection.name)
detection_files = []
errors = []
if input_dto.detection_path:
detection_files.append(input_dto.detection_path)
elif input_dto.detection_folder:
detection_files = Utils.get_all_yml_files_from_directory(input_dto.detection_folder)
else:
print("ERROR: --detection_path or --detection_folder needed.")
sys.exit(1)
file_name = detection.name.replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
sigma_rule = self.get_sigma_rule(detection, data_source)
if input_dto.data_model == SigmaConverterTarget.RAW:
if input_dto.log_source and input_dto.log_source != detection.data_source[0][0]:
try:
field_mapping = self.find_mapping(data_source.convert_to_log_source, 'data_source', input_dto.log_source)
except Exception as e:
print(e)
print("ERROR: Couldn't find data source mapping for log source " + input_dto.log_source + " for detection: " + detection.name)
sys.exit(1)
logsource_condition = self.get_logsource_condition(data_source)
processing_item = self.get_field_transformation_processing_item(
field_mapping['mapping'],
logsource_condition
)
sigma_processing_pipeline = self.get_pipeline_from_processing_items([processing_item])
splunk_backend = SplunkBackend(processing_pipeline=sigma_processing_pipeline)
data_source = self.load_data_source(input_dto.input_path, input_dto.log_source)
else:
splunk_backend = SplunkBackend()
search = splunk_backend.convert(sigma_rule)[0]
search = self.add_source_macro(search, data_source.type)
search = self.add_stats_count(search, data_source.raw_fields)
search = self.add_timeformat_conversion(search)
search = self.add_filter_macro(search, file_name)
elif input_dto.data_model == SigmaConverterTarget.CIM:
logsource_condition = self.get_logsource_condition(data_source)
try:
field_mapping = self.find_mapping(data_source.field_mappings, 'data_model', 'cim')
except Exception as e:
print(e)
print("ERROR: Couldn't find data source mapping to cim for log source " + detection.data_source[0] + " and detection " + detection.name)
sys.exit(1)
sigma_transformation_processing_item = self.get_field_transformation_processing_item(
field_mapping['mapping'],
logsource_condition
)
sigma_state_fields_processing_item = self.get_state_fields_processing_item(
field_mapping['mapping'].values(),
logsource_condition
)
sigma_state_data_model_processing_item = self.get_state_data_model_processing_item(
field_mapping['data_set'],
logsource_condition
)
sigma_processing_pipeline = self.get_pipeline_from_processing_items([
sigma_transformation_processing_item,
sigma_state_fields_processing_item,
sigma_state_data_model_processing_item
])
splunk_backend = SplunkBackend(processing_pipeline=sigma_processing_pipeline)
search = splunk_backend.convert(sigma_rule, "data_model")[0]
search = self.add_filter_macro(search, file_name)
elif input_dto.data_model == SigmaConverterTarget.OCSF:
processing_items = list()
logsource_condition = self.get_logsource_condition(data_source)
if input_dto.log_source and input_dto.log_source != detection.data_source[0]:
try:
field_mapping = self.find_mapping(data_source.convert_to_log_source, 'data_source', input_dto.log_source)
except Exception as e:
print(e)
print("ERROR: Couldn't find data source mapping for log source " + input_dto.log_source + " and detection " + detection.name)
for detection_file in detection_files:
#try:
detection = self.read_detection(str(detection_file))
print("Converting detection: " + detection.name)
data_source = self.load_data_source(input_dto.input_path, detection.data_source[0])
if not data_source:
print("ERROR: Didn't find data source with name: " + detection.data_source[0] + " for detection " + detection.name)
sys.exit(1)
processing_items.append(
self.get_field_transformation_processing_item(
file_name = detection.name.replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
sigma_rule = self.get_sigma_rule(detection, data_source)
if input_dto.data_model == SigmaConverterTarget.RAW:
if input_dto.log_source and input_dto.log_source != detection.data_source[0][0]:
try:
field_mapping = self.find_mapping(data_source.convert_to_log_source, 'data_source', input_dto.log_source)
except Exception as e:
print(e)
print("ERROR: Couldn't find data source mapping for log source " + input_dto.log_source + " for detection: " + detection.name)
sys.exit(1)
logsource_condition = self.get_logsource_condition(data_source)
processing_item = self.get_field_transformation_processing_item(
field_mapping['mapping'],
logsource_condition
)
sigma_processing_pipeline = self.get_pipeline_from_processing_items([processing_item])
splunk_backend = SplunkBackend(processing_pipeline=sigma_processing_pipeline)
data_source = self.load_data_source(input_dto.input_path, input_dto.log_source)
else:
splunk_backend = SplunkBackend()
search = splunk_backend.convert(sigma_rule)[0]
search = self.add_source_macro(search, data_source.type)
search = self.add_stats_count(search, data_source.raw_fields)
search = self.add_timeformat_conversion(search)
search = self.add_filter_macro(search, file_name)
detection.file_path = file_name + '.yml'
elif input_dto.data_model == SigmaConverterTarget.CIM:
logsource_condition = self.get_logsource_condition(data_source)
try:
field_mapping = self.find_mapping(data_source.field_mappings, 'data_model', 'cim')
except Exception as e:
print(e)
print("ERROR: Couldn't find data source mapping to cim for log source " + detection.data_source[0] + " and detection " + detection.name)
sys.exit(1)
sigma_transformation_processing_item = self.get_field_transformation_processing_item(
field_mapping['mapping'],
logsource_condition
)
)
data_source = self.load_data_source(input_dto.input_path, input_dto.log_source)
sigma_state_fields_processing_item = self.get_state_fields_processing_item(
field_mapping['mapping'].values(),
logsource_condition
)
sigma_state_data_model_processing_item = self.get_state_data_model_processing_item(
field_mapping['data_set'],
logsource_condition
)
sigma_processing_pipeline = self.get_pipeline_from_processing_items([
sigma_transformation_processing_item,
sigma_state_fields_processing_item,
sigma_state_data_model_processing_item
])
splunk_backend = SplunkBackend(processing_pipeline=sigma_processing_pipeline)
search = splunk_backend.convert(sigma_rule, "data_model")[0]
search = self.add_filter_macro(search, file_name)
field_mapping = self.find_mapping(data_source.field_mappings, 'data_model', 'ocsf')
detection.file_path = file_name + '.yml'
processing_items.append(
self.get_field_transformation_processing_item(
field_mapping['mapping'],
logsource_condition
)
)
processing_items.append(
self.get_state_fields_processing_item(
field_mapping['mapping'].values(),
logsource_condition
)
)
elif input_dto.data_model == SigmaConverterTarget.OCSF:
sigma_processing_pipeline = self.get_pipeline_from_processing_items(processing_items)
if not data_source.name == "Windows Security 4688":
print("ERROR: Convert command for OCSF only supports data source Windows Security 4688 for now.")
continue
splunk_backend = SplunkBABackend(processing_pipeline=sigma_processing_pipeline)
search = splunk_backend.convert(sigma_rule, "data_model")[0]
processing_items = list()
logsource_condition = self.get_logsource_condition(data_source)
if input_dto.log_source and input_dto.log_source != detection.data_source[0]:
try:
field_mapping = self.find_mapping(data_source.convert_to_log_source, 'data_source', input_dto.log_source)
except Exception as e:
print(e)
print("ERROR: Couldn't find data source mapping for log source " + input_dto.log_source + " and detection " + detection.name)
sys.exit(1)
detection.search = search
detection.file_path = file_name + '.yml'
self.output_dto.detections.append(detection)
processing_items.append(
self.get_field_transformation_processing_item(
field_mapping['mapping'],
logsource_condition
)
)
data_source = self.load_data_source(input_dto.input_path, input_dto.log_source)
if input_dto.cim_to_ocsf:
field_mapping_dot = {
"data_model": "ocsf",
"mapping": {
"process_name": "process.file.name",
"parent_process_name": "actor.process.file.name",
"parent_process": "actor.process.cmd_line",
"cmd_line": "process.cmd_line",
"process": "process.cmd_line",
"process_path": "process.file.path",
"process_file_path": "process.file.path",
"user": "process.user.name",
"dest": "device.hostname"
}
}
field_mapping = copy.deepcopy(field_mapping_dot)
for field in field_mapping["mapping"].keys():
field_mapping["mapping"][field] = field_mapping["mapping"][field].replace(".", "_")
else:
field_mapping = self.find_mapping(data_source.field_mappings, 'data_model', 'ocsf')
self.add_required_fields_and_mappings(field_mapping_dot, detection)
self.update_observables(detection)
processing_items.append(
self.get_field_transformation_processing_item(
field_mapping['mapping'],
logsource_condition
)
)
processing_items.append(
self.get_state_fields_processing_item(
field_mapping['mapping'].values(),
logsource_condition
)
)
sigma_processing_pipeline = self.get_pipeline_from_processing_items(processing_items)
if input_dto.cim_to_ocsf:
splunk_backend = SplunkBABackend(processing_pipeline=sigma_processing_pipeline, detection=detection, field_mapping=field_mapping_dot)
else:
splunk_backend = SplunkBABackend(processing_pipeline=sigma_processing_pipeline, detection=detection)
search = splunk_backend.convert(sigma_rule, "data_model")[0]
search = search + ' --finding_report--'
detection.file_path = 'ssa___' + file_name + '.yml'
detection.search = search
self.output_dto.detections.append(detection)
# except Exception as e:
# print(e)
# errors.append("ERROR: Converting detection " + detection.name)
print()
for error in errors:
print(error)
print()
def read_detection(self, detection_path : str) -> Detection:
yml_dict = YmlReader.load_file(detection_path)
@@ -162,7 +229,7 @@ class SigmaConverter():
data_sources = list()
files = Utils.get_all_yml_files_from_directory(os.path.join(input_path, 'data_sources'))
for file in files:
data_sources.append(DataSource.parse_obj(YmlReader.load_file(file)))
data_sources.append(DataSource.parse_obj(YmlReader.load_file(str(file))))
data_source = None
@@ -256,3 +323,52 @@ class SigmaConverter():
return mapping
raise AttributeError("ERROR: Couldn't find mapping.")
def add_required_fields_and_mappings(self, field_mapping: dict, detection: Detection) -> None:
required_fields = list()
required_fields = ["process.user.name", "device.hostname"]
mappings = list()
mappings = [
{
"ocsf": "process.user.name",
"cim": "user"
},
{
"ocsf": "device.hostname",
"cim": "dest"
}
]
for mapping in field_mapping["mapping"].keys():
for selection in detection.search.keys():
if selection != "condition":
for detection_field in detection.search[selection]:
if detection_field.startswith(mapping):
if not field_mapping["mapping"][mapping] in required_fields:
required_fields.append(field_mapping["mapping"][mapping])
mappings.append({"ocsf": field_mapping["mapping"][mapping], "cim": mapping})
detection.tags.mappings = mappings
detection.tags.required_fields = required_fields
def update_observables(self, detection : Detection) -> None:
mapping_field_to_type = {
"process.user.name": "User Name",
"device.hostname": "Hostname",
"process.file.name": "File Name",
"actor.process.file.name": "File Name",
"actor.process.cmd_line": "Process",
"process.cmd_line": "Other",
"process.file.path": "File"
}
observables = list()
for field in detection.tags.required_fields:
observables.append({
"name": field,
"type": mapping_field_to_type[field]
})
detection.tags.observable = observables
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/savedsearches.conf
+1 -1
View File
@@ -136,7 +136,7 @@ action.escu.full_search_name = ESCU - Get Parent Process Info - Response Task
description = This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest
action.escu.creation_date = 2019-02-28
action.escu.modification_date = 2019-02-28
action.escu.analytic_story = ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"]
action.escu.analytic_story = ["Collection and Staging", "Command And Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/savedsearches.conf
+1 -1
View File
@@ -136,7 +136,7 @@ action.escu.full_search_name = ESCU - Get Parent Process Info - Response Task
description = This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest
action.escu.creation_date = 2019-02-28
action.escu.modification_date = 2019-02-28
action.escu.analytic_story = ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"]
action.escu.analytic_story = ["Collection and Staging", "Command And Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"]
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
action.escu.providing_technologies = []
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json
+1 -1
View File
@@ -1 +1 @@
{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command And Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json
+1 -1
View File
@@ -1 +1 @@
{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command And Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/investigation/investigation.yml
+1 -1
View File
@@ -23,7 +23,7 @@ references: []
tags:
analytic_story:
- Collection and Staging
- Command and Control
- Command And Control
- DHS Report TA18-074A
- Disabling Security Tools
- 'Emotet Malware DHS Report TA18-201A '
contentctl.py
+10 -4
View File
@@ -125,7 +125,8 @@ def generate(args) -> None:
os.path.abspath(args.path),
SecurityContentBasicBuilder(),
SecurityContentDetectionBuilder(force_cached_or_offline = args.cached_and_offline, skip_enrichment=args.skip_enrichment),
SecurityContentDirector()
SecurityContentDirector(),
AttackEnrichment.get_attack_lookup(args.path, force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
)
@@ -196,7 +197,8 @@ def validate(args) -> None:
os.path.abspath(args.path),
SecurityContentBasicBuilder(),
SecurityContentDetectionBuilder(force_cached_or_offline = args.cached_and_offline, check_references=args.check_references, skip_enrichment=args.skip_enrichment),
SecurityContentDirector()
SecurityContentDirector(),
AttackEnrichment.get_attack_lookup(args.path, force_cached_or_offline=args.cached_and_offline, skip_enrichment=args.skip_enrichment)
)
if args.product == "ESCU" or args.product == "all":
@@ -319,8 +321,10 @@ def convert(args) -> None:
sigma_converter_input_dto = SigmaConverterInputDto(
data_model = data_model,
detection_path = args.detection_path,
detection_folder = args.detection_folder,
input_path = args.path,
log_source = args.log_source
log_source = args.log_source,
cim_to_ocsf = args.cim_to_ocsf
)
convert_input_dto = ConvertInputDto(
@@ -408,7 +412,9 @@ def main(args):
convert_parser.add_argument("-dm", "--data_model", required=False, type=str, default="cim", help="converter target, choose between cim, raw, ba")
convert_parser.add_argument("-lo", "--log_source", required=False, type=str, help="converter log source")
convert_parser.add_argument("-dp", "--detection_path", required=True, type=str, help="path to the detection")
convert_parser.add_argument("-dp", "--detection_path", required=False, type=str, help="path to a single detection")
convert_parser.add_argument("-df", "--detection_folder", required=False, type=str, help="path to a detection folder")
convert_parser.add_argument("-cto", "--cim_to_ocsf", action=argparse.BooleanOptionalAction, help="temp: cim to ocsf")
convert_parser.add_argument("-o", "--output", required=True, type=str, help="output path to store the detections")
convert_parser.set_defaults(func=convert)
data_sources/endpoint/Windows_Security_4688.yml
+2 -2
View File
@@ -39,11 +39,11 @@ field_mappings:
- data_model: ocsf
mapping:
NewProcessId: process.pid
NewProcessName: process.file
NewProcessName: process.file.name
Process_Command_Line: process.cmd_line
SubjectUserSid: user.name
ProcessId: actor_process.pid
ParentProcessName: actor_process.file
ParentProcessName: actor.process.file.name
Computer: origin.device.name
convert_to_log_source:
- data_source: Sysmon Event ID 1
detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
+1 -1
View File
@@ -45,7 +45,7 @@ tags:
analytic_story:
- AWS Network ACL Activity
- Suspicious AWS Traffic
- Command and Control
- Command And Control
asset_type: AWS Instance
confidence: 50
impact: 50
detections/deprecated/clients_connecting_to_multiple_dns_servers.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
- DNS Hijacking
- Suspicious DNS Traffic
- Host Redirection
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/deprecated/detect_long_dns_txt_record_response.yml
+2 -2
View File
@@ -7,7 +7,7 @@ status: deprecated
type: TTP
description: This search is used to detect attempts to use DNS tunneling, by calculating
the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission
for data exfiltration, command and control, or evasion of security controls can
for data exfiltration, Command And Control, or evasion of security controls can
often be detected by noting unusually large volumes of DNS traffic. Deprecated because
this detection should focus on DNS queries instead of DNS responses.
data_source: []
@@ -32,7 +32,7 @@ references: []
tags:
analytic_story:
- Suspicious DNS Traffic
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/deprecated/detection_of_dns_tunnels.yml
+2 -2
View File
@@ -9,7 +9,7 @@ description: 'This search is used to detect DNS tunneling, by calculating the su
of the length of DNS queries and DNS answers. The search also filters out potential
false positives by filtering out queries made to internal systems and the queries
originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
method of transmission for data exfiltration, command and control, or evasion of
method of transmission for data exfiltration, Command And Control, or evasion of
security controls can often be detected by noting an unusually large volume of DNS
traffic. \
@@ -48,7 +48,7 @@ tags:
analytic_story:
- Data Protection
- Suspicious DNS Traffic
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml
+1 -1
View File
@@ -24,7 +24,7 @@ tags:
- DNS Hijacking
- Suspicious DNS Traffic
- Host Redirection
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/detect_regasm_with_network_connection.yml
+1 -1
View File
@@ -8,7 +8,7 @@ type: TTP
description: The following analytic identifies regasm.exe with a network connection
to a public IP address, exluding private IP space. This particular technique has
been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe
are signed by Microsoft. By contacting a remote command and control server, the
are signed by Microsoft. By contacting a remote Command And Control server, the
adversary will have the ability to escalate privileges and complete the objectives.
During investigation, identify and retrieve the content being loaded. Review parallel
processes for additional suspicious behavior. Gather any other file modifications
detections/endpoint/detect_regsvcs_with_network_connection.yml
+1 -1
View File
@@ -8,7 +8,7 @@ type: TTP
description: The following analytic identifies Regsvcs.exe with a network connection
to a public IP address, exluding private IP space. This particular technique has
been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe
are signed by Microsoft. By contacting a remote command and control server, the
are signed by Microsoft. By contacting a remote Command And Control server, the
adversary will have the ability to escalate privileges and complete the objectives.
During investigation, identify and retrieve the content being loaded. Review parallel
processes for additional suspicious behavior. Gather any other file modifications
detections/endpoint/dns_exfiltration_using_nslookup_app.yml
+1 -1
View File
@@ -35,7 +35,7 @@ tags:
- Suspicious DNS Traffic
- Dynamic DNS
- Data Exfiltration
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 80
impact: 90
detections/endpoint/excessive_usage_of_nslookup_app.yml
+1 -1
View File
@@ -32,7 +32,7 @@ tags:
- Suspicious DNS Traffic
- Dynamic DNS
- Data Exfiltration
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 70
impact: 40
detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
+1 -1
View File
@@ -13,7 +13,7 @@ description: This correlation find exploitation of Log4Shell CVE-2021-44228 agai
of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral
Movement using Powershell or similar T1562.001 Each of these phases fall into different
MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking
MITRE ATT&CK Tactics (Initial Access, Execution, Command And Control), by looking
into 2 or more phases showing up in detections triggerd is how this correlation
search finds exploitation. If we get a notable from this correlation search the
best way to triage it is by investigating the affected systems against Log4Shell
detections/endpoint/nishang_powershelltcponeline.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
status: production
type: TTP
description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that
spawns a call back to a remote command and control server. This is a powershell
spawns a call back to a remote Command And Control server. This is a powershell
oneliner. In addition, this will capture on the command-line additional utilities
used by Nishang. Triage the endpoint and identify any parallel processes that look
suspicious. Review the reputation of the remote IP or domain contacted by the powershell
detections/endpoint/suspicious_curl_network_connection.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic identifies the use of a curl contacting suspicious
remote domains to checkin to command and control servers or download further implants.
remote domains to checkin to Command And Control servers or download further implants.
In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com.
This particular behavior is common with MacOS adware-malicious software.
data_source:
detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml
+1 -1
View File
@@ -8,7 +8,7 @@ type: Anomaly
description: The following analytic identifies a possible windows application having
a FTP connection in a non common installation path in windows operating system.This
network protocol is being used by adversaries, threat actors and malware like AgentTesla
as a command and control communication to transfer its collected stolen information
as a Command And Control communication to transfer its collected stolen information
like the desktop screenshots, browser information and system information of a targeted
or compromised host.
data_source:
detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml
+1 -1
View File
@@ -8,7 +8,7 @@ type: Anomaly
description: The following analytic identifies a possible windows application having
a SMTP connection in a non common installation path in windows operating system.This
network protocol is being used by adversaries, threat actors and malware like AgentTesla
as a command and control communication to transfer its collected stolen information
as a Command And Control communication to transfer its collected stolen information
like the desktop screenshots, browser information and system information of a targeted
or compromised host.
data_source:
detections/endpoint/windows_remote_access_software_hunt.yml
+1 -1
View File
@@ -35,7 +35,7 @@ references:
tags:
analytic_story:
- Insider Threat
- Command and Control
- Command And Control
- Ransomware
asset_type: Endpoint
confidence: 10
detections/endpoint/windows_system_discovery_using_qwinsta.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: The following analytic identifies the execution of qwinsta.exe exec
about sessions on a remote desktop session host server. The information includes
servername, sessionname, username and many more. This tool is being abused of Qakbot
malware to gather information to the targeted or compromised host that will be send
back to its Command and control server.
back to its Command And Control server.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
detections/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml
+1 -1
View File
@@ -64,7 +64,7 @@ tags:
- DNS Hijacking
- Suspicious DNS Traffic
- Dynamic DNS
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 90
impact: 70
detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
+2 -2
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
status: production
type: TTP
description: Malicious actors often abuse legitimate Dynamic DNS services to host
malicious payloads or interactive command and control nodes. Attackers will automate
malicious payloads or interactive Command And Control nodes. Attackers will automate
domain resolution changes by routing dynamic domains to countless IP addresses to
circumvent firewall blocks, block lists as well as frustrate a network defenders
analytic and investigative processes. This search will look for DNS queries made
@@ -51,7 +51,7 @@ tags:
- DNS Hijacking
- Suspicious DNS Traffic
- Dynamic DNS
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 80
impact: 70
detections/network/detect_large_outbound_icmp_packets.yml
+2 -2
View File
@@ -29,14 +29,14 @@ how_to_implement: 'In order to run this search effectively, we highly recommend
known_false_positives: ICMP packets are used in a variety of ways to help troubleshoot
networking issues and ensure the proper flow of traffic. As such, it is possible
that a large ICMP packet could be perfectly legitimate. If large ICMP packets are
associated with command and control traffic, there will typically be a large number
associated with Command And Control traffic, there will typically be a large number
of these packets observed over time. If the search is providing a large number of
false positives, you can modify the macro `detect_large_outbound_icmp_packets_filter`
to adjust the byte threshold or add specific IP addresses to an allow list.
references: []
tags:
analytic_story:
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/network/dns_query_length_outliers___mltk.yml
+1 -1
View File
@@ -51,7 +51,7 @@ tags:
analytic_story:
- Hidden Cobra Malware
- Suspicious DNS Traffic
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/network/dns_query_length_with_high_standard_deviation.yml
+1 -1
View File
@@ -24,7 +24,7 @@ tags:
analytic_story:
- Hidden Cobra Malware
- Suspicious DNS Traffic
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 80
impact: 70
detections/network/excessive_dns_failures.yml
+1 -1
View File
@@ -26,7 +26,7 @@ references: []
tags:
analytic_story:
- Suspicious DNS Traffic
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/network/multiple_archive_files_http_post_traffic.yml
+1 -1
View File
@@ -34,7 +34,7 @@ references:
tags:
analytic_story:
- Data Exfiltration
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/network/plain_http_post_exfiltrated_data.yml
+1 -1
View File
@@ -24,7 +24,7 @@ references:
tags:
analytic_story:
- Data Exfiltration
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 90
impact: 70
detections/network/prohibited_network_traffic_allowed.yml
+1 -1
View File
@@ -27,7 +27,7 @@ tags:
analytic_story:
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/network/protocol_or_port_mismatch.yml
+1 -1
View File
@@ -29,7 +29,7 @@ references: []
tags:
analytic_story:
- Prohibited Traffic Allowed or Protocol Mismatch
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
detections/network/tor_traffic.yml
+1 -1
View File
@@ -26,7 +26,7 @@ tags:
- Prohibited Traffic Allowed or Protocol Mismatch
- Ransomware
- NOBELIUM Group
- Command and Control
- Command And Control
asset_type: Endpoint
confidence: 50
impact: 50
dev/endpoint/nishang_powershelltcponeline.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
status: production
type: TTP
description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that
spawns a call back to a remote command and control server. This is a powershell
spawns a call back to a remote Command And Control server. This is a powershell
oneliner. In addition, this will capture on the command-line additional utilities
used by Nishang. Triage the endpoint and identify any parallel processes that look
suspicious. Review the reputation of the remote IP or domain contacted by the powershell
dev/endpoint/suspicious_curl_network_connection.yml
+1 -1
View File
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic identifies the use of a curl contacting suspicious
remote domains to checkin to command and control servers or download further implants.
remote domains to checkin to Command And Control servers or download further implants.
In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com.
This particular behavior is common with MacOS adware-malicious software.
data_source:
dev/endpoint/windows_remote_access_software_hunt.yml
+1 -1
View File
@@ -33,7 +33,7 @@ references:
tags:
analytic_story:
- Insider Threat
- Command and Control
- Command And Control
- Ransomware
asset_type: Endpoint
confidence: 10
dev/endpoint/windows_system_discovery_using_qwinsta.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: The following analytic identifies the execution of qwinsta.exe exec
about sessions on a remote desktop session host server. The information includes
servername, sessionname, username and many more. This tool is being abused of Qakbot
malware to gather information to the targeted or compromised host that will be send
back to its Command and control server.
back to its Command And Control server.
data_source:
- Sysmon Event ID 1
search:
dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+80
View File
@@ -0,0 +1,80 @@
name: Anomalous usage of Archive Tools
id: 63614a58-10e2-4c6c-ae81-ea1113681439
version: 1
date: '2021-11-22'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following detection identifies the usage of archive tools from the
command line.
data_source:
- Windows Security 4688
search:
selection1:
process_name: WinRAR.exe
selection2:
process_name|startswith: 7z
selection3:
process_name|startswith: winzip
selection4:
parent_process_name|endswith:
- powershell.exe
- cmd.exe
condition: (selection1 or selection2 or selection3) and selection4
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: False positives can be ligitmate usage of archive tools from
the command line.
references:
- https://attack.mitre.org/techniques/T1560/001/
tags:
analytic_story:
- Cobalt Strike
- NOBELIUM Group
- Insider Threat
asset_type: Endpoint
confidence: 60
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
of 7zip.
mitre_attack_id:
- T1560.001
- T1560
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
kill_chain_phases:
- Exploitation
risk_score: 42
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___attempt_to_delete_services.yml
+78
View File
@@ -0,0 +1,78 @@
name: Attempt To Delete Services
id: a0c8c292-d01a-11eb-aa18-acde48001122
version: 3
date: '2021-11-24'
author: Teoderick Contreras, splunk
status: production
type: TTP
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to delete a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then delete it.
Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
data_source:
- Windows Security 4688
search:
selection1:
process_name: sc.exe
cmd_line|contains: delete
condition: selection1
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
confidence: 60
impact: 60
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
mitre_attack_id:
- T1489
- T1543
- T1543.003
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 36
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___attempt_to_disable_services.yml
+79
View File
@@ -0,0 +1,79 @@
name: Attempt To Disable Services
id: afb31de4-d023-11eb-98d5-acde48001122
version: 3
date: '2021-11-24'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to disable a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then disable
it. Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: config
selection2:
cmd_line|contains: disabled
selection3:
process_name: sc.exe
condition: selection1 and selection2 and selection3
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
confidence: 60
impact: 60
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
mitre_attack_id:
- T1489
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
kill_chain_phases:
- Exploitation
risk_score: 36
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+77
View File
@@ -0,0 +1,77 @@
name: Attempted Credential Dump From Registry via Reg exe
id: 14038953-e5f2-4daf-acff-5452062baf03
version: 2
date: '2021-11-29'
author: Jose Hernandez, Splunk
status: production
type: TTP
description: The following analytic identifies the use of `reg.exe` attempting to
export Windows registry keys that contain hashed credentials. Adversaries will utilize
this technique to capture and perform offline password cracking.
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- reg.exe
- cmd.exe
selection2:
cmd_line|re:
- HKEY_LOCAL_MACHINE\System
- HKEY_LOCAL_MACHINE\SAM
- HKEY_LOCAL_MACHINE\Security
- HKLM\System
- HKLM\SAM
- HKLM\Security
selection3:
cmd_line|re: save
condition: selection1 and (selection2) and selection3
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified.
references:
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
tags:
analytic_story:
- Credential Dumping
asset_type: Endpoint
confidence: 90
impact: 70
message: An attempt to save registry keys storing credentials has been performed on
mitre_attack_id:
- T1003
- T1003.002
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Actions on Objectives
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml
+76
View File
@@ -0,0 +1,76 @@
name: BCDEdit Failure Recovery Modification
id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
data_source:
- Windows Security 4688
search:
selection1:
process_name: bcdedit.exe
selection2:
cmd_line|contains: 'no'
selection3:
cmd_line|contains: recoveryenabled
condition: selection1 and (selection2 and selection3)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
tags:
analytic_story:
- Ryuk Ransomware
- Ransomware
- Information Sabotage
asset_type: Endpoint
confidence: 80
impact: 100
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability
to recover the endpoint.
mitre_attack_id:
- T1490
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Actions on Objectives
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+78
View File
@@ -0,0 +1,78 @@
name: Clear Unallocated Sector Using Cipher App
id: 8f907d90-6173-11ec-9c23-acde48001122
version: 1
date: '2021-12-20'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: this search is to detect execution of `cipher.exe` to clear the unallocated
sectors of a specific disk. This technique was seen in some ransomware to make it
impossible to forensically recover deleted files.
data_source:
- Windows Security 4688
search:
selection1:
process_name: cipher.exe
cmd_line|contains: '/W:'
condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: administrator may execute this app to manage disk
references:
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
tags:
analytic_story:
- Ransomware
- Information Sabotage
asset_type: Endpoint
confidence: 100
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
of a specific disk.
mitre_attack_id:
- T1070.004
- T1070
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
kill_chain_phases:
- Exploitation
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___delete_a_net_user.yml
+84
View File
@@ -0,0 +1,84 @@
name: Delete A Net User
id: 8776d79c-d26e-11eb-9a56-acde48001122
version: 4
date: '2022-03-17'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
legitimate purposes, however this behavior has been used in the wild to impair some
user or deleting adversaries tracks created during its lateral movement additional
systems. During triage, review parallel processes for additional behavior. Identify
any other user accounts created before or after.
data_source:
- Windows Security 4688
search:
selection1:
process|contains: user
selection2:
process|contains: /delete
selection3:
process_name:
- net.exe
- net1.exe
condition: selection1 and selection2 and (selection3)
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
confidence: 70
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user
account.
mitre_attack_id:
- T1531
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
source: WinEventLog:Security
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml
+69
View File
@@ -0,0 +1,69 @@
name: Deny Permission using Cacls Utility
id: b76eae28-cd25-11eb-9c92-acde48001122
version: 3
date: '2021-11-29'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the deny permission on a file or directory. Adversaries
perform this behavior to prevent responders from reviewing or gaining access to
adversary files on disk.
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- icacls.exe
- xcacls.exe
- cacls.exe
cmd_line|re: deny
condition: (selection1)
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: System administrators may use cacls utilities but this is not
a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Information Sabotage
asset_type: Endpoint
confidence: 70
impact: 50
message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+89
View File
@@ -0,0 +1,89 @@
name: Detect Prohibited Applications Spawning cmd exe
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
version: 3
date: '2022-03-01'
author: Ignacio Bermudez Corrales, Splunk
status: production
type: Anomaly
description: The following analytic identifies parent processes, browsers, Windows
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
many applications spawn cmd.exe natively or built into macros. Much of this will
need to be tuned to further enhance the risk.
data_source:
- Windows Security 4688
search:
selection1:
parent_process_name:
- winword.exe
- excel.exe
- outlook.exe
- acrobat.exe
- acrord32.exe
- iexplore.exe
- opera.exe
- firefox.exe
- powershell.exe
-
selection2:
parent_process_name: java.exe
selection3:
parent_process|re: patch1-Hotfix1a
selection4:
parent_process_name: chrome.exe
selection5:
parent_process: chrome-extension
condition: selection1 or (selection2 and not selection3) or (selection4 and not selection5)
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface.
references:
- https://attack.mitre.org/techniques/T1059/
tags:
analytic_story:
- Suspicious Command-Line Executions
- Insider Threat
asset_type: Endpoint
confidence: 50
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
that warrants investigating.
mitre_attack_id:
- T1059
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml
+92
View File
@@ -0,0 +1,92 @@
name: Detect RClone Command-Line Usage
id: e8b74268-5454-11ec-a799-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic identifies commonly used command-line arguments used by
`rclone.exe` to initiate a file transfer. Some arguments were negated as they are
specific to the configuration used by adversaries. In particular, an adversary may
list the files or directories of the remote file share using `ls` or `lsd`, which
is not indicative of malicious behavior. During triage, at this stage of a ransomware
event, exfiltration is about to occur or has already. Isolate the endpoint and continue
investigating by review file modifications and parallel processes.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- --multi-thread-streams
- --transfers
- --auto-confirm
- --ignore-existing
- --no-check-certificate
- --progress
- --config
- ftp
- pcloud
- mega
- copy
process_name: rclone.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives should be limited as this is restricted to
the Rclone process name. Filter or tune the analytic as needed.
references:
- https://redcanary.com/blog/rclone-mega-extortion/
- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
tags:
analytic_story:
- DarkSide Ransomware
- Ransomware
- Insider Threat
asset_type: Endpoint
confidence: 70
impact: 50
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a
remote cloud service to move files or folders.
mitre_attack_id:
- T1020
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___disable_net_user_account.yml
+81
View File
@@ -0,0 +1,81 @@
name: Disable Net User Account
id: ba858b08-d26c-11eb-af9b-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This analytic will identify a suspicious command-line that disables a
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
may used by the adversaries to interrupt availability of accounts and continue the
impact against the organization.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: user
selection2:
cmd_line|contains: /active:no
selection3:
process_name:
- net.exe
- net1.exe
condition: selection1 and selection2 and (selection3)
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
used.
known_false_positives: System administrators or automated scripts may disable an account
but not a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
confidence: 70
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
mitre_attack_id:
- T1489
- T1078
observable:
- name: user
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
+85
View File
@@ -0,0 +1,85 @@
name: DNS Exfiltration Using Nslookup App
id: 2452e632-9e0d-11eb-34ba-acde48001122
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search is to detect potential DNS exfiltration using nslookup application.
This technique are seen in couple of malware and APT group to exfiltrated collected
data in a infected machine or infected network. This detection is looking for unique
use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
commonly used by attacker and also the retry parameter which is designed to query
C2 DNS multiple tries.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- -retry=
- -type=
- -q=
- -qt=
- -querytype=
process_name: nslookup.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: It is possible for some legitimate administrative utilities
to use similar cmd_line parameters. Filter as needed.
references:
- https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings
- https://www.varonis.com/blog/dns-tunneling
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
tags:
analytic_story:
- Suspicious DNS Traffic
- Dynamic DNS
- Data Exfiltration
- Command And Control
asset_type: Endpoint
confidence: 80
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related
to DNS exfiltration.
mitre_attack_id:
- T1048
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 72
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml
+76
View File
@@ -0,0 +1,76 @@
name: Fsutil Zeroing File
id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search is to detect a suspicious fsutil process to zeroing a target
file. This technique was seen in lockbit ransomware where it tries to zero out its
malware path as part of its defense evasion after encrypting the compromised host.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: setzerodata
process_name: fsutil.exe
condition: (selection1)
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
tags:
analytic_story:
- Ransomware
- Insider Threat
- Information Sabotage
asset_type: Endpoint
confidence: 90
impact: 60
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file
deletion.
mitre_attack_id:
- T1070
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 54
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml
+69
View File
@@ -0,0 +1,69 @@
name: Grant Permission Using Cacls Utility
id: c6da561a-cd29-11eb-ae65-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the grant permission on a file or directory. Adversaries
perform this behavior to allow components of their files to run, however it allows
responders to review or gaining access to adversary files on disk.
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- icacls.exe
- xcacls.exe
- cacls.exe
cmd_line|re: grant
condition: (selection1)
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: System administrators may use cacls utilities but this is not
a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
- Insider Threat
asset_type: Endpoint
confidence: 70
impact: 50
message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
user a permission to a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+67
View File
@@ -0,0 +1,67 @@
name: Hiding Files And Directories With Attrib exe
id: 028e4406-6176-11ec-aec2-acde48001122
version: 1
date: '2021-12-20'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
as hidden by using specific flags so that the victim does not see the file. The
search looks for specific command-line arguments to detect the use of attrib.exe
to hide files.
data_source:
- Windows Security 4688
search:
selection1:
process_name: attrib.exe
cmd_line|re: ''
condition: selection1
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: 'Some applications and users may legitimately use attrib.exe
to interact with the files. '
references:
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Persistence Techniques
- Information Sabotage
- Insider Threat
asset_type: Endpoint
confidence: 90
impact: 80
message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
mitre_attack_id:
- T1222.001
- T1222
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Endpoint
role:
- Victim
- name: parent_process
type: Other
role:
- Attacker
- Parent Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
kill_chain_phases:
- Exploitation
risk_score: 72
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+74
View File
@@ -0,0 +1,74 @@
name: Modify ACLs Permission Of Files Or Folders
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
version: 3
date: '2022-03-17'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic identifies suspicious modification of ACL permission to
a files or folder to make it available to everyone or to a specific user. This technique
may be used by the adversary to evade ACLs or protected files access. This changes
is commonly configured by the file or directory owner with appropriate permission.
This behavior raises suspicion if this command is seen on an endpoint utilized by
an account with no permission to do so.
data_source:
- Windows Security 4688
search:
selection1:
process|re:
- 'S-1-1-0:'
- 'SYSTEM:'
- 'everyone:'
selection2:
process_name:
- icacls.exe
- xcacls.exe
- cacls.exe
condition: (selection1) and (selection2)
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
known_false_positives: System administrators may use this windows utility. filter
is needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
analytic_story:
- XMRig
asset_type: Endpoint
confidence: 70
impact: 50
message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml
+80
View File
@@ -0,0 +1,80 @@
name: Office Product Spawning Windows Script Host
id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
version: 1
date: '2022-10-12'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic will identify a Windows Office Product spawning
WScript.exe or CScript.exe. Tuning may be required based on legitimate application
usage that may spawn scripts from an Office product.
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- cscript.exe
- wscript.exe
parent_process_name|re:
- visio.exe
- mspub.exe
- powerpnt.exe
- excel.exe
- winword.exe
condition: selection1
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present based on macro based approved
documents in the organization. Filtering may be needed.
references:
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
tags:
analytic_story:
- Spearphishing Attachments
asset_type: Endpoint
confidence: 90
impact: 70
message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious
child process $process_name$ on host $dest$.
mitre_attack_id:
- T1566
- T1566.001
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
kill_chain_phases:
- Exploitation
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
source: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml
+81
View File
@@ -0,0 +1,81 @@
name: Resize Shadowstorage Volume
id: dbc30554-d27e-11eb-9e5e-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies the resizing of shadowstorage using
vssadmin.exe to avoid the shadow volumes being made again. This technique is typically
found used by adversaries during a ransomware event and a precursor to deleting
the shadowstorage.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: shadowstorage
selection2:
cmd_line|contains: resize
selection3:
cmd_line|contains: maxsize
selection4:
process_name: vssadmin.exe
condition: selection1 and selection2 and selection3 and selection4
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: System administrators may resize the shadowstorage for valid
purposes. Filter as needed.
references:
- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
analytic_story:
- Clop Ransomware
- Ransomware
asset_type: Endpoint
confidence: 80
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow
copy to perform offline password cracking.
mitre_attack_id:
- T1489
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 64
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___sdelete_application_execution.yml
+107
View File
@@ -0,0 +1,107 @@
name: Sdelete Application Execution
id: fcc52b9a-4616-11ec-8454-acde48001122
version: 1
date: '2021-11-15'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic will detect the execution of sdelete.exe attempting to
delete potentially important files that may related to adversary or insider threats
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
to securely delete files on disk. This tool is commonly used to clear tracks and
artifact on the targeted host.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- .xls
- .gz
- .tar
- .rar
- .zip
- .7z
- .bmp
- .gif
- .png
- .jpg
- .txt
- .log
- .key
- .pdf
- .rtf
- .ppt
- .xls
- .doc
- -nobanner
- /accepteula
- '-z '
- '-s '
- '-q '
- '-r '
- '-p '
- '-f '
- '-c '
process_name|contains: sdelete
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives should be limited, filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
tags:
analytic_story:
- Information Sabotage
- Insider Threat
asset_type: Endpoint
confidence: 70
impact: 60
message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
to permanently delete files by $dest_user_id$.
mitre_attack_id:
- T1485
- T1070.004
- T1070
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest
- user
- parent_process_name
- parent_process
- process_name
- process
- process_id
- process_path
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 42
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml
+624
View File
@@ -0,0 +1,624 @@
name: System Process Running from Unexpected Location
id: 28179107-099a-464a-94d3-08301e6c055f
version: 4
date: '2022-03-24'
author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk
status: production
type: Anomaly
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
process from a different folder. This detection checks that a list of system processes
run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- xwizard.exe
- xpsrchvw.exe
- xcopy.exe
- wusa.exe
- wuauclt.exe
- wuapp.exe
- wuapihost.exe
- wsqmcons.exe
- wsmprovhost.exe
- wscript.exe
- write.exe
- wpr.exe
- wpnpinst.exe
- wowreg32.exe
- wlrmdr.exe
- wlanext.exe
- wksprt.exe
- wkspbroker.exe
- wisptis.exe
- winver.exe
- winrshost.exe
- winrs.exe
- winresume.exe
- winlogon.exe
- winload.exe
- wininit.exe
- wimserv.exe
- wifitask.exe
- wiawow64.exe
- wiaacmgr.exe
- whoami.exe
- where.exe
- wextract.exe
- wevtutil.exe
- wermgr.exe
- wecutil.exe
- wbengine.exe
- wbadmin.exe
- waitfor.exe
- w32tm.exe
- vssadmin.exe
- vmicsvc.exe
- verifiergui.exe
- verifier.exe
- verclsid.exe
- vdsldr.exe
- vds.exe
- userinit.exe
- upnpcont.exe
- unregmp2.exe
- unlodctr.exe
- ucsvc.exe
- tzutil.exe
- tzsync.exe
- typeperf.exe
- tskill.exe
- tsdiscon.exe
- tscon.exe
- tracerpt.exe
- tpmvscmgrsvr.exe
- tpmvscmgr.exe
- timeout.exe
- tcmsetup.exe
- taskmgr.exe
- tasklist.exe
- taskkill.exe
- taskhostw.exe
- taskhost.exe
- taskeng.exe
- takeown.exe
- tabcal.exe
- systray.exe
- systemreset.exe
- systeminfo.exe
- syskey.exe
- sxstrace.exe
- svchost.exe
- subst.exe
- srdelayed.exe
- spreview.exe
- sppsvc.exe
- spoolsv.exe
- spinstall.exe
- sort.exe
- snmptrap.exe
- smss.exe
- slui.exe
- sihost.exe
- sigverif.exe
- shutdown.exe
- shrpubw.exe
- shadow.exe
- sfc.exe
- setx.exe
- setupugc.exe
- setupcl.exe
- setspn.exe
- sethc.exe
- sessionmsg.exe
- services.exe
- secinit.exe
- sdiagnhost.exe
- sdclt.exe
- sdchange.exe
- sdbinst.exe
- schtasks.exe
- sc.exe
- sbunattend.exe
- rwinsta.exe
- runonce.exe
- rundll32.exe
- runas.exe
- rstrui.exe
- rrinstaller.exe
- rmttpmvscmgrsvr.exe
- resmon.exe
- reset.exe
- replace.exe
- repair-bde.exe
- relog.exe
- rekeywiz.exe
- regsvr32.exe
- regini.exe
- regedt32.exe
- reg.exe
- recover.exe
- recdisc.exe
- rdrleakdiag.exe
- rdpinput.exe
- rdpclip.exe
- rasphone.exe
- raserver.exe
- rasdial.exe
- rasautou.exe
- qwinsta.exe
- quser.exe
- query.exe
- qprocess.exe
- qappsrv.exe
- pwlauncher.exe
- psr.exe
- provtool.exe
- proquota.exe
- printui.exe
- printfilterpipelinesvc.exe
- print.exe
- prevhost.exe
- powercfg.exe
- poqexec.exe
- plasrv.exe
- phoneactivate.exe
- perfmon.exe
- pcwrun.exe
- pcawrk.exe
- pcaui.exe
- pcalua.exe
- p2phost.exe
- osk.exe
- openfiles.exe
- omadmprc.exe
- omadmclient.exe
- odbcconf.exe
- odbcad32.exe
- ocsetup.exe
- ntprint.exe
- ntoskrnl.exe
- nslookup.exe
- notepad.exe
- nltest.exe
- newdev.exe
- netsh.exe
- netiougc.exe
- netcfg.exe
- netbtugc.exe
- net1.exe
- net.exe
- ndadmin.exe
- nbtstat.exe
- mtstocom.exe
- mstsc.exe
- msra.exe
- mspaint.exe
- msinfo32.exe
- msiexec.exe
- mshta.exe
- msg.exe
- msfeedssync.exe
- msdtc.exe
- msdt.exe
- msconfig.exe
- mpnotify.exe
- mountvol.exe
- mobsync.exe
- mmc.exe
- mfpmp.exe
- mctadmin.exe
- mcbuilder.exe
- mblctr.exe
- manage-bde.exe
- makecab.exe
- lsm.exe
- lsass.exe
- lpremove.exe
- lpksetup.exe
- lpkinstall.exe
- logoff.exe
- logman.exe
- logagent.exe
- lodctr.exe
- licensingdiag.exe
- label.exe
- ktmutil.exe
- ksetup.exe
- klist.exe
- isoburn.exe
- iscsicpl.exe
- iscsicli.exe
- irftp.exe
- ipconfig.exe
- immersivetpmvscmgrsvr.exe
- iexpress.exe
- ieetwcollector.exe
- ieunatt.exe
- ie4uinit.exe
- icsunattend.exe
- icardagt.exe
- icacls.exe
- hwrreg.exe
- hwrcomp.exe
- help.exe
- hdwwiz.exe
- grpconv.exe
- gpupdate.exe
- gpscript.exe
- gpresult.exe
- getmac.exe
- fveprompt.exe
- fvenotify.exe
- ftp.exe
- fsutil.exe
- fsquirt.exe
- fsavailux.exe
- forfiles.exe
- fontview.exe
- fontdrvhost.exe
- fodhelper.exe
- fltmc.exe
- fixmapi.exe
- finger.exe
- findstr.exe
- find.exe
- fhmanagew.exe
- fc.exe
- extrac32.exe
- expand.exe
- eventvwr.exe
- eventcreate.exe
- eudcedit.exe
- esentutl.exe
- embeddedapplauncher.exe
- efsui.exe
- easinvoker.exe
- dxdiag.exe
- dwm.exe
- dvdupgrd.exe
- dvdplay.exe
- dstokenclean.exe
- dsregcmd.exe
- drvinst.exe
- drvcfg.exe
- driverquery.exe
- dpnsvr.exe
- dpapimig.exe
- doskey.exe
- dnscacheugc.exe
- dmclient.exe
- dmcfghost.exe
- dmcertinst.exe
- dllhst3g.exe
- dllhost.exe
- djoin.exe
- dispdiag.exe
- diskraid.exe
- diskperf.exe
- diskpart.exe
- dinotify.exe
- diantz.exe
- dialer.exe
- dfrgui.exe
- ddodiag.exe
- dcomcnfg.exe
- dccw.exe
- dashost.exe
- cttunesvr.exe
- cttune.exe
- ctfmon.exe
- csrss.exe
- cscript.exe
- credwiz.exe
- convert.exe
- control.exe
- consent.exe
- conhost.exe
- compact.exe
- comp.exe
- colorcpl.exe
- cofire.exe
- cmstp.exe
- cmmon32.exe
- cmdl32.exe
- cmdkey.exe
- cmd.exe
- clip.exe
- cliconfg.exe
- cleanmgr.exe
- cipher.exe
- choice.exe
- chkntfs.exe
- chkdsk.exe
- chgusr.exe
- chgport.exe
- chglogon.exe
- charmap.exe
- changepk.exe
- change.exe
- certutil.exe
- certreq.exe
- cdpreference.exe
- calc.exe
- cacls.exe
- bthudtask.exe
- browser_broker.exe
- bridgeunattend.exe
- bootsect.exe
- bootim.exe
- bootcfg.exe
- bitsadmin.exe
- bdeunlock.exe
- bdechangepin.exe
- bcdedit.exe
- bcdboot.exe
- bcastdvr.exe
- backgroundtaskhost.exe
- baaupdate.exe
- autofmt.exe
- autoconv.exe
- autochk.exe
- auditpol.exe
- audiodg.exe
- attrib.exe
- at.exe
- appidpolicyconverter.exe
- appidcertstorecheck.exe
- alg.exe
- aitstatic.exe
- aitagent.exe
- acu.exe
- wpcmon.exe
- workfolders.exe
- windowsupdateelevatedinstaller.exe
- windowsanytimeupgradeui.exe
- windowsanytimeupgraderesults.exe
- windowsanytimeupgrade.exe
- windowsactiondialog.exe
- windows.media.backgroundplayback.exe
- winsat.exe
- werfaultsecure.exe
- werfault.exe
- webcache.exe
- wallpaperhost.exe
- wwahost.exe
- wudfhost.exe
- wsreset.exe
- wsmanhttpconfig.exe
- wscollect.exe
- wpdshextautoplay.exe
- wmpdmc.exe
- wfs.exe
- vaultsysui.exe
- vaultcmd.exe
- vssvc.exe
- utilman.exe
- usoclient.exe
- useraccountcontrolsettings.exe
- useraccountbroker.exe
- upgraderesultsui.exe
- ui0detect.exe
- tswpfwrp.exe
- tpminit.exe
- tokenbrokercookies.exe
- thumbnailextractionhost.exe
- taskmgr.exe
- tapiunattend.exe
- tswbprxy.exe
- tstheme.exe
- tracert.exe
- tcpsvcs.exe
- systemsettingsremovedevice.exe
- systemsettingsbroker.exe
- systemsettingsadminflows.exe
- systempropertiesremote.exe
- systempropertiesprotection.exe
- systempropertiesperformance.exe
- systempropertieshardware.exe
- systempropertiesdataexecutionprevention.exe
- systempropertiescomputername.exe
- systempropertiesadvanced.exe
- sysreseterr.exe
- synchost.exe
- stikynot.exe
- srtasks.exe
- sppextcomobj.exe
- spaceagent.exe
- soundrecorder.exe
- snippingtool.exe
- sndvol.exe
- smartscreensettings.exe
- slidetoshutdown.exe
- settingsynchost.exe
- setieinstalleddate.exe
- sensordataservice.exe
- secedit.exe
- searchprotocolhost.exe
- searchindexer.exe
- searchfilterhost.exe
- sihclient.exe
- runtimebroker.exe
- runlegacycplelevated.exe
- rpcping.exe
- rmclient.exe
- remoteposworker.exe
- relpost.exe
- registeriepkeys.exe
- register-cimprovider.exe
- recoverydrive.exe
- reagentc.exe
- rdpsauachelper.exe
- rdpsaproxy.exe
- rdpsa.exe
- route.exe
- rmactivate_ssp_isv.exe
- rmactivate_ssp.exe
- rmactivate_isv.exe
- rmactivate.exe
- rdspnf.exe
- proximityuxhost.exe
- printisolationhost.exe
- printdialoghost3d.exe
- printdialoghost.exe
- printbrmui.exe
- presentationsettings.exe
- presentationhost.exe
- pnputil.exe
- pnpunattend.exe
- pkgmgr.exe
- pickerhost.exe
- passwordonwakesettingflyout.exe
- ping.exe
- pathping.exe
- optionalfeatures.exe
- openwith.exe
- networkuxbroker.exe
- netplwiz.exe
- netproj.exe
- netevtfwdr.exe
- netcfgnotifyobjecthost.exe
- narrator.exe
- netstat.exe
- napstat.exe
- musnotificationux.exe
- musnotification.exe
- multidigimon.exe
- muiunattend.exe
- msspellcheckinghost.exe
- mpsigstub.exe
- migautoplay.exe
- mdsched.exe
- mdres.exe
- mbaeparsertask.exe
- magnify.exe
- mschedexe.exe
- mrt.exe
- mrinfo.exe
- mdmappinstaller.exe
- mdmagent.exe
- mdeserver.exe
- lsaiso.exe
- logonui.exe
- lockscreencontentserver.exe
- lockapphost.exe
- locator.exe
- locationnotifications.exe
- locationnotificationwindows.exe
- licensingui.exe
- licensemanagershellext.exe
- legacynetuxhost.exe
- launchwinapp.exe
- launchtm.exe
- languagecomponentsinstallercomhandler.exe
- installagent.exe
- infdefaultinstall.exe
- icsentitlementhost.exe
- hostname.exe
- gettingstarted.exe
- genvalobj.exe
- gamepanel.exe
- fondue.exe
- filehistory.exe
- fxsunatd.exe
- fxssvc.exe
- fxscover.exe
- ehstorauthn.exe
- easeofaccessdialog.exe
- easpoliciesbrokerhost.exe
- eap3host.exe
- eosnotify.exe
- edpcleanup.exe
- dxpserver.exe
- dsmusertask.exe
- dpiscaling.exe
- dmomacpmo.exe
- dmnotificationbroker.exe
- displayswitch.exe
- dism.exe
- disksnapshot.exe
- deviceproperties.exe
- devicepairingwizard.exe
- deviceenroller.exe
- deviceeject.exe
- devicedisplayobjectprovider.exe
- defrag.exe
- dataexchangehost.exe
- dwwin.exe
- dfdwiz.exe
- credentialuibroker.exe
- computerdefaults.exe
- compattelrunner.exe
- compmgmtlauncher.exe
- cloudstoragewizard.exe
- cloudnotifications.exe
- cloudexperiencehostbroker.exe
- clipup.exe
- checknetisolation.exe
- certenrollctrl.exe
- castsrv.exe
- camerasettingsuihost.exe
- bytecodegenerator.exe
- bitlockerwizardelev.exe
- bitlockerwizard.exe
- bitlockerdeviceencryption.exe
- bdeunlockwizard.exe
- bdeuisrv.exe
- bdehdcfg.exe
- backgroundtransferhost.exe
- axinstui.exe
- autoworkplace.exe
- authhost.exe
- atbroker.exe
- applicationframehost.exe
- adaptertroubleshooter.exe
- arp.exe
selection2:
process_path|re: \\windows\\syswow64
selection3:
process_path|re: \\windows\\system32
condition: selection1 and not selection2 and not selection3
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: None
references: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Masquerading - Rename System Utilities
asset_type: Endpoint
confidence: 80
impact: 70
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path in host $dest_device_id$
mitre_attack_id:
- T1036
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- _time
- dest_user_id
- process_path
kill_chain_phases:
- Actions on Objectives
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml
+79
View File
@@ -0,0 +1,79 @@
name: WBAdmin Delete System Backups
id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
status: production
type: TTP
description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
Tool) that delete backup files. This is typically used by ransomware to prevent
recovery.
data_source:
- Windows Security 4688
search:
selection1:
process_name: wbadmin.exe
selection2:
cmd_line|contains:
- systemstatebackup
- catalog
- delete
condition: selection1 and selection2
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
- https://thedfirreport.com/2020/10/08/ryuks-return/
- https://attack.mitre.org/techniques/T1490/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
tags:
analytic_story:
- Ryuk Ransomware
- Ransomware
asset_type: Endpoint
confidence: 50
impact: 30
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system
backups.
mitre_attack_id:
- T1490
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 15
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+76
View File
@@ -0,0 +1,76 @@
name: WevtUtil Usage To Clear Logs
id: 5438113c-cdd9-11eb-93b8-acde48001122
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup,
powershell, sysmon, or system event logs.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|re:
- powershell
- setup
- application
- sysmon
- system
- security
cmd_line|contains: ' cl '
process_name: wevtutil.exe
condition: (selection1)
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: The wevtutil.exe application is a legitimate Windows event
log utility. Administrators may use it to manage Windows event logs.
references:
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
- Clop Ransomware
- Insider Threat
- CISA AA22-264A
asset_type: Endpoint
confidence: 90
impact: 70
message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
kill_chain_phases:
- Exploitation
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+71
View File
@@ -0,0 +1,71 @@
name: Wevtutil Usage To Disable Logs
id: a4bdc944-cdd9-11eb-ac97-acde48001122
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This search is to detect execution of wevtutil.exe to disable logs. This
technique was seen in several ransomware to disable the event logs to evade alerts
and detections in compromised host.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: /e:false
selection2:
cmd_line|contains: ' sl '
selection3:
process_name: wevtutil.exe
condition: selection1 and selection2 and selection3
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: network operator may disable audit event logs for debugging
purposes.
references:
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
- Insider Threat
- Information Sabotage
asset_type: Endpoint
confidence: 90
impact: 70
message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
kill_chain_phases:
- Exploitation
risk_score: 63
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml
+89
View File
@@ -0,0 +1,89 @@
name: Windows Bits Job Persistence
id: 1e25e97a-8ea4-11ec-9767-acde48001122
version: 1
date: '2022-02-15'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
The query identifies the parameters used to create, resume or add a file to a BITS
job. Typically seen combined in a oneliner or ran in sequence. If identified, review
the BITS job created and capture any files written to disk. It is possible for BITS
to be used to upload files and this may require further network data analysis to
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- resume
- setcustomheaders
- setminretrydelay
- setnotifycmdline
- setnotifyflags
- addfile
- create
process_name: bitsadmin.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
tags:
analytic_story:
- BITS Jobs
- Living Off The Land
asset_type: Endpoint
confidence: 80
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
mitre_attack_id:
- T1197
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml
+89
View File
@@ -0,0 +1,89 @@
name: Windows Bitsadmin Download File
id: d76e8188-8f5a-11ec-ace4-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
object. In addition, look for `download` or `upload` on the command-line, the switches
are not required to perform a transfer. Capture any files downloaded. Review the
reputation of the IP or domain used. Typically once executed, a follow on command
will be used to execute the dropped file. Note that the network connection or file
modification events related will not spawn or create from `bitsadmin.exe`, but the
artifacts will appear in a parallel process of `svchost.exe` with a command-line
similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
and child processes to capture any behaviors and artifacts. In some suspicious and
malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
to list out the jobs during investigation.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: transfer
process_name: bitsadmin.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
tags:
analytic_story:
- Ingress Tool Transfer
- BITS Jobs
- DarkSide Ransomware
- Living Off The Land
asset_type: Endpoint
confidence: 70
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1197
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml
+84
View File
@@ -0,0 +1,84 @@
name: Windows CertUtil Decode File
id: b06983f4-8f72-11ec-ab50-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
file that was downloaded. Once decoded, it will be loaded by a parallel process.
Note that there are two additional command switches that may be used - `encodehex`
and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
further execution. During triage, identify the source of the file being decoded.
Review its contents or execution behavior for further analysis.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: decode
process_name: certutil.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Typically seen used to `encode` files, but it is possible to
see legitimate use of `decode`. Filter based on parent-child relationship, file
paths, endpoint or user.
references:
- https://attack.mitre.org/techniques/T1140/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
tags:
analytic_story:
- Deobfuscate-Decode Files or Information
- Living Off The Land
asset_type: Endpoint
confidence: 80
impact: 50
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
on disk.
mitre_attack_id:
- T1140
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 40
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml
+84
View File
@@ -0,0 +1,84 @@
name: Windows CertUtil URLCache Download
id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: Certutil.exe may download a file from a remote destination using `-urlcache`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
data_source:
- Windows Security 4688
search:
selection1:
process_name: certutil.exe
selection2:
cmd_line|contains: split
selection3:
cmd_line|contains: urlcache
selection4:
cmd_line|contains: urlcache
condition: selection1 and selection2 and selection3 or selection4
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
asset_type: Endpoint
confidence: 100
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml
+85
View File
@@ -0,0 +1,85 @@
name: Windows CertUtil VerifyCtl Download
id: 9ac29c40-8f6b-11ec-b19a-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
\ During triage, capture any files on disk and review. Review the reputation of
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
data_source:
- Windows Security 4688
search:
selection1:
process_name: certutil.exe
selection2:
cmd_line|contains: split
selection3:
cmd_line|contains: verifyctl
selection4:
cmd_line|contains: verifyctl
condition: selection1 and selection2 and selection3 or selection4
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
asset_type: Endpoint
confidence: 100
impact: 90
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 90
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
+81
View File
@@ -0,0 +1,81 @@
name: Windows COM Hijacking InprocServer32 Modification
id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca
version: 1
date: '2022-10-12'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the use of reg.exe performing an add
to the InProcServer32, which may be related to COM hijacking. Adversaries can use
the COM system to insert malicious code that can be executed in place of legitimate
software through hijacking the COM references and relationships as a means for persistence.
Hijacking a COM object requires a change in the Registry to replace a reference
to a legitimate system component which may cause that component to not work when
executed. When that system component is executed through normal system operation
the adversary's code will be executed instead.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|re: inprocserver32
process_name: reg.exe
condition: selection1
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present and some filtering may be required.
references:
- https://attack.mitre.org/techniques/T1546/015/
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
confidence: 80
impact: 80
message: An instance of $parent_process_name$ has spawned $process_name$ attempting
to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$.
mitre_attack_id:
- T1546.015
- T1546
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 64
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+95
View File
@@ -0,0 +1,95 @@
name: Windows Curl Upload to Remote Destination
id: cc8d046a-543b-11ec-b864-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'The following analytic identifies the use of Windows Curl.exe uploading
a file to a remote destination. \
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
\
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
web application, and it is, for example, how most common HTML forms on the web work.
\
HTTP multipart formposts are done with `-F`, but this appears to not be compatible
with the Windows version of Curl. Will update if identified adversary tradecraft.
\
Adversaries may use one of the three methods based on the remote destination and
what they are attempting to upload (zip vs txt). During triage, review parallel
processes for further behavior. In addition, identify if the upload was successful
in network logs. If a file was uploaded, isolate the endpoint and review.'
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- '-F '
- '--data '
- '-d '
- '--upload-file '
- '-T '
process_name|re: curl.exe
condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives may be limited to source control applications
and may be required to be filtered out.
references:
- https://everything.curl.dev/usingcurl/uploads
- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
- https://twitter.com/d1r4c/status/1279042657508081664?s=20
tags:
analytic_story:
- Ingress Tool Transfer
- Insider Threat
asset_type: Endpoint
confidence: 100
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote
destination.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+64
View File
@@ -0,0 +1,64 @@
name: Windows Defender Tools in Non Standard Path
id: c205bd2e-cd5b-4224-8510-578a2a1f83d7
version: 1
date: '2022-07-18'
author: Lou Stella, Splunk
status: production
type: Anomaly
description: The following analytic identifies usage of the MPCmdRun utility that
can be abused by adversaries by moving it to a new directory.
data_source:
- Windows Security 4688
search:
selection1:
process_name|re: mpcmdrun.exe
selection2:
process_path|re: \\windows defender
selection3:
process_path|re: \\microsoft\\windows defender\\platform
condition: selection1 and not selection2 and not selection3
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
references:
- https://attack.mitre.org/techniques/T1036/003/
- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
confidence: 80
impact: 70
message: Process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- _time
- dest_user_id
- process_path
- cmd_line
kill_chain_phases:
- Actions on Objectives
risk_score: 56
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml
+76
View File
@@ -0,0 +1,76 @@
name: Windows Diskshadow Proxy Execution
id: aa502688-9037-11ec-842d-acde48001122
version: 1
date: '2022-02-17'
author: Lou Stella, Splunk
status: production
type: Anomaly
description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
It has a scripting mode intended for complex scripted backup operations. This feature
also allows for execution of arbitrary unsigned code. This analytic looks for the
usage of the scripting mode flags in executions of DiskShadow. During triage, compare
to known backup behavior in your environment and then review the scripts called
by diskshadow.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- /s
- -S
process_name: diskshadow.exe
condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
on processes that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators using the DiskShadow tool in their infrastructure
as a main backup tool with scripts will cause false positives
references:
- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
confidence: 70
impact: 70
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
mitre_attack_id:
- T1218
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
+124
View File
@@ -0,0 +1,124 @@
name: Windows DotNet Binary in Non Standard Path
id: 21179107-099a-324a-94d3-08301e6c065f
version: 1
date: '2022-03-17'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies native .net binaries within the Windows
operating system that may be abused by adversaries by moving it to a new directory.
The analytic identifies the .net binary by using a list. If one or the other matches
an alert will be generated. Adversaries abuse these binaries as they are native
to Windows and native DotNet. Note that not all SDK (post install of Windows) are
captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv.
data_source:
- Windows Security 4688
search:
selection1:
process_name|re:
- MSBuild.exe
- comsvcconfig.exe
- dfsradmin.exe
- dfsvc.exe
- microsoft.workflow.compiler.exe
- smsvchost.exe
- wsatconfig.exe
- addinprocess.exe
- addinprocess32.exe
- addinutil.exe
- aspnet_compiler.exe
- aspnet_regbrowsers.exe
- aspnet_regsql.exe
- caspol.exe
- datasvcutil.exe
- edmgen.exe
- installutil.exe
- jsc.exe
- ngentask.exe
- regasm.exe
- regsvcs.exe
- sdnbr.exe
- acu.exe
- appvstreamingux.exe
- dsac.exe
- lbfoadmin.exe
- microsoft.uev.synccontroller.exe
- mtedit.exe
- scriptrunner.exe
- servermanager.exe
- stordiag.exe
- tzsync.exe
- uevagentpolicygenerator.exe
- uevappmonitor.exe
- uevtemplatebaselinegenerator.exe
- uevtemplateconfigitemgenerator.exe
- powershell_ise.exe
- iediagcmd.exe
- xbox.tcui.exe
- microsoft.activedirectory.webservices.exe
- iisual.exe
- filehistory.exe
- secureassessmentbrowser.exe
selection2:
process_path|re:
- \\windows\\system32
- \\windows\\syswow64
- \\windows\\adws
- \\windows\\networkcontroller
- \\windows\\systemapps
- \\winsxs
- \\microsoft.net
condition: selection1 and not selection2
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
tags:
analytic_story:
- Masquerading - Rename System Utilities
- Unusual Processes
- Ransomware
- Signed Binary Proxy Execution InstallUtil
- WhisperGate
asset_type: Endpoint
confidence: 70
impact: 70
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
- T1218
- T1218.004
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- _time
- dest_user_id
- process_path
- cmd_line
kill_chain_phases:
- Actions on Objectives
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_eventvwr_uac_bypass.yml
+71
View File
@@ -0,0 +1,71 @@
name: Windows Eventvwr UAC Bypass
id: 66adff66-90d9-11ec-aba7-acde48001122
version: 1
date: '2022-02-18'
author: Lou Stella, Splunk
status: experimental
type: Anomaly
description: The following search identifies Eventvwr bypass by identifying the registry
modification into a specific path that eventvwr.msc looks to (but is not valid)
upon execution. A successful attack will include a suspicious command to be executed
upon eventvwr.msc loading. Upon triage, review the parallel processes that have
executed. Identify any additional registry modifications on the endpoint that may
look suspicious. Remediate as necessary.
data_source:
- Sysmon Event ID 13
search:
selection1:
process_name|contains: mscfile\\\\shell\\\\open\\\\command
condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Registry` datamodel.
known_false_positives: None known at this time.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://attack.mitre.org/techniques/T1548/002/
- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
tags:
analytic_story:
- Windows Defense Evasion Tactics
- IcedID
- Living Off The Land
asset_type: Endpoint
confidence: 100
impact: 80
message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
mitre_attack_id:
- T1548.002
- T1548
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- event_id
- registry_path
- registry_hive
- registry_value_name
- registry_key_name
- registry_value_type
- registry_value_data
- process_guid
kill_chain_phases:
- Exploitation
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml
+92
View File
@@ -0,0 +1,92 @@
name: Windows Exchange PowerShell Module Usage
id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909
version: 1
date: '2022-10-12'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'The following analytic identifies the usage of Exchange PowerShell modules
that were recently used for a proof of concept related to ProxyShell. Currently,
there is no active data shared or data we could re-produce relate to this part of
the ProxyShell chain of exploits. \
Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
and user, of the session will assist with determining the intent. \
Module - New-MailboxExportRequest will begin the process of exporting contents of
a primary mailbox or archive to a .pst file. \
Module - New-managementroleassignment can assign a management role to a management
role group, management role assignment policy, user, or universal security group
(USG). \
Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate
of search results, place search results on In-Place Hold or copy them to a Discovery
mailbox. You can also place all contents in a mailbox on hold by not specifying
a search query, which accomplishes similar results as Litigation Hold. \ Module
- Get-Recipient cmdlet to view existing recipient objects in your organization.
This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users,
mail contacts, and distribution groups).'
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|re:
- get-recipient
- new-mailboxsearch
- new-managementroleassignment
- new-mailboxexportrequest
condition: (selection1)
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
This will only work with Multiline event logs, not XML.
known_false_positives: Administrators or power users may use this PowerShell commandlet
references:
- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
- https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
- https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
tags:
analytic_story:
- ProxyShell
- CISA AA22-264A
asset_type: Endpoint
confidence: 80
impact: 40
message: Exchange enumeration using PowerShell on $dest_device_id$.
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Actions on Objectives
risk_score: 32
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+91
View File
@@ -0,0 +1,91 @@
name: Windows Execute Arbitrary Commands with MSDT
id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
version: 1
date: '2022-09-15'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies a recently disclosed arbitraty command
execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
a remote payload. During triage, review file modifications for html. Identify parallel
process execution that may be related, including an Office Product.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- ms-msdt:/id
- ms-msdt:-id
- ms-msdt:/id
- 'ms-msdt:'
- msdt
process_name: msdt.exe
selection2:
cmd_line|re:
- .xml
- it_rebrowseforfile=
- it_browseforfile=
selection3:
cmd_line|re: pcwdiagnostic
condition: selection1 and selection2 and selection3
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present, filter as needed. Added .xml
to potentially capture any answer file usage. Remove as needed.
references:
- https://isc.sans.edu/diary/rss/28694
- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
tags:
analytic_story:
- Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
asset_type: Endpoint
confidence: 100
cve:
- CVE-2022-30190
impact: 100
message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative
of indirect command execution.
mitre_attack_id:
- T1218
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 100
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+81
View File
@@ -0,0 +1,81 @@
name: Windows Ingress Tool Transfer Using Explorer
id: 695bfad6-9662-4f9e-a576-bf02a951aa60
version: 1
date: '2022-09-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the Windows Explorer process with a
URL within the command-line. Explorer.exe is known Windows process that handles
start menu, taskbar, desktop and file manager. Many adversaries abuse this process,
like DCRat malware, where it attempts to open the URL with the default browser application
on the target host by putting the URL as a parameter on explorer.exe process. This
anomaly detection might be a good pivot to check which user and how this process
was executed, what is the parent process and what is the URL link. This technique
is not commonly used to open an URL.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- https://
- http://
process_name: explorer.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints.
known_false_positives: False positives may be present based on legitimate applications
or third party utilities. Filter out any additional parent process names.
references:
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
tags:
analytic_story:
- DarkCrystal RAT
asset_type: Endpoint
confidence: 50
impact: 50
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 25
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+157
View File
@@ -0,0 +1,157 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
version: 4
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies native living off the land binaries
within the Windows operating system that may be abused by adversaries by moving
it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe,
regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- bitsadmin.exe
- certoc.exe
- certreq.exe
- certutil.exe
- cmdkey.exe
- cmdl32.exe
- cmstp.exe
- configsecuritypolicy.exe
- control.exe
- cscript.exe
- datasvcutil.exe
- desktopimgdownldr.exe
- dfsvc.exe
- diantz.exe
- diskshadow.exe
- dllhost.exe
- dnscmd.exe
- esentutl.exe
- eventvwr.exe
- expand.exe
- extexport.exe
- extrac32.exe
- findstr.exe
- finger.exe
- fltmc.exe
- forfiles.exe
- ftp.exe
- gfxdownloadwrapper.exe
- gpscript.exe
- imewdbld.exe
- ie4uinit.exe
- ieexec.exe
- ilasm.exe
- infdefaultinstall.exe
- makecab.exe
- mavinject.exe
- microsoft.workflow.compiler.exe
- mmc.exe
- msconfig.exe
- msdt.exe
- mshta.exe
- msiexec.exe
- netsh.exe
- odbcconf.exe
- offlinescannershell.exe
- pcalua.exe
- pcwrun.exe
- pktmon.exe
- pnputil.exe
- presentationhost.exe
- print.exe
- printbrm.exe
- psr.exe
- rasautou.exe
- reg.exe
- regini.exe
- register-cimprovider.exe
- regsvr32.exe
- replace.exe
- rpcping.exe
- rundll32.exe
- runonce.exe
- runscripthelper.exe
- sc.exe
- schtasks.exe
- scriptrunner.exe
- settingsynchost.exe
- syncappvpublishingserver.exe
- ttdinject.exe
- tttracer.exe
- vbc.exe
- verclsid.exe
- wab.exe
- wlrmdr.exe
- wmic.exe
- workfolders.exe
- wscript.exe
- wsreset.exe
- wuauclt.exe
- xwizard.exe
selection2:
process_path|re:
- (?i)\\windows\\system32
- (?i)\\windows\\syswow64
- (?i)\\windows\\networkcontrolle
- (?i)\\windows\\systemapps
- (?i)\\winsxs
- (?i)\\microsoft.net
condition: selection1 and not selection2
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: False positives may be present and filtering may be required.
Certain utilities will run from non-standard paths based on the third-party application
in use.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
- https://attack.mitre.org/techniques/T1036/003/
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
tags:
analytic_story:
- Unusual Processes
- Ransomware
- WhisperGate
asset_type: Endpoint
confidence: 70
impact: 70
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path on host $dest_device_id$
mitre_attack_id:
- T1036
- T1036.003
- T1218
- T1218.004
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- _time
- dest_user_id
- process_path
- cmd_line
kill_chain_phases:
- Actions on Objectives
risk_score: 49
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_mshta_child_process.yml
+86
View File
@@ -0,0 +1,86 @@
name: Windows MSHTA Child Process
id: f63f7e9c-9526-11ec-9fc7-acde48001122
version: 2
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies child processes spawning from "mshta.exe".
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, parent process
"mshta.exe" and its child process.
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- wscript.exe
- cscript.exe
- searchprotocolhost.exe
- microsoft.workflow.compiler.exe
- msbuild.exe
- colorcpl.exe
- scrcons.exe
- cmd.exe
- powershell.exe
parent_process_name|endswith: mshta.exe
condition: selection1
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
asset_type: Endpoint
confidence: 100
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1218.005
- T1218
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml
+84
View File
@@ -0,0 +1,84 @@
name: Windows MSHTA Command-Line URL
id: 9b35c538-94ef-11ec-9439-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
utility is used to make remote http connections. Adversaries may use mshta.exe to
proxy the download and execution of remote .hta files. The analytic identifies command
line arguments of http and https being used. This technique is commonly used by
malicious software to bypass preventative controls. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "rundll32.exe" and its parent process.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- https://
- http://
process_name: mshta.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: It is possible legitimate applications may perform this behavior
and will need to be filtered.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
asset_type: Endpoint
confidence: 100
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1218.005
- T1218
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml
+83
View File
@@ -0,0 +1,83 @@
name: Windows MSHTA Inline HTA Execution
id: 24962154-9524-11ec-9333-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies "mshta.exe" execution with inline protocol
handlers. "JavaScript", "VBScript", and "About" are the only supported options when
invoking HTA content directly on the command-line. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "mshta.exe" and its parent process.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- about
- javascript
- vbscript
process_name: mshta.exe
condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
asset_type: Endpoint
confidence: 100
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA,
indicative of defense evasion.
mitre_attack_id:
- T1218.005
- T1218
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml
+78
View File
@@ -0,0 +1,78 @@
name: Windows Odbcconf Load Response File
id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
version: 1
date: '2022-09-15'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the odbcconf.exe, Windows Open Database
Connectivity utility, loading up a resource file. The file extension is arbitrary
and may be named anything. The resource file itself may have different commands
supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
During triage, review file modifications and parallel processes.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- '/f '
- '-f '
process_name: odbcconf.exe
selection2:
cmd_line|contains: .rsp
condition: (selection1) and selection2
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives may be present and filtering may need to occur
based on legitimate application usage. Filter as needed.
references:
- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
confidence: 70
impact: 60
message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$
attempting to circumvent controls.
mitre_attack_id:
- T1218.008
- T1218
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 42
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+87
View File
@@ -0,0 +1,87 @@
name: Windows OS Credential Dumping with Ntdsutil Export NTDS
id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
version: 1
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
database - NTDS.dit, typically used for offline password cracking. It may be used
in normal circumstances with no command line arguments or shorthand variations of
more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
command used to dump ntds.dit \
ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
This technique uses "Install from Media" (IFM), which will extract a copy of the
Active Directory database. A successful export of the Active Directory database
will yield a file modification named ntds.dit to the destination.'
data_source:
- Windows Security 4688
search:
selection1:
process_name: ntdsutil.exe
selection2:
cmd_line|contains: create
selection3:
cmd_line|contains: ntds
condition: selection1 and (selection2 and selection3)
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Highly possible Server Administrators will troubleshoot with
ntdsutil.exe, generating false positives.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
tags:
analytic_story:
- Credential Dumping
- HAFNIUM Group
- Living Off The Land
asset_type: Endpoint
confidence: 50
impact: 100
message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by
$dest_user_id$.
mitre_attack_id:
- T1003.003
- T1003
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 50
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+86
View File
@@ -0,0 +1,86 @@
name: Windows OS Credential Dumping with Procdump
id: e102e297-dbe6-4a19-b319-5c08f4c19a06
version: 1
date: '2022-08-31'
author: Michael Haag, Splunk
status: production
type: TTP
description: 'Detect procdump.exe dumping the lsass process. This query looks for
both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
file with all process memory. Both are highly suspect and should be reviewed. This
query does not monitor for the internal name (original_file_name=procdump) of the
PE or look for procdump64.exe. Modify the query as needed.\
During triage, confirm this is procdump.exe executing. If it is the first time a
Sysinternals utility has been ran, it is possible there will be a -accepteula on
the command line. Review other endpoint data sources for cross process (injection)
into lsass.exe.'
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains:
- '-ma '
- '-mm '
process_name:
- procdump64.exe
- procdump.exe
selection2:
cmd_line|contains: lsass
condition: (selection1) and selection2
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified.
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
tags:
analytic_story:
- Credential Dumping
- HAFNIUM Group
asset_type: Endpoint
confidence: 100
impact: 80
message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$.
mitre_attack_id:
- T1003.001
- T1003
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 80
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
source: XmlWinEventLog
sourcetype: XmlWinEventLog
update_timestamp: true
dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+94
View File
@@ -0,0 +1,94 @@
name: Windows Powershell Connect to Internet With Hidden Window
id: 477e068e-8b6d-11ec-b6c1-81af21670352
version: 1
date: '2022-02-11'
author: Jose Hernandez, David Dorsey, Michael Haag Splunk
status: production
type: Anomaly
description: The following hunting analytic identifies PowerShell commands utilizing
the WindowStyle parameter to hide the window on the compromised endpoint. This combination
of command-line options is suspicious because it is overriding the default PowerShell
execution policy, attempts to hide its activity from the user, and connects to the
Internet. Removed in this version of the query is New-Object. The analytic identifies
all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter.
For example w, win, windowsty and so forth. In addition, through our research it
was identified that PowerShell will interpret different command switch types beyond
the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
data_source:
- Windows Security 4688
search:
selection1:
process_name:
- powershell_ise.exe
- powershell.exe
- sqltoolsps.exe
- sqlps.exe
- pwsh.exe
- pwsh.exe
selection2:
process|re: '(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]'
condition: selection1 and not selection2
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: Legitimate process can have this combination of command-line
options, but it's not common.
references:
- https://regexr.com/663rr
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
tags:
analytic_story:
- Malicious PowerShell
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- HAFNIUM Group
- Log4Shell CVE-2021-44228
asset_type: Endpoint
confidence: 70
impact: 50
message: PowerShell processes $process$ started with parameters to modify the execution
policy of the run, run in a hidden window, and connect to the Internet on host
$dest$ executed by user $user$.
mitre_attack_id:
- T1020
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- process
kill_chain_phases:
- Exploitation
risk_score: 35
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
source: WinEventLog:Security
dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
+69
View File
@@ -0,0 +1,69 @@
name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser
id: d57b4d91-fc91-4482-a325-47693cced1eb
version: 1
date: '2022-11-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of the `Get-ADUser` commandlet with specific parameters.
`Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows
Active Directory networks. As the name suggests, `Get-ADUser` is used to query for
domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover
domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries
alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
their passwords offline.
data_source:
- Windows Security 4688
search:
selection1:
cmd_line|contains: '4194304'
selection2:
cmd_line|re: get-aduser
condition: selection1 and selection2
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators or power users may use search for accounts with
Kerberos Pre Authentication disabled for legitimate purposes.
references:
- https://attack.mitre.org/techniques/T1558/004/
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
tags:
analytic_story:
- Active Directory Kerberos Attacks
asset_type: Endpoint
confidence: 90
impact: 60
message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest_device_id$
mitre_attack_id:
- T1558
- T1558.004
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
kill_chain_phases:
- Exploitation
risk_score: 54
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
source: WinEventLog
sourcetype: WinEventLog
update_timestamp: true

Some files were not shown because too many files have changed in this diff Show More