Updates + new

detections/endpoint/exchange_powershell_module_usage.yml

@@ -1,14 +1,12 @@
 name: Exchange PowerShell Module Usage
 id: 2d10095e-05ae-11ec-8fdf-acde48001122
-version: 3
-date: '2022-09-22'
+version: 4
+date: '2022-10-05'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: 'The following analytic identifies the usage of Exchange PowerShell modules
-  that were recently used for a proof of concept related to ProxyShell. Currently,
-  there is no active data shared or data we could re-produce relate to this part of
-  the ProxyShell chain of exploits.  \
+  that were recently used for a proof of concept related to ProxyShell. Adversaries may abuse a limited set of PwSh Modules related to Exchange once gained access via ProxyShell or ProxyNotShell.\
 
   Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
   and user, of the session will assist with determining the intent. \
@@ -40,22 +38,25 @@ references:
   - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
   - https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
   - https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
+  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
 tags:
   analytic_story:
   - ProxyShell
   - CISA AA22-264A
+  - ProxyNotShell
   asset_type: Endpoint
-  confidence: 50
+  confidence: 80
   context:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  dataset: []
-  impact: 30
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
+  impact: 40
   kill_chain_phases:
   - Reconnaissance
   - Exploitation
-  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  message: Suspicious Exchange PowerShell module usaged was identified on $dest$.
   mitre_attack_id:
   - T1059
   - T1059.001
@@ -75,5 +76,5 @@ tags:
   - Computer
   - UserID
   - EventCode
-  risk_score: 15
+  risk_score: 32
   security_domain: endpoint

detections/endpoint/unified_messaging_service_spawning_a_process.yml

@@ -17,8 +17,7 @@ description: This detection identifies Microsoft Exchange Server's Unified Messa
   public access to Exchange. In final, patch the vulnerablity and monitor.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe"
-  OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe"
-  OR Processes.process_name!="werfault.exe") by Processes.dest Processes.user Processes.parent_process_name
+  OR Processes.parent_process_name="UMService.exe" NOT (Processes.process_name IN ("wermgr.exe", "werfault.exe")) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `unified_messaging_service_spawning_a_process_filter`'

detections/endpoint/windows_create_local_account.yml

@@ -0,0 +1,64 @@
+name: Windows Create Local Account
+id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb
+version: 1
+date: '2022-10-05'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.
+search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
+  result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change
+  where All_Changes.result_id=4720 by 
+  All_Changes.user All_Changes.dest All_Changes.result All_Changes.action | `drop_dm_object_name("All_Changes")` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  | `windows_create_local_account_filter`'
+how_to_implement: 'This search requires you to have enabled your Group Management
+  Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More
+  information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/'
+known_false_positives: It is possible that an administrator created the account. Verifying activity with an administrator is advised. This analytic is set to anomaly to allow for risk to be added. Filter and tune as needed. Restrict to critical infrastructure to reduce any volume.
+references:
+  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
+tags:
+  analytic_story:
+  - Account Monitoring and Controls
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/4720.log
+  impact: 20
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: The following $user$ was added to $dest$ as a local account.
+  mitre_attack_id:
+  - T1136.001
+  - T1136
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - All_Changes.user 
+  - All_Changes.dest 
+  - All_Changes.result 
+  - All_Changes.action 
+  risk_score: 18
+  security_domain: endpoint

stories/cisa_aa22_277a.yml

@@ -0,0 +1,19 @@
+name: CISA AA22-277A
+id: db408f93-e915-4215-9962-5fada348bdd7
+version: 1
+date: '2022-10-05'
+author: Michael Haag, Splunk
+description: From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization's enterprise network. During incident response activities, multiple utilities were utilized.
+narrative: CISA uncovered that likely multiple APT groups compromised the organization's network, and some APT actors had long-term access to the environment. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim's sensitive data.
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-277a
+  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-277a-impacket-and-exfiltration-tool-used-to-steal-sensitive-information-from-defense-industrial-base-organization.pdf
+tags:
+  analytic_story: CISA AA22-277A
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/exchange_powershell_module_usage.test.yml

@@ -0,0 +1,12 @@
+name: Exchange PowerShell Module Usage Unit Test
+tests:
+- name: Exchange PowerShell Module Usage
+  file: endpoint/exchange_powershell_module_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

tests/endpoint/windows_create_local_account.test.yml

@@ -0,0 +1,13 @@
+name: Windows Create Local Account Unit Test
+tests:
+- name: Windows Create Local Account
+  file: endpoint/windows_create_local_account.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4720.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/4720.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true