diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index e0fbdd6a79..47e4a3a49c 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -34,6 +34,7 @@ tags: - Remcos - Windows Defense Evasion Tactics - WhisperGate + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 3736b1281d..7c8ab9d7b1 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -29,6 +29,7 @@ tags: - Remcos - Windows Registry Abuse - Azorult + - AgentTesla asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index aef81e69e8..8c1c101d48 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -49,6 +49,7 @@ tags: - AgentTesla - Qakbot - IcedID + - Trickbot automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index a9099039e9..cc439561e2 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - IcedID + - Qakbot confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 9cde991f53..2e3fa3b1eb 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -35,6 +35,8 @@ tags: - DarkCrystal RAT - Azorult - Remcos + - Qakbot + - AgentTesla confidence: 80 context: - Source:Endpoint @@ -47,8 +49,8 @@ tags: message: an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ mitre_attack_id: - - T1218 - - T1218.005 + - T1566 + - T1566.001 observable: - name: dest type: Hostname diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index daa22f2ea2..d82f0b92d0 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -35,6 +35,8 @@ references: tags: analytic_story: - Spearphishing Attachments + - AgentTesla + - Trickbot confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 94829d3064..a42d9572a3 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Spearphishing Attachments - IcedID + - Azorult confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 989300131b..e7812cd4fd 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -30,6 +30,7 @@ tags: - Remcos - Windows Defense Evasion Tactics - WhisperGate + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index ace0b4e214..4743a716d2 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -37,6 +37,7 @@ tags: - CISA AA22-257A - AgentTesla - Qakbot + - Trickbot asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index e412490b64..ec7cd65ee1 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -42,6 +42,7 @@ tags: analytic_story: - Active Directory Lateral Movement - Living Off The Land + - Qakbot confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 963785dc88..cf42d1b659 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -30,6 +30,8 @@ references: tags: analytic_story: - Unusual Processes + - Qakbot + - IcedID confidence: 90 context: - Stage:Execution diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 7a6f968c26..d57eb6b7ca 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - XMRig + - AgentTesla confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index d094ae78b2..a76b51042a 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -45,6 +45,8 @@ tags: - AgentTesla - Qakbot - IcedID + - Trickbot + - Azorult automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index e3499d4da1..f3c9682262 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -22,6 +22,7 @@ tags: analytic_story: - Living Off The Land - Windows Defense Evasion Tactics + - Qakbot asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index 6596f94289..3dff584824 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -22,6 +22,7 @@ references: tags: analytic_story: - Windows Drivers + - AgentTesla asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index cf86f5f721..ca569e6137 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Windows Drivers + - AgentTesla cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index c7e80d176a..259310edec 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,7 +1,7 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 version: 3 -date: '2022-08-26' +date: '2022-11-14' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -11,8 +11,8 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services. -search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name - IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) +search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*.exe" NOT (Service_File_Name + IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' @@ -29,6 +29,7 @@ tags: - Clop Ransomware - Active Directory Lateral Movement - Brute Ratel C4 + - Qakbot confidence: 80 context: - Source:Endpoint