From daa727cd9000d8981ff3d6520b3a5ff294c3166a Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 14 Nov 2022 09:54:09 +0100 Subject: [PATCH 01/11] cisa_coverage2 --- ...indows_service_created_with_suspicious_service_path.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index c7e80d176a..259310edec 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,7 +1,7 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 version: 3 -date: '2022-08-26' +date: '2022-11-14' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -11,8 +11,8 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services. -search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name - IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) +search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*.exe" NOT (Service_File_Name + IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' @@ -29,6 +29,7 @@ tags: - Clop Ransomware - Active Directory Lateral Movement - Brute Ratel C4 + - Qakbot confidence: 80 context: - Source:Endpoint From bf30249438081725de2b47f7962a7bc049319802 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 14 Nov 2022 11:22:40 +0100 Subject: [PATCH 02/11] cisa_coverage2 --- .../executables_or_script_creation_in_suspicious_path.yml | 1 + detections/endpoint/suspicious_process_file_path.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index aef81e69e8..8c1c101d48 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -49,6 +49,7 @@ tags: - AgentTesla - Qakbot - IcedID + - Trickbot automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index d094ae78b2..ea38c3d12c 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -45,6 +45,7 @@ tags: - AgentTesla - Qakbot - IcedID + - Trickbot automated_detection_testing: passed confidence: 50 context: From 0b25fa47d3059cabc3026c9f66e41bc8b33581ca Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 14 Nov 2022 13:26:41 +0100 Subject: [PATCH 03/11] cisa_coverage2 --- .../endpoint/office_application_spawn_regsvr32_process.yml | 1 + detections/endpoint/office_product_spawn_cmd_process.yml | 2 ++ detections/endpoint/office_product_spawning_certutil.yml | 1 + detections/endpoint/office_product_spawning_mshta.yml | 1 + 4 files changed, 5 insertions(+) diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index a9099039e9..cc439561e2 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - IcedID + - Qakbot confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 9cde991f53..39fdbe375a 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -35,6 +35,8 @@ tags: - DarkCrystal RAT - Azorult - Remcos + - Qakbot + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index daa22f2ea2..2e439244cc 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - AgentTesla confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 94829d3064..a42d9572a3 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Spearphishing Attachments - IcedID + - Azorult confidence: 90 context: - Source:Endpoint From 3a05118df857276ff0ea0e252adaeb2f45b1c60c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 14 Nov 2022 13:31:57 +0100 Subject: [PATCH 04/11] Update office_product_spawn_cmd_process.yml --- detections/endpoint/office_product_spawn_cmd_process.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 39fdbe375a..2e3fa3b1eb 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -49,8 +49,8 @@ tags: message: an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ mitre_attack_id: - - T1218 - - T1218.005 + - T1566 + - T1566.001 observable: - name: dest type: Hostname From bc1b90b8a63eaa92f96ddef7630930573b553d6d Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 14 Nov 2022 13:49:55 +0100 Subject: [PATCH 05/11] cisa_coverage2 --- detections/endpoint/office_product_spawning_certutil.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 2e439244cc..d82f0b92d0 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -36,6 +36,7 @@ tags: analytic_story: - Spearphishing Attachments - AgentTesla + - Trickbot confidence: 90 context: - Source:Endpoint From 05cafb7fb5c5ac767f1a2682806bd3b66651216b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 14 Nov 2022 14:50:15 +0100 Subject: [PATCH 06/11] cisa_coverage2 --- .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/services_exe_lolbas_execution_process_spawn.yml | 1 + detections/endpoint/suspicious_copy_on_system32.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index ace0b4e214..4743a716d2 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -37,6 +37,7 @@ tags: - CISA AA22-257A - AgentTesla - Qakbot + - Trickbot asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index e412490b64..ec7cd65ee1 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -42,6 +42,7 @@ tags: analytic_story: - Active Directory Lateral Movement - Living Off The Land + - Qakbot confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 963785dc88..92ea1918cb 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Unusual Processes + - Qakbot confidence: 90 context: - Stage:Execution From 834a65cacd8e70f38fbf2aef670597546ca1533d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 17 Nov 2022 09:33:11 +0100 Subject: [PATCH 07/11] Update suspicious_copy_on_system32.yml --- detections/endpoint/suspicious_copy_on_system32.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 92ea1918cb..cf42d1b659 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Unusual Processes - Qakbot + - IcedID confidence: 90 context: - Stage:Execution From 529fd647cc259e1976d04e49af2702b12773bc0f Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Nov 2022 10:21:46 +0100 Subject: [PATCH 08/11] cisa_coverage2 --- detections/endpoint/add_or_set_windows_defender_exclusion.yml | 1 + .../endpoint/powershell_windows_defender_exclusion_commands.yml | 1 + detections/endpoint/suspicious_driver_loaded_path.yml | 1 + detections/endpoint/windows_driver_load_non_standard_path.yml | 1 + detections/endpoint/windows_drivers_loaded_by_signature.yml | 1 + 5 files changed, 5 insertions(+) diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index e0fbdd6a79..47e4a3a49c 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -34,6 +34,7 @@ tags: - Remcos - Windows Defense Evasion Tactics - WhisperGate + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 989300131b..e7812cd4fd 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -30,6 +30,7 @@ tags: - Remcos - Windows Defense Evasion Tactics - WhisperGate + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 7a6f968c26..d57eb6b7ca 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - XMRig + - AgentTesla confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index 6596f94289..3dff584824 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -22,6 +22,7 @@ references: tags: analytic_story: - Windows Drivers + - AgentTesla asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index cf86f5f721..ca569e6137 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Windows Drivers + - AgentTesla cis20: - CIS 3 - CIS 5 From da754be569fada47ff96b7b06c2cf77f84095dcb Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Nov 2022 16:03:40 +0100 Subject: [PATCH 09/11] cisa_coverage2 --- .../windows_dll_search_order_hijacking_hunt_with_sysmon.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index e3499d4da1..f3c9682262 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -22,6 +22,7 @@ tags: analytic_story: - Living Off The Land - Windows Defense Evasion Tactics + - Qakbot asset_type: Endpoint cis20: - CIS 3 From 7a77d8079a36169eba9178450e3050500db704b3 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Nov 2022 16:06:19 +0100 Subject: [PATCH 10/11] cisa_coverage2 --- detections/endpoint/disabling_remote_user_account_control.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 3736b1281d..7c8ab9d7b1 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -29,6 +29,7 @@ tags: - Remcos - Windows Registry Abuse - Azorult + - AgentTesla asset_type: Endpoint cis20: - CIS 8 From 26198e8f3ca63365ba293f3c6043c1f24b41a563 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 17 Nov 2022 18:09:52 +0100 Subject: [PATCH 11/11] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index ea38c3d12c..a76b51042a 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -46,6 +46,7 @@ tags: - Qakbot - IcedID - Trickbot + - Azorult automated_detection_testing: passed confidence: 50 context: