From e9479a7c9cba8b5c69fe63322740b82c65220ab3 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 9 Jun 2022 16:07:40 +0200 Subject: [PATCH 01/12] azorult-sfx-package --- .../attempt_to_stop_security_service.yml | 1 + .../endpoint/chcp_command_execution.yml | 1 + ...cmd_carry_out_string_command_parameter.yml | 1 + ...ate_local_admin_accounts_using_net_exe.yml | 1 + ..._cmd_exe_to_launch_script_interpreters.yml | 1 + .../excessive_attempt_to_disable_services.yml | 3 +- .../endpoint/excessive_usage_of_cacls_app.yml | 1 + .../endpoint/excessive_usage_of_net_app.yml | 1 + .../excessive_usage_of_sc_service_utility.yml | 1 + .../endpoint/excessive_usage_of_taskkill.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 1 + .../firewall_allowed_program_enable.yml | 3 +- .../hide_user_account_from_sign_in_screen.yml | 1 + ..._files_and_directories_with_attrib_exe.yml | 1 + detections/endpoint/icacls_deny_command.yml | 1 + .../endpoint/net_localgroup_discovery.yml | 1 + .../network_connection_discovery_net.yml | 1 + .../endpoint/processes_launching_netsh.yml | 1 + .../sc_exe_manipulating_windows_services.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + ...s_scheduled_task_from_public_directory.yml | 1 + stories/azorult.yml | 28 +++++++++++++++++++ 22 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 stories/azorult.yml diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 6bdebc0f31..da046b0d60 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -31,6 +31,7 @@ tags: - Disabling Security Tools - Trickbot - WhisperGate + - Azorult asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index d9651cdf68..f3da51b3d1 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - IcedID + - Azorult confidence: 30 context: - Source:Endpoint diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 7144a751a6..37830f5cf9 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -36,6 +36,7 @@ tags: - WhisperGate - Hermetic Wiper - Living Off The Land + - Azorult automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 4ab022ef07..42a9b1a862 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -26,6 +26,7 @@ references: [] tags: analytic_story: - DHS Report TA18-074A + - Azorult asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 2420c28776..6123aacee2 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -26,6 +26,7 @@ tags: analytic_story: - 'Emotet Malware DHS Report TA18-201A ' - Suspicious Command-Line Executions + - Azorult asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 705e2756d5..f0be24f660 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where - count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + count >=4 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -27,6 +27,7 @@ references: tags: analytic_story: - XMRig + - Azorult confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 212a964ee2..8e9522442c 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - XMRig + - Azorult confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 6fa2f8f347..cb8852cdb9 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -28,6 +28,7 @@ tags: analytic_story: - XMRig - Ransomware + - Azorult confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 92ae980ff3..63dfe423c4 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Ransomware + - Azorult context: - Source:Endpoint - Scope:Local diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index b25aed23dc..22c82d5e96 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - XMRig + - Azorult confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index c895a2846b..2d7567db60 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -42,6 +42,7 @@ tags: - WhisperGate - Hermetic Wiper - Industroyer2 + - Azorult automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 1e90cd0a8d..90bcb69a4f 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -13,7 +13,7 @@ description: This analytic detects a potential suspicious modification of firewa testing or allowing legitimate tool or application. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" - Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process + Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -35,6 +35,7 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion + - Azorult dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log impact: 50 diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 7948f3ac6b..7f24e93935 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -39,6 +39,7 @@ tags: analytic_story: - XMRig - Windows Registry Abuse + - Azorult confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 7321aa4b1d..0afa98a8a9 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -27,6 +27,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Persistence Techniques + - Azorult asset_type: '' cis20: - CIS 8 diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 8ff692f6cb..8cca9b176b 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - XMRig + - Azorult confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index 2c0e134c87..eb48b3e57d 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Active Directory Discovery - Windows Discovery Techniques + - Azorult confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_connection_discovery_net.yml b/detections/endpoint/network_connection_discovery_net.yml index 45a34f54d6..29133265c6 100644 --- a/detections/endpoint/network_connection_discovery_net.yml +++ b/detections/endpoint/network_connection_discovery_net.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Azorult confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 49999e959f..46770ffccf 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -32,6 +32,7 @@ tags: - Netsh Abuse - Disabling Security Tools - DHS Report TA18-074A + - Azorult asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 4889e6fdc1..fe86c4b9f8 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -29,6 +29,7 @@ tags: - Windows Persistence Techniques - Disabling Security Tools - NOBELIUM Group + - Azorult asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 70e44fae46..cc5a66a67f 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -31,6 +31,7 @@ tags: - NOBELIUM Group - Windows Persistence Techniques - Living Off The Land + - Azorult asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 000d4eb9c0..2b5dad1423 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -32,6 +32,7 @@ tags: - Ryuk Ransomware - Windows Persistence Techniques - Living Off The Land + - Azorult confidence: 50 context: - Source:Endpoint diff --git a/stories/azorult.yml b/stories/azorult.yml new file mode 100644 index 0000000000..78c485fa90 --- /dev/null +++ b/stories/azorult.yml @@ -0,0 +1,28 @@ +name: Azorult +id: efed5343-4ac2-42b1-a16d-da2428d0ce94 +version: 1 +date: '2022-06-09' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. + The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. + It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key + to establish a Remote Desktop Protocol (RDP) connection. + + Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are now the major infection vectors of the AZORult malware. + Other malware families such as Ramnit and Emotet also download AZORult. The current malspam and phishing emails use fake product order requests, invoice documents + and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information. +narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption + is the goal. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +- https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null +tags: + analytic_story: Azorult + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 58d8339184cc996e93a69a03f0de84395fae79ab Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 9 Jun 2022 16:11:51 +0200 Subject: [PATCH 02/12] Update azorult.yml --- stories/azorult.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stories/azorult.yml b/stories/azorult.yml index 78c485fa90..16d63b961f 100644 --- a/stories/azorult.yml +++ b/stories/azorult.yml @@ -15,7 +15,6 @@ description: Leverage searches that allow you to detect and investigate unusual narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal. references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null tags: analytic_story: Azorult @@ -25,4 +24,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection From 9160a479f4ad2932fda1c448d10523ce9fe480e2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 9 Jun 2022 16:18:54 +0200 Subject: [PATCH 03/12] Update firewall_allowed_program_enable.yml --- detections/endpoint/firewall_allowed_program_enable.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 90bcb69a4f..fb7ec27350 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -31,11 +31,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Azorult confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion - - Azorult dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log impact: 50 From 357808a69d9fcf791a01c011f52a271c7f745f72 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 9 Jun 2022 17:44:37 +0200 Subject: [PATCH 04/12] Update azorult.yml --- stories/azorult.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/stories/azorult.yml b/stories/azorult.yml index 16d63b961f..0be7c96409 100644 --- a/stories/azorult.yml +++ b/stories/azorult.yml @@ -8,7 +8,6 @@ description: Leverage searches that allow you to detect and investigate unusual The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key to establish a Remote Desktop Protocol (RDP) connection. - Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are now the major infection vectors of the AZORult malware. Other malware families such as Ramnit and Emotet also download AZORult. The current malspam and phishing emails use fake product order requests, invoice documents and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information. From 9baf583f068bd6f5041c234466157147211b2952 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 9 Jun 2022 17:46:04 +0200 Subject: [PATCH 05/12] Update azorult.yml --- stories/azorult.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/stories/azorult.yml b/stories/azorult.yml index 0be7c96409..d5270b90cb 100644 --- a/stories/azorult.yml +++ b/stories/azorult.yml @@ -8,9 +8,8 @@ description: Leverage searches that allow you to detect and investigate unusual The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key to establish a Remote Desktop Protocol (RDP) connection. - Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are now the major infection vectors of the AZORult malware. - Other malware families such as Ramnit and Emotet also download AZORult. The current malspam and phishing emails use fake product order requests, invoice documents - and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information. + Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are one of the major infection vectors of the AZORult malware. + The current malspam and phishing emails use fake product order requests, invoice documents and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information. narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal. references: From 2cf31f78d7e923f7ae26a43d9c5c1ecb47bedab5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 20 Jun 2022 16:12:39 +0200 Subject: [PATCH 06/12] azorult-sfx-package --- detections/endpoint/allow_operation_with_consent_admin.yml | 1 + .../endpoint/disable_defender_submit_samples_consent_feature.yml | 1 + detections/endpoint/disable_windows_behavior_monitoring.yml | 1 + detections/endpoint/disabling_remote_user_account_control.yml | 1 + detections/endpoint/windows_disableantispyware_reg.yml | 1 + 5 files changed, 5 insertions(+) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 219f2cc83b..36c69cc884 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -40,6 +40,7 @@ tags: analytic_story: - Ransomware - Windows Registry Abuse + - Azorult confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index f4d6e75115..2f9087466c 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -33,6 +33,7 @@ tags: analytic_story: - IceID - Windows Registry Abuse + - Azorult confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 27e511a6ca..7a3bca8c50 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -42,6 +42,7 @@ tags: - Ransomware - Revil Ransomware - Windows Registry Abuse + - Azorult confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index cec67662fe..f9a9f25a0f 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -27,6 +27,7 @@ tags: - Suspicious Windows Registry Activities - Remcos - Windows Registry Abuse + - Azorult asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index af508a8574..5fd40bf090 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -31,6 +31,7 @@ tags: - Ryuk Ransomware - Windows Defense Evasion Tactics - Windows Registry Abuse + - Azorult asset_type: Endpoint cis20: - CIS 8 From 79e7a23cd874a10de6185208fca05c52491d2b4f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 20 Jun 2022 16:40:54 +0200 Subject: [PATCH 07/12] azorult-sfx-package --- detections/endpoint/disable_show_hidden_files.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 4b38910f2a..f5ba08768b 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -36,6 +36,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - Azorult confidence: 100 context: - Source:Endpoint From dc22c28425edf7f8439c2a67c3e86627664350aa Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 21 Jun 2022 15:08:26 +0200 Subject: [PATCH 08/12] azorult-sfx-package --- .../endpoint/non_firefox_process_access_firefox_profile_dir.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 87d87b8111..57f268f033 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -29,6 +29,7 @@ tags: analytic_story: - FIN7 - Remcos + - Azorult confidence: 70 context: - Source:Endpoint From 07ef9a215e45d783e88ba50e432f5c684fa063fc Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 22 Jun 2022 15:04:13 +0200 Subject: [PATCH 09/12] azorult-sfx-package --- detections/endpoint/registry_keys_used_for_persistence.yml | 1 + .../endpoint/windows_defender_exclusion_registry_entry.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index c5a14cb897..c1abc8b1f7 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -56,6 +56,7 @@ tags: - IcedID - Remcos - Windows Registry Abuse + - Azorult asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 5c350e3f69..aff252f197 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Remcos - Windows Defense Evasion Tactics + - Azorult confidence: 80 context: - Source:Endpoint From 4ace852c0b1af3c7e2c705b29c30e575d256dc55 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 22 Jun 2022 16:55:51 +0200 Subject: [PATCH 10/12] azorult-sfx-package --- .../endpoint/disable_defender_blockatfirstseen_feature.yml | 1 + detections/endpoint/disable_defender_enhanced_notification.yml | 1 + detections/endpoint/disable_defender_spynet_reporting.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index b5b16d85d0..67493e64e5 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -34,6 +34,7 @@ tags: analytic_story: - IceID - Windows Registry Abuse + - Azorult confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index b55567d231..51543a90d4 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -34,6 +34,7 @@ tags: analytic_story: - IceID - Windows Registry Abuse + - Azorult confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index dcd559b377..d50493ac2d 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -33,6 +33,7 @@ tags: analytic_story: - IceID - Windows Registry Abuse + - Azorult confidence: 70 context: - Source:Endpoint From 6fa400f4f9129f712d9e657b07a372f1dff8207d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 22 Jun 2022 18:50:08 +0200 Subject: [PATCH 11/12] Update azorult.yml --- stories/azorult.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/stories/azorult.yml b/stories/azorult.yml index d5270b90cb..3da6ad44f6 100644 --- a/stories/azorult.yml +++ b/stories/azorult.yml @@ -14,6 +14,7 @@ narrative: Adversaries may use this technique to maximize the impact on the targ is the goal. references: - https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: analytic_story: Azorult category: From f6500dc1f6d0368818a15980a98e6e3cffe70fb4 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 1 Jul 2022 11:47:38 +0200 Subject: [PATCH 12/12] Update disable_defender_submit_samples_consent_feature.yml --- .../disable_defender_submit_samples_consent_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 2f9087466c..dc17013676 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: his analytic is to detect a suspicious modification of registry to disable +description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry