From 3d3ff91c2bddfa773367bbfe9e288c52e0c2d7ec Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 17 May 2021 10:00:36 +0200 Subject: [PATCH] removed --- .../delete_shadowcopy_with_powershell.yml | 39 --------------- .../ransomware_notes_bulk_creation.yml | 49 ------------------- macros/powershell.yml | 4 -- ...delete_shadowcopy_with_powershell.test.yml | 12 ----- 4 files changed, 104 deletions(-) delete mode 100644 detections/endpoint/delete_shadowcopy_with_powershell.yml delete mode 100644 detections/endpoint/ransomware_notes_bulk_creation.yml delete mode 100644 macros/powershell.yml delete mode 100644 tests/endpoint/delete_shadowcopy_with_powershell.test.yml diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml deleted file mode 100644 index 25cb159580..0000000000 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: Delete ShadowCopy With PowerShell -id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 -version: 1 -date: '2021-05-12' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: this search is to detect powershell command to delete shadow copy using wmic powershell module. - This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded - command to delete shadow copy. This hex encoded command was able to decrypt by powershell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" - stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `delete_shadowcopy_with_powershell_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -known_false_positives: unknown -references: -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1490 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - Message - - ComputerName - - User - security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml deleted file mode 100644 index ace3740572..0000000000 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Ransomware Notes bulk creation -id: eff7919a-8330-11eb-83f8-acde48001122 -version: 1 -date: '2021-03-12' -author: Teoderick Contreras -type: batch -datamodel: -- Endpoint -description: The following analytics identifies a big number of instance of ransomware - notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This - behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your lookup table list for monitoring. -search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time - span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) - as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer - Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: unknown -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -tags: - analytic_story: - - Clop Ransomware - - DarkSide Ransomware - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log - kill_chain_phases: - - Obfuscation - mitre_attack_id: - - T1486 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - EventCode - - file_name - - _time - - TargetFilename - - Computer - - Image - - user - security_domain: endpoint diff --git a/macros/powershell.yml b/macros/powershell.yml deleted file mode 100644 index 2597ffcbd5..0000000000 --- a/macros/powershell.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: sourcetype=XmlWinEventLog:Microsoft-Windows-PowerShell/Operational -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: powershell diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml deleted file mode 100644 index b53c03377c..0000000000 --- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Delete ShadowCopy With PowerShell Unit Test -tests: -- name: Delete ShadowCopy With PowerShell - file: endpoint/delete_shadowcopy_with_powershell.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog \ No newline at end of file