Branch was auto-updated.

detections/endpoint/ssa___attempt_to_delete_services.yml

@@ -1,15 +1,13 @@
-name: Attempt To delete Services
+name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
-version: 2
-date: '2021-06-18'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint
-description: This analytic identifies suspicious series of attempt to kill multiple
-  services on a system using either `net.exe` or `sc.exe`. This technique is use by
-  adversaries to terminate security services or other related services to continue
-  there objective and evade detections.
+  - Endpoint
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: unknown
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -55,5 +53,32 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
+  impact: 60
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/ssa___attempt_to_disable_services.yml

@@ -1,15 +1,13 @@
 name: Attempt To Disable Services
 id: afb31de4-d023-11eb-98d5-acde48001122
-version: 2
-date: '2021-06-18'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
-description: This analytic will identify suspicious series of command-line to disable
-  several services. This technique is seen where the adversary attempts to disable
-  security app services or other malware services to complete the objective on the
-  compromised system.
+  - Endpoint
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
   "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,10 +25,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: unknown
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service 
 tags:
   analytic_story:
   - XMRig
@@ -59,3 +58,29 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
+  impact: 60
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/ssa___delete_a_net_user.yml

@@ -1,11 +1,11 @@
 name: Delete A Net User
 id: 8776d79c-d26e-11eb-9a56-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+  - Endpoint
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -41,10 +41,11 @@ tags:
   - CIS 16
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
-  - T1489
+  - T1531
   nist:
   - PR.AC
   - PR.IP
@@ -58,5 +59,31 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user account.
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/ssa___disable_net_user_account.yml

@@ -1,22 +1,21 @@
 name: Disable Net User Account
 id: ba858b08-d26c-11eb-af9b-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-12-01'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+  - Endpoint
 description: This analytic will identify a suspicious command-line that disables a
-  user account using the `net.exe` utility native to Windows. This technique may used
-  by the adversaries to interrupt availability of such users to do their malicious
-  act.
+  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
+  by the adversaries to interrupt availability of accounts and continue the impact against the organization.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
+  cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -27,8 +26,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
   used.
-known_false_positives: network operator may use this approach to quickly disable an
-  account but not a common practice.
+known_false_positives: System administrators or automated scripts may disable an
+  account but not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -57,5 +56,31 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: medium
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

detections/endpoint/ssa___resize_shadowstorage_volume.yml

@@ -6,12 +6,8 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytics identifies the resizing of shadowstorage by ransomware
-  malware to avoid the shadow volumes being made again. this technique is an alternative
-  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
-  team. one example of ransomware that use this technique is CLOP ransomware where
-  it drops a .bat file that will resize the shadowstorage to minimum size as much
-  as possible
+description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
+  and a precursor to deleting the shadowstorage. 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,7 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network admin can resize the shadowstorage for valid purposes.
+known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -59,5 +55,33 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow copy to perform
+    offline password cracking.
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

tests/endpoint/ssa___delete_a_net_user.test.yml

@@ -7,4 +7,9 @@ tests:
     attack_data:
       - file_name: net_user_del.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
-        source: WinEventLog:Security
+        source: WinEventLog:Security
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
+        source: WinEventLog:Security
+        
+