From fe3c940162a50758a2667f2d494452bbea059110 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 3 Feb 2023 09:47:51 +0100 Subject: [PATCH 1/2] swiftslicer --- ...truction_recursive_exec_files_deletion.yml | 75 +++++++++++++++++++ .../windows_high_file_deletion_frequency.yml | 1 + stories/swiftslicer.yml | 23 ++++++ ...ion_recursive_exec_files_deletion.test.yml | 13 ++++ 4 files changed, 112 insertions(+) create mode 100644 detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml create mode 100644 stories/swiftslicer.yml create mode 100644 tests/endpoint/windows_data_destruction_recursive_exec_files_deletion.test.yml diff --git a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml new file mode 100644 index 0000000000..c752ac93e8 --- /dev/null +++ b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml @@ -0,0 +1,75 @@ +name: Windows Data Destruction Recursive Exec Files Deletion +id: 3596a799-6320-4a2f-8772-a9e98ddb2960 +version: 1 +date: '2023-02-02' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a suspicious process recursively deleting files in compromised host. + This behavior was seen in several destructive malware, wiper like caddy wiper, doublezero, and now swiftslicer that delete or + overwrite files with random generated strings to make it unrecoverable. This analytic can also catch a possible recursive file write on multiple files + using Sysmon Event 23. Sysmon treat the modified file as deleted one as soon as it was overwriten. This analytic can be a good indicator that a possible + destructive malware is running in a host machine or a big software application is being uninstalled. +search: '`sysmon` EventCode=23 TargetFilename IN ("*.exe", "*.sys", "*.dll") + | bin _time span=2m + | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by Computer user EventCode Image ProcessID + | where count >=500 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_data_destruction_recursive_exec_files_deletion_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the deleted target file name, process name and process id from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: uninstall a big software application may trigger this detection. Filter is needed. +references: +- https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-ukraine/ +tags: + analytic_story: + - Swift Slicer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/swift_slicer/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a big number of executable files being deleted in $Computer$ + mitre_attack_id: + - T1485 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Endpoint + role: + - Victim + - name: deleted_files + type: File Name + role: + - Target + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - TargetFilename + - Computer + - user + - Image + - ProcessID + - _time + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index 10743148c8..632cc7ae57 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -30,6 +30,7 @@ tags: - Clop Ransomware - WhisperGate - DarkCrystal RAT + - Swift Slicer confidence: 80 context: - Source:Endpoint diff --git a/stories/swiftslicer.yml b/stories/swiftslicer.yml new file mode 100644 index 0000000000..5a639a50a2 --- /dev/null +++ b/stories/swiftslicer.yml @@ -0,0 +1,23 @@ +name: Swift Slicer +id: 234c9dd7-52fb-4d6f-aec9-075ef88a2cea +version: 1 +date: '2023-02-01' +author: Teoderick Contreras, Rod Soto, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the swift slicer malware including overwriting of files and etc. +narrative: Swift Slicer is one of Windows destructive malware found by ESET that was used in a targeted organizarion to wipe critical files like windows drivers and other files + to destroy and left the machine inoperable. This malware like Caddy Wiper was deliver through GPO which suggests that the attacker had taken control of the victims active directory environment. +references: +- https://twitter.com/ESETresearch/status/1618960022150729728 +- https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-ukraine/ +tags: + analytic_story: Swift Slicer + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/windows_data_destruction_recursive_exec_files_deletion.test.yml b/tests/endpoint/windows_data_destruction_recursive_exec_files_deletion.test.yml new file mode 100644 index 0000000000..e148ba6b9c --- /dev/null +++ b/tests/endpoint/windows_data_destruction_recursive_exec_files_deletion.test.yml @@ -0,0 +1,13 @@ +name: Windows Data Destruction Recursive Exec Files Deletion Unit Test +tests: +- name: Windows Data Destruction Recursive Exec Files Deletion + file: endpoint/windows_data_destruction_recursive_exec_files_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/swift_slicer/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 0b1f09fda79b27c814cdd268231affc691bf687a Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 3 Feb 2023 09:52:47 +0100 Subject: [PATCH 2/2] swiftslicer --- ...windows_data_destruction_recursive_exec_files_deletion.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml index c752ac93e8..29e0582e73 100644 --- a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml +++ b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a suspicious process recursively deleting files in compromised host. +description: The following analytic identifies a suspicious process recursively deleting files in a compromised host. This behavior was seen in several destructive malware, wiper like caddy wiper, doublezero, and now swiftslicer that delete or overwrite files with random generated strings to make it unrecoverable. This analytic can also catch a possible recursive file write on multiple files - using Sysmon Event 23. Sysmon treat the modified file as deleted one as soon as it was overwriten. This analytic can be a good indicator that a possible + using Sysmon Event 23. Sysmon treats the modified file as a deleted one as soon as it was overwritten. This analytic can be a good indicator that a possible destructive malware is running in a host machine or a big software application is being uninstalled. search: '`sysmon` EventCode=23 TargetFilename IN ("*.exe", "*.sys", "*.dll") | bin _time span=2m