mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
Bhavin Patel
+1
-1
@@ -15,7 +15,7 @@ import re
|
||||
from attackcti import attack_client
|
||||
import csv
|
||||
import shutil
|
||||
from bin.yaml_to_json import Yaml2Json
|
||||
from yaml_to_json import Yaml2Json
|
||||
import os
|
||||
import json
|
||||
|
||||
|
||||
@@ -2,6 +2,7 @@ import os
|
||||
import sys
|
||||
import argparse
|
||||
from bin import validate as validator
|
||||
sys.path.append('bin')
|
||||
from bin import generate as generator
|
||||
from bin import newcontent as content
|
||||
from pathlib import Path
|
||||
|
||||
+54
-18
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-11-10T15:58:56 UTC
|
||||
# On Date: 2021-11-17T12:46:53 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -518,7 +518,7 @@ version = 1
|
||||
references = ["https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/", "https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Regsvr32 Cmdline - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule"]
|
||||
searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"]
|
||||
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.
|
||||
narrative = IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains "license.dat" which is the actual core icedid bot.
|
||||
|
||||
@@ -529,7 +529,7 @@ version = 1
|
||||
references = ["https://attack.mitre.org/techniques/T1105/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Suspicious Curl Network Connection - Rule"]
|
||||
searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - Windows Curl Upload to Remote Destination - Rule"]
|
||||
description = Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.
|
||||
narrative = Ingress tool transfer is a Technique under tactic Command and Control. Behaviors will include the use of living off the land binaries to download implants or binaries over alternate communication ports. It is imperative to baseline applications on endpoints to understand what generates network activity, to where, and what is its native behavior. These utilities, when abused, will write files to disk in world writeable paths.\ During triage, review the reputation of the remote public destination IP or domain. Capture any files written to disk and perform analysis. Review other parrallel processes for additional behaviors.
|
||||
|
||||
@@ -1133,7 +1133,7 @@ version = 1
|
||||
references = ["https://attack.mitre.org/techniques/T1218/010/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md", "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Malicious InProcServer32 Modification - Rule", "ESCU - Regsvr32 Silent Param Dll Loading - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule"]
|
||||
searches = ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Malicious InProcServer32 Modification - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule"]
|
||||
description = Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code.
|
||||
narrative = One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo" using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads. Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious.
|
||||
|
||||
@@ -1311,7 +1311,7 @@ version = 2
|
||||
references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
|
||||
searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
|
||||
description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
|
||||
narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
|
||||
|
||||
@@ -6668,16 +6668,26 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"
|
||||
known_false_positives = There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Regsvr32 Silent Param Dll Loading - Rule]
|
||||
[savedsearch://ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
explanation = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL on the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot by the parent process, parent command-line and command-line of the file that execute this regsvr32.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
|
||||
known_false_positives = Other third part application may used this parameter but not so common in base windows environment.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download and decrypt the config payload. The switch type may be either a hyphen `-` or forward slash `/`. This behavior is typically found with `-s`, and it is possible there are more switch types that may be used. \ During triage, review parallel processes and capture any artifacts that may have landed on disk. Isolate and contain the endpoint as necessary.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
|
||||
known_false_positives = minimal. but network operator can use this application to load dll.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Remcos RAT File Creation in Remcos Folder - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
@@ -7484,16 +7494,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
|
||||
known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Suspicious IcedID Regsvr32 Cmdline - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader that will download and decrypt the config payload.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
|
||||
known_false_positives = minimal. but network operator can use this application to load dll.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Suspicious IcedID Rundll32 Cmdline - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
@@ -8205,6 +8205,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["
|
||||
known_false_positives = False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows. Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.
|
||||
how_to_implement = Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"]}
|
||||
known_false_positives = False positives will be present. Filter based on ActionName paths or specify keywords of interest.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - WinRM Spawning a Process - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
@@ -8225,6 +8235,32 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre
|
||||
known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Windows Curl Download to Suspicious Path - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \
|
||||
-O or --output is used when a file is to be downloaded and placed in a specified location. \
|
||||
During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
|
||||
known_false_positives = It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Windows Curl Upload to Remote Destination - Rule]
|
||||
type = detection
|
||||
asset_type =
|
||||
confidence = medium
|
||||
explanation = The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \
|
||||
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
|
||||
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
|
||||
HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
|
||||
Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1105"]}
|
||||
known_false_positives = False positives may be limited to source control applications and may be required to be filtered out.
|
||||
providing_technologies = []
|
||||
|
||||
[savedsearch://ESCU - Windows DisableAntiSpyware Registry - Rule]
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-11-10T15:58:56 UTC
|
||||
# On Date: 2021-11-17T12:46:53 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
Vendored
+26
-6
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-11-10T15:58:56 UTC
|
||||
# On Date: 2021-11-17T12:46:53 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -282,6 +282,10 @@ description = Matches the process with its original file name, data for this mac
|
||||
definition = (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_curl]
|
||||
definition = (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
|
||||
[process_dllhost]
|
||||
definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
|
||||
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
|
||||
@@ -475,6 +479,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
|
||||
definition = eventtype=wineventlog_system
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[wineventlog_task_scheduler]
|
||||
definition = source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
|
||||
[wmi]
|
||||
definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
|
||||
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
||||
@@ -2975,7 +2983,11 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[regsvr32_silent_param_dll_loading_filter]
|
||||
[regsvr32_silent_and_install_param_dll_loading_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[regsvr32_with_known_silent_switch_cmdline_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
@@ -3299,10 +3311,6 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[suspicious_icedid_regsvr32_cmdline_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[suspicious_icedid_rundll32_cmdline_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -3583,6 +3591,10 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[winevent_windows_task_scheduler_event_action_started_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[winrm_spawning_a_process_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
@@ -3591,6 +3603,14 @@ description = Update this macro to limit the output results to filter out false
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_curl_download_to_suspicious_path_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_curl_upload_to_remote_destination_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
[windows_disableantispyware_registry_filter]
|
||||
definition = search *
|
||||
description = Update this macro to limit the output results to filter out false positives.
|
||||
|
||||
Vendored
+216
-63
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-11-10T15:58:56 UTC
|
||||
# On Date: 2021-11-17T12:46:52 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -766,8 +766,8 @@ action.escu.data_models = []
|
||||
action.escu.eli5 = The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated.
|
||||
action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
|
||||
action.escu.known_false_positives = It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
|
||||
action.escu.creation_date = 2021-04-05
|
||||
action.escu.modification_date = 2021-04-05
|
||||
action.escu.creation_date = 2021-11-12
|
||||
action.escu.modification_date = 2021-11-12
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - AWS IAM AccessDenied Discovery Events - Rule
|
||||
action.escu.search_type = detection
|
||||
@@ -794,7 +794,7 @@ relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`
|
||||
search = `cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`
|
||||
|
||||
[ESCU - AWS IAM Assume Role Policy Brute Force - Rule]
|
||||
action.escu = 0
|
||||
@@ -19807,7 +19807,7 @@ relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`
|
||||
search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `office_application_drop_executable_filter`
|
||||
|
||||
[ESCU - Office Application Spawn Regsvr32 process - Rule]
|
||||
action.escu = 0
|
||||
@@ -19897,7 +19897,7 @@ relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") `process_rundll32` by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") AND `process_rundll32` by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`
|
||||
|
||||
[ESCU - Office Document Creating Schedule Task - Rule]
|
||||
action.escu = 0
|
||||
@@ -22660,38 +22660,38 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_for_creating_shim_databases_filter`
|
||||
|
||||
[ESCU - Regsvr32 Silent Param Dll Loading - Rule]
|
||||
[ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32.
|
||||
description = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL on the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot by the parent process, parent command-line and command-line of the file that execute this regsvr32.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.eli5 = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL on the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot by the parent process, parent command-line and command-line of the file that execute this regsvr32.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
action.escu.known_false_positives = Other third part application may used this parameter but not so common in base windows environment.
|
||||
action.escu.creation_date = 2021-10-04
|
||||
action.escu.modification_date = 2021-10-04
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Regsvr32 Silent Param Dll Loading - Rule
|
||||
action.escu.full_search_name = ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = []
|
||||
action.escu.analytic_story = ["Suspicious Regsvr32 Activity"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = regsvr32 process with $process$ commandline in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}]
|
||||
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and dllinstall parameter.
|
||||
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
|
||||
action.risk.param.verbose = 0
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Regsvr32 Silent Param Dll Loading - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
|
||||
action.correlationsearch.label = ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = ['user', 'dest']
|
||||
action.notable.param.rule_description = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32.
|
||||
action.notable.param.rule_title = Regsvr32 Silent Param Dll Loading
|
||||
action.notable.param.rule_description = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL on the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot by the parent process, parent command-line and command-line of the file that execute this regsvr32.
|
||||
action.notable.param.rule_title = Regsvr32 Silent and Install Param Dll Loading
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
alert.digest_mode = 1
|
||||
@@ -22703,7 +22703,52 @@ relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` AND Processes.process="*/i*" by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_silent_and_install_param_dll_loading_filter`
|
||||
|
||||
[ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download and decrypt the config payload. The switch type may be either a hyphen `-` or forward slash `/`. This behavior is typically found with `-s`, and it is possible there are more switch types that may be used. \ During triage, review parallel processes and capture any artifacts that may have landed on disk. Isolate and contain the endpoint as necessary.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download and decrypt the config payload. The switch type may be either a hyphen `-` or forward slash `/`. This behavior is typically found with `-s`, and it is possible there are more switch types that may be used. \ During triage, review parallel processes and capture any artifacts that may have landed on disk. Isolate and contain the endpoint as necessary.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
action.escu.known_false_positives = minimal. but network operator can use this application to load dll.
|
||||
action.escu.creation_date = 2021-07-27
|
||||
action.escu.modification_date = 2021-07-27
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = []
|
||||
action.escu.analytic_story = ["IcedID", "Suspicious Regsvr32 Activity"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter.
|
||||
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
|
||||
action.risk.param.verbose = 0
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Suspicious Regsvr32 Activity"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = ['user', 'dest']
|
||||
action.notable.param.rule_description = The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download and decrypt the config payload. The switch type may be either a hyphen `-` or forward slash `/`. This behavior is typically found with `-s`, and it is possible there are more switch types that may be used. \ During triage, review parallel processes and capture any artifacts that may have landed on disk. Isolate and contain the endpoint as necessary.
|
||||
action.notable.param.rule_title = Regsvr32 with Known Silent Switch Cmdline
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_with_known_silent_switch_cmdline_filter`
|
||||
|
||||
[ESCU - Remcos RAT File Creation in Remcos Folder - Rule]
|
||||
action.escu = 0
|
||||
@@ -26210,51 +26255,6 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`
|
||||
|
||||
[ESCU - Suspicious IcedID Regsvr32 Cmdline - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader that will download and decrypt the config payload.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader that will download and decrypt the config payload.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
action.escu.known_false_positives = minimal. but network operator can use this application to load dll.
|
||||
action.escu.creation_date = 2021-07-27
|
||||
action.escu.modification_date = 2021-07-27
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Suspicious IcedID Regsvr32 Cmdline - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = []
|
||||
action.escu.analytic_story = ["IcedID"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = regsvr32 process $process_name$ with commandline $process$ in host $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process name"}]
|
||||
action.risk.param.verbose = 0
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Suspicious IcedID Regsvr32 Cmdline - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = ['user', 'dest']
|
||||
action.notable.param.rule_description = this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader that will download and decrypt the config payload.
|
||||
action.notable.param.rule_title = Suspicious IcedID Regsvr32 Cmdline
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*-s* by Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`
|
||||
|
||||
[ESCU - Suspicious IcedID Rundll32 Cmdline - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
@@ -29323,6 +29323,51 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_to_spawn_shell_filter`
|
||||
|
||||
[ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows. Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"]}
|
||||
action.escu.data_models = []
|
||||
action.escu.eli5 = The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows. Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.
|
||||
action.escu.how_to_implement = Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message.
|
||||
action.escu.known_false_positives = False positives will be present. Filter based on ActionName paths or specify keywords of interest.
|
||||
action.escu.creation_date = 2021-10-19
|
||||
action.escu.modification_date = 2021-10-19
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = []
|
||||
action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = A Scheduled Task was scheduled and ran on $dest$.
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}]
|
||||
action.risk.param.verbose = 0
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Persistence Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = ['dest']
|
||||
action.notable.param.rule_description = The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows. Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze.
|
||||
action.notable.param.rule_title = WinEvent Windows Task Scheduler Event Action Started
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = `wineventlog_task_scheduler` EventCode IN ("200","201") | rename ComputerName as dest | stats count min(_time) as firstTime max(_time) as lastTime by Message dest EventCode category | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_windows_task_scheduler_event_action_started_filter`
|
||||
|
||||
[ESCU - WinRM Spawning a Process - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
@@ -29405,6 +29450,114 @@ realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`
|
||||
|
||||
[ESCU - Windows Curl Download to Suspicious Path - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \
|
||||
-O or --output is used when a file is to be downloaded and placed in a specified location. \
|
||||
During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \
|
||||
-O or --output is used when a file is to be downloaded and placed in a specified location. \
|
||||
During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
action.escu.known_false_positives = It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
|
||||
action.escu.creation_date = 2021-10-19
|
||||
action.escu.modification_date = 2021-10-19
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Windows Curl Download to Suspicious Path - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = []
|
||||
action.escu.analytic_story = ["IceID", "Ingress Tool Transfer"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
|
||||
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
|
||||
action.risk.param.verbose = 0
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Windows Curl Download to Suspicious Path - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = ['user', 'dest']
|
||||
action.notable.param.rule_description = The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \
|
||||
-O or --output is used when a file is to be downloaded and placed in a specified location. \
|
||||
During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze.
|
||||
action.notable.param.rule_title = Windows Curl Download to Suspicious Path
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_download_to_suspicious_path_filter`
|
||||
|
||||
[ESCU - Windows Curl Upload to Remote Destination - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \
|
||||
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
|
||||
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
|
||||
HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
|
||||
Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1105"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \
|
||||
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
|
||||
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
|
||||
HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
|
||||
Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
action.escu.known_false_positives = False positives may be limited to source control applications and may be required to be filtered out.
|
||||
action.escu.creation_date = 2021-11-10
|
||||
action.escu.modification_date = 2021-11-10
|
||||
action.escu.confidence = high
|
||||
action.escu.full_search_name = ESCU - Windows Curl Upload to Remote Destination - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = []
|
||||
action.escu.analytic_story = ["Ingress Tool Transfer"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination.
|
||||
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
|
||||
action.risk.param.verbose = 0
|
||||
cron_schedule = 0 * * * *
|
||||
dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Windows Curl Upload to Remote Destination - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = ['user', 'dest']
|
||||
action.notable.param.rule_description = The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \
|
||||
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
|
||||
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
|
||||
HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
|
||||
Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.
|
||||
action.notable.param.rule_title = Windows Curl Upload to Remote Destination
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
enableSched = 1
|
||||
allow_skew = 100%
|
||||
counttype = number of events
|
||||
relation = greater than
|
||||
quantity = 0
|
||||
realtime_schedule = 0
|
||||
is_visible = false
|
||||
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`
|
||||
|
||||
[ESCU - Windows DisableAntiSpyware Registry - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2021-11-10T15:58:56 UTC
|
||||
# On Date: 2021-11-17T12:46:53 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
Reference in New Issue
Block a user