From 9941b8009d40f71a653ecd739dcc5a789f7c6043 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:13:24 -0400 Subject: [PATCH 1/8] fixing issue with printservice macro --- macros/printservice.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/printservice.yml b/macros/printservice.yml index b9da8fea7c..02f97ed5b5 100644 --- a/macros/printservice.yml +++ b/macros/printservice.yml @@ -1,4 +1,4 @@ -definition: source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +definition: source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: printservice From e3b816088b26ddb69d67a3ab70fdae1334eb4e53 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:30:32 -0400 Subject: [PATCH 2/8] fixing issues with detection --- ...mgr_process_connecting_to_ip_check_web_services.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 7df34f9c2c..e6b0890526 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -1,8 +1,8 @@ name: Wermgr Process Connecting To IP Check Web Services id: ed313326-a0f9-11eb-a89c-acde48001122 -version: 1 -date: '2021-04-19' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-06-01' +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint @@ -17,8 +17,8 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") - | stats min(_time) as firstTime max(_time) as lastTime count by process_path - process_name process_id QueryName QueryStatus QueryResults Computer EventCode | + | stats min(_time) as firstTime max(_time) as lastTime count by Image + process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from From f4cd60d8b509534eeccaf3d8d3358d660cd00321 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:40:06 -0400 Subject: [PATCH 3/8] fixing wrong field name --- .../endpoint/windows_installutil_credential_theft.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index d2bf537944..d0c6050e63 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -1,8 +1,8 @@ name: Windows InstallUtil Credential Theft id: ccfeddec-43ec-11ec-b494-acde48001122 -version: 1 -date: '2021-11-12' -author: Michael Haag, Splunk +version: 2 +date: '2022-06-01' +author: Michael Haag, Mauricio Velazo, Splunk type: TTP datamodel: - Endpoint @@ -23,7 +23,7 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina processes. Capture any artifacts and review further.' search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime - by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer + by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting From c60117fb6be3bf23eed09e78506e129ca73f18f5 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:45:16 -0400 Subject: [PATCH 4/8] fixing broken detection to avoid using non-existing fields --- .../suspicious_process_with_discord_dns_query.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index c6f3f4b6fe..0724a6c5fb 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -1,8 +1,8 @@ name: Suspicious Process With Discord DNS Query id: 4d4332ae-792c-11ec-89c1-acde48001122 -version: 1 -date: '2022-01-19' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-06-01' +author: Teoderick Contreras, Mauricio Velazco, Splunk type: Anomaly datamodel: - Endpoint @@ -12,9 +12,9 @@ description: This analytic identifies a process making a DNS query to Discord, a external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" - AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats + AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus - process_name QueryResults Computer process_path | `security_content_ctime(firstTime)` + process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`' how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query. known_false_positives: Noise and false positive can be seen if the following instant @@ -68,7 +68,6 @@ tags: - process_name - QueryResults - Computer - - process_path risk_score: 64 security_domain: endpoint asset_type: Endpoint From f79d1ddb2300932fa927c6e4fc07e0c71958081e Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 14:07:23 -0400 Subject: [PATCH 5/8] fixing wrong field name --- .../endpoint/mshtml_module_load_in_office_product.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 4a7bb55824..b8f229bd70 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -1,8 +1,8 @@ name: MSHTML Module Load in Office Product id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 1 -date: '2021-09-09' -author: Michael Haag, Splunk +version: 2 +date: '2022-06-01' +author: Michael Haag, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint @@ -14,7 +14,7 @@ description: The following detection identifies the module load of mshtml.dll in search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, - ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` + ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using From 7686814bc7f3bce9a2106f43bd95b6ff06b755e3 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 14:18:11 -0400 Subject: [PATCH 6/8] fixing wrong field name --- detections/endpoint/spoolsv_suspicious_loaded_modules.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 846127e4b0..c602c1ba3c 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -1,6 +1,6 @@ name: Spoolsv Suspicious Loaded Modules id: a5e451f8-da81-11eb-b245-acde48001122 -version: 1 +version: 2 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: TTP @@ -12,7 +12,7 @@ description: This search is to detect suspicious loading of dll in specific path search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer - process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` + ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you From 41c6cdbfae9fa23990fbe5da73a39c19621bb015 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Jun 2022 15:34:29 -0400 Subject: [PATCH 7/8] fixing wrong field name --- .../endpoint/suspicious_process_with_discord_dns_query.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 0724a6c5fb..dc874c2702 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -11,7 +11,7 @@ description: This analytic identifies a process making a DNS query to Discord, a by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. -search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" +search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` From ec0c39c8d5c8a8db797dce0c1963d629041f9bc4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Jun 2022 16:24:39 -0400 Subject: [PATCH 8/8] updating wrong field --- detections/endpoint/mshtml_module_load_in_office_product.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index b8f229bd70..10ec4eb2d1 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -14,7 +14,7 @@ description: The following detection identifies the module load of mshtml.dll in search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, - ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` + ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using