Merge branch 'icedid' of https://github.com/splunk/security_content into icedid

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -6,19 +6,18 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect suspicious process injection in command shell. 
-  This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as 
-  banking trojan. It is really uncommon to have a create remote thread execution in the following application.
-search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*")
-  | stats count min(_time) as firstTime max(_time) as lastTime
-  by  TargetImage TargetProcessId SourceProcessId  EventCode StartAddress SourceImage Computer 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `create_remote_thread_in_shell_application_filter`'
+description: This search is to detect suspicious process injection in command shell.
+  This technique was seen in IcedID where it execute cmd.exe process to inject its
+  shellcode as part of its execution as banking trojan. It is really uncommon to have
+  a create remote thread execution in the following application.
+search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by  TargetImage TargetProcessId
+  SourceProcessId  EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/
@@ -37,24 +36,24 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - SourceImage 
-  - TargetImage 
-  - TargetProcessId 
-  - SourceProcessId 
-  - StartAddress 
-  - EventCode 
-  - Computer 
+  - SourceImage
+  - TargetImage
+  - TargetProcessId
+  - SourceProcessId
+  - StartAddress
+  - EventCode
+  - Computer
   security_domain: endpoint
   impact: 70
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 70
-  context: 
-  - source: endpoint 
+  context:
+  - source: endpoint
   - stage: Defense Evasion
-  message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$
+  message: process $SourceImage$ create a remote thread to shell app process $TargetImage$
+    in host $Computer$
   observable:
-  - name: Computer 
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -62,4 +61,4 @@ tags:
     type: process name
     role:
     - Attacker
-  
+  automated_detection_testing: passed

detections/endpoint/office_application_spawn_regsvr32_process.yml

@@ -10,14 +10,13 @@ description: this detection was designed to identifies suspicious spawned proces
   of known MS office application due to macro or malicious code. this technique can
   be seen in so many malware like Icedid that used MS office as its weapon or attack
   vector to initially infect the machines.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
-  from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
-  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") 
-  Processes.process_name=regsvr32.exe by Processes.parent_process_name Processes.parent_process Processes.process_name 
-  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest 
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
+  = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") Processes.process_name=regsvr32.exe
+  by Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `office_application_spawn_regsvr32_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -41,18 +40,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
-  - Processes.process_guid 
-  - Processes.user 
-  - Processes.dest 
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_guid
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
   impact: 70
   confidence: 90
-  # (impact * confidence)/100
   risk_score: 63
   context:
   - Source:Endpoint
@@ -62,4 +60,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim  
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/suspicious_icedid_rundll32_cmdline.yml

@@ -6,24 +6,21 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious rundll32.exe commandline to execute dll file. 
-  This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted 
-  dll payload which is the license.dat.
+description: This search is to detect a suspicious rundll32.exe commandline to execute
+  dll file. This technique was seen in IcedID malware to load its payload dll with
+  the following parameter to load encrypted dll payload which is the license.dat.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*/i:* by  Processes.process_name Processes.process 
-  Processes.parent_process_name Processes.parent_process Processes.process_id 
-  Processes.parent_process_id Processes.dest Processes.user 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `suspicious_icedid_rundll32_cmdline_filter`'
+  Processes.process=*/i:* by  Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: limitted. this parameter is not commonly used by 
-  windows application but can be used by the network operator.
+known_false_positives: limitted. this parameter is not commonly used by windows application
+  but can be used by the network operator.
 references:
 - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
 tags:
@@ -41,25 +38,24 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name 
-  - process 
-  - parent_process_name 
-  - parent_process 
-  - process_id 
-  - parent_process_id 
-  - dest 
-  - user 
+  - process_name
+  - process
+  - parent_process_name
+  - parent_process
+  - process_id
+  - parent_process_id
+  - dest
+  - user
   security_domain: endpoint
   impact: 70
   confidence: 80
-  # (impact * confidence)/100
   risk_score: 56
   context:
-  - source: endpoint 
+  - source: endpoint
   - stage: Defense Evasion
   message: rundll32 process $process_name$ with commandline $process$ in host $dest$
   observable:
-  - name: dest 
+  - name: dest
     type: Hostname
     role:
     - Victim
@@ -67,4 +63,4 @@ tags:
     type: process name
     role:
     - Attacker
-  
+  automated_detection_testing: passed

detections/endpoint/suspicious_rundll32_plugininit.yml

@@ -6,23 +6,21 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious rundll32.exe process with plugininit parameter. 
-  This technique is commonly seen in IceID malware to execute its initial dll stager to download another 
-  payload to the compromised machine.
+description: This search is to detect a suspicious rundll32.exe process with plugininit
+  parameter. This technique is commonly seen in IceID malware to execute its initial
+  dll stager to download another payload to the compromised machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*PluginInit* by  Processes.process_name Processes.process
-  Processes.parent_process_name Processes.parent_process Processes.process_id 
-  Processes.parent_process_id Processes.dest Processes.user
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `suspicious_rundll32_plugininit_filter`'
+  Processes.process=*PluginInit* by  Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: third party application may used this dll export name to execute function.
+known_false_positives: third party application may used this dll export name to execute
+  function.
 references:
 - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
 tags:
@@ -40,25 +38,24 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name 
+  - process_name
   - process
-  - parent_process_name 
-  - parent_process 
-  - process_id 
-  - parent_process_id 
-  - dest 
+  - parent_process_name
+  - parent_process
+  - process_id
+  - parent_process_id
+  - dest
   - user
   security_domain: endpoint
   impact: 60
   confidence: 70
-  # (impact * confidence)/100
   risk_score: 42
   context:
-  - source: endpoint 
+  - source: endpoint
   - stage: Defense Evasion
   message: rundll32 process $process_name$ with commandline $process$ in host $dest$
   observable:
-  - name: dest 
+  - name: dest
     type: Hostname
     role:
     - Victim
@@ -66,4 +63,4 @@ tags:
     type: process name
     role:
     - Attacker
-  
+  automated_detection_testing: passed