diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 5236bd4f97..38cd1190f8 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -6,19 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious process injection in command shell. - This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as - banking trojan. It is really uncommon to have a create remote thread execution in the following application. -search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") - | stats count min(_time) as firstTime max(_time) as lastTime - by TargetImage TargetProcessId SourceProcessId EventCode StartAddress SourceImage Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `create_remote_thread_in_shell_application_filter`' +description: This search is to detect suspicious process injection in command shell. + This technique was seen in IcedID where it execute cmd.exe process to inject its + shellcode as part of its execution as banking trojan. It is really uncommon to have + a create remote thread execution in the following application. +search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats + count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId + SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ @@ -37,24 +36,24 @@ tags: - Splunk Cloud required_fields: - _time - - SourceImage - - TargetImage - - TargetProcessId - - SourceProcessId - - StartAddress - - EventCode - - Computer + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer security_domain: endpoint impact: 70 confidence: 100 - # (impact * confidence)/100 risk_score: 70 - context: - - source: endpoint + context: + - source: endpoint - stage: Defense Evasion - message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ + message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ + in host $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim @@ -62,4 +61,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 4aa6627b89..ac10bc9de9 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -10,14 +10,13 @@ description: this detection was designed to identifies suspicious spawned proces of known MS office application due to macro or malicious code. this technique can be seen in so many malware like Icedid that used MS office as its weapon or attack vector to initially infect the machines. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") - Processes.process_name=regsvr32.exe by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name + = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") Processes.process_name=regsvr32.exe + by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_application_spawn_regsvr32_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -41,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.process_guid - - Processes.user - - Processes.dest + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.user + - Processes.dest security_domain: endpoint impact: 70 confidence: 90 - # (impact * confidence)/100 risk_score: 63 context: - Source:Endpoint @@ -62,4 +60,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index c8f30af051..4a7e38e572 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -6,24 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious rundll32.exe commandline to execute dll file. - This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted - dll payload which is the license.dat. +description: This search is to detect a suspicious rundll32.exe commandline to execute + dll file. This technique was seen in IcedID malware to load its payload dll with + the following parameter to load encrypted dll payload which is the license.dat. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*/i:* by Processes.process_name Processes.process - Processes.parent_process_name Processes.parent_process Processes.process_id - Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_icedid_rundll32_cmdline_filter`' + Processes.process=*/i:* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: limitted. this parameter is not commonly used by - windows application but can be used by the network operator. +known_false_positives: limitted. this parameter is not commonly used by windows application + but can be used by the network operator. references: - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ tags: @@ -41,25 +38,24 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest - - user + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user security_domain: endpoint impact: 70 confidence: 80 - # (impact * confidence)/100 risk_score: 56 context: - - source: endpoint + - source: endpoint - stage: Defense Evasion message: rundll32 process $process_name$ with commandline $process$ in host $dest$ observable: - - name: dest + - name: dest type: Hostname role: - Victim @@ -67,4 +63,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index 21b2d37c0a..236dd6679e 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -6,23 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious rundll32.exe process with plugininit parameter. - This technique is commonly seen in IceID malware to execute its initial dll stager to download another - payload to the compromised machine. +description: This search is to detect a suspicious rundll32.exe process with plugininit + parameter. This technique is commonly seen in IceID malware to execute its initial + dll stager to download another payload to the compromised machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*PluginInit* by Processes.process_name Processes.process - Processes.parent_process_name Processes.parent_process Processes.process_id - Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_rundll32_plugininit_filter`' + Processes.process=*PluginInit* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: third party application may used this dll export name to execute function. +known_false_positives: third party application may used this dll export name to execute + function. references: - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ tags: @@ -40,25 +38,24 @@ tags: - Splunk Cloud required_fields: - _time - - process_name + - process_name - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest - user security_domain: endpoint impact: 60 confidence: 70 - # (impact * confidence)/100 risk_score: 42 context: - - source: endpoint + - source: endpoint - stage: Defense Evasion message: rundll32 process $process_name$ with commandline $process$ in host $dest$ observable: - - name: dest + - name: dest type: Hostname role: - Victim @@ -66,4 +63,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed