From cb7523dfd90e216321a80159c947f612f3871bf0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 7 Jul 2022 17:46:24 +0200 Subject: [PATCH 1/2] fix-join-issue2 --- .../office_product_writing_cab_or_inf.yml | 31 +++++++++++-------- .../suspicious_wav_file_in_appdata_folder.yml | 26 +++++++++------- 2 files changed, 33 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index 1affe30763..f52fc2428d 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -1,8 +1,8 @@ name: Office Product Writing cab or inf id: f48cd1d4-125a-11ec-a447-acde48001122 -version: 1 -date: '2021-09-10' -author: Michael Haag, Splunk +version: 2 +date: '2022-07-07' +author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,16 +10,21 @@ description: The following analytic identifies behavior related to CVE-2021-4044 Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | fields _time dest file_create_time file_name file_path process_name process_path - process] | dedup file_create_time | table dest, process_name, process, file_create_time, - file_name, file_path | `office_product_writing_cab_or_inf_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | join proc_guid, _time [ + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.inf","*.cab") + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] + | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid + | `office_product_writing_cab_or_inf_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index ff532958aa..fa79a58594 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious WAV file in Appdata Folder id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 1 -date: '2021-09-21' +version: 2 +date: '2022-07-07' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -12,15 +12,19 @@ description: This analytic is to detect a suspicious creation of .wav file in ap to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields file_name file_path - process_name process_path process dest file_create_time _time ] | `suspicious_wav_file_in_appdata_folder_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | join proc_guid, _time [ + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] + | `suspicious_wav_file_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least From 10aa2d0a0a2ee2048237aebbac0cd113f3a7cb94 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 7 Jul 2022 17:55:57 +0200 Subject: [PATCH 2/2] Update office_product_writing_cab_or_inf.yml --- detections/endpoint/office_product_writing_cab_or_inf.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index f52fc2428d..b906212777 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -2,7 +2,7 @@ name: Office Product Writing cab or inf id: f48cd1d4-125a-11ec-a447-acde48001122 version: 2 date: '2022-07-07' -author: Michael Haag, Teoderick Contreras, Splunk +author: Michael Haag, Splunk type: TTP datamodel: - Endpoint