Branch was auto-updated.

detections/endpoint/adsisearcher_account_discovery.yml

@@ -23,6 +23,7 @@ references:
 - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
 tags:
   analytic_story:
+  - Industroyer2
   - Active Directory Discovery
   confidence: 50
   context:

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -29,6 +29,7 @@ tags:
   - Credential Dumping
   - DarkSide Ransomware
   - Windows Registry Abuse
+  - Industroyer2
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -27,6 +27,7 @@ tags:
   - Suspicious Rundll32 Activity
   - HAFNIUM Group
   - Living Off The Land
+  - Industroyer2
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -34,6 +34,7 @@ tags:
   - Active Directory Lateral Movement
   - Trickbot
   - Hermetic Wiper
+  - Industroyer2
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -41,6 +41,7 @@ tags:
   - Remcos
   - WhisperGate
   - Hermetic Wiper
+  - Industroyer2
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -39,6 +39,7 @@ tags:
   analytic_story:
   - Active Directory Lateral Movement
   - WhisperGate
+  - Industroyer2
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/linux_dd_file_overwrite.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Data Destruction
+  - Industroyer2
   asset_type: endpoint
   cis20:
   - CIS 3

detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Cyclops BLink
+  - Industroyer2
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/linux_system_network_discovery.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Network Discovery
+  - Industroyer2
   asset_type: endpoint
   cis20:
   - CIS 3

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Industroyer2
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/suspicious_process_file_path.yml

@@ -38,6 +38,7 @@ tags:
   - Remcos
   - WhisperGate
   - Hermetic Wiper
+  - Industroyer2
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -26,7 +26,7 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   to identify source.'
 search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
   ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*",
-  "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
+  "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
   dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -48,6 +48,7 @@ tags:
   - Ryuk Ransomware
   - IcedID
   - Active Directory Lateral Movement
+  - Industroyer2
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - IcedID
   - Windows Persistence Techniques
+  - Industroyer2
   confidence: 100
   context:
   - Source:Endpoint

stories/industroyer2.yml

@@ -0,0 +1,25 @@
+name: Industroyer2
+id: 7ff7db2b-b001-498e-8fe8-caf2dbc3428a
+version: 1
+date: '2022-04-21'
+author: Teoderick Contreras, Splunk
+type: batch
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Industroyer2 attack, including file writes associated with its payload, 
+  lateral movement, persistence, privilege escalation and data destruction.
+narrative: Industroyer2 is part of continuous attack to ukraine targeting energy facilities.
+  This malware is a windows binary that implement IEC-104 protocol to communicate with industrial equipments.
+  This attack consist of several destructive linux script component to wipe or delete several linux critical files, 
+  powershell for domain enumeration and caddywiper to wipe boot sector of the targeted host.
+references:
+- https://cert.gov.ua/article/39518
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+tags:
+  analytic_story: Industroyer2
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection