From 11d372b63ca8d5be86c3fda2ad3da634d2fe4f8d Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Apr 2022 09:36:55 +0200 Subject: [PATCH 1/2] industroyer2 --- ...dential_dump_from_registry_via_reg_exe.yml | 1 + .../endpoint/dump_lsass_via_comsvcs_dll.yml | 1 + ...le_written_in_administrative_smb_share.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 1 + ...ateral_movement_commandline_parameters.yml | 1 + .../endpoint/linux_dd_file_overwrite.yml | 1 + ...ux_stdout_redirection_to_dev_null_file.yml | 1 + .../linux_system_network_discovery.yml | 1 + .../endpoint/schtasks_run_task_on_demand.yml | 1 + .../endpoint/suspicious_process_file_path.yml | 1 + ...eduled_task_created_within_public_path.yml | 3 ++- ...ws_task_scheduler_event_action_started.yml | 1 + stories/industroyer2.yml | 25 +++++++++++++++++++ 13 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 stories/industroyer2.yml diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 280cd8db84..9547305518 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -29,6 +29,7 @@ tags: - Credential Dumping - DarkSide Ransomware - Windows Registry Abuse + - Industroyer2 asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 8c90706d14..fcb38967de 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -27,6 +27,7 @@ tags: - Suspicious Rundll32 Activity - HAFNIUM Group - Living Off The Land + - Industroyer2 asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 9a10c51742..e8c96f3fb8 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -34,6 +34,7 @@ tags: - Active Directory Lateral Movement - Trickbot - Hermetic Wiper + - Industroyer2 automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index a29cb171b9..c895a2846b 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -41,6 +41,7 @@ tags: - Remcos - WhisperGate - Hermetic Wiper + - Industroyer2 automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 6c612f9e3b..051e857767 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -39,6 +39,7 @@ tags: analytic_story: - Active Directory Lateral Movement - WhisperGate + - Industroyer2 confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index cda83ffe62..7c20077758 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Data Destruction + - Industroyer2 asset_type: endpoint cis20: - CIS 3 diff --git a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml index d72e417d28..3d1f335194 100644 --- a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Cyclops BLink + - Industroyer2 asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index a6b4430ada..c7ba8f4f58 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Network Discovery + - Industroyer2 asset_type: endpoint cis20: - CIS 3 diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index f9eadac1ff..f846173778 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - XMRig + - Industroyer2 confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index bb98c9ccf2..40cedea8de 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -38,6 +38,7 @@ tags: - Remcos - WhisperGate - Hermetic Wiper + - Industroyer2 automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index fe04448577..5f063fbc8e 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -26,7 +26,7 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s to identify source.' search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", - "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by + "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -48,6 +48,7 @@ tags: - Ryuk Ransomware - IcedID - Active Directory Lateral Movement + - Industroyer2 confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 2d1e5ce286..a021bdb930 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -31,6 +31,7 @@ tags: analytic_story: - IcedID - Windows Persistence Techniques + - Industroyer2 confidence: 100 context: - Source:Endpoint diff --git a/stories/industroyer2.yml b/stories/industroyer2.yml new file mode 100644 index 0000000000..af1406c14c --- /dev/null +++ b/stories/industroyer2.yml @@ -0,0 +1,25 @@ +name: Industroyer2 +id: 7ff7db2b-b001-498e-8fe8-caf2dbc3428a +version: 1 +date: '2022-04-21' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Industroyer2 attack, including file writes associated with its payload, + lateral movement, persistence, privilege escalation and data destruction. +narrative: Industroyer2 is part of continuous attack to ukraine targeting energy facilities. + This malware is a windows binary that implement IEC-104 protocol to communicate with industrial equipments. + This attack consist of several destructive linux script component to wipe or delete several linux critical files, + powershell for domain enumeration and caddywiper to wipe boot sector of the targeted host. +references: +- https://cert.gov.ua/article/39518 +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +tags: + analytic_story: Industroyer2 + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 1acfac609cd0d196b6a2fb83a772cb89f48a7862 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Apr 2022 12:03:54 +0200 Subject: [PATCH 2/2] industroyer2 --- detections/endpoint/adsisearcher_account_discovery.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 10a6c955df..e9538f85fd 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -23,6 +23,7 @@ references: - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ tags: analytic_story: + - Industroyer2 - Active Directory Discovery confidence: 50 context: