From 02191943c2f8ab294e204b89bac6cd032c3c3db3 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Wed, 19 Mar 2025 16:07:11 +0100 Subject: [PATCH] renamed_earth_erties --- .../endpoint/any_powershell_downloadfile.yml | 16 +-- .../endpoint/detect_rare_executables.yml | 12 +-- detections/endpoint/detect_renamed_psexec.yml | 24 ++--- detections/endpoint/detect_renamed_winrar.yml | 8 +- ..._or_script_creation_in_suspicious_path.yml | 99 ++++++++++--------- ...tables_or_script_creation_in_temp_path.yml | 97 +++++++++--------- ...file_permission_modification_via_chmod.yml | 28 +++--- ..._auditd_nopasswd_entry_in_sudoers_file.yml | 22 ++--- ...td_possible_access_to_credential_files.yml | 26 +++-- ...auditd_possible_access_to_sudoers_file.yml | 14 ++- ...ux_auditd_preload_hijack_library_calls.yml | 25 ++--- ...x_common_process_for_elevation_control.yml | 10 +- .../linux_nopasswd_entry_in_sudoers_file.yml | 8 +- ...ux_possible_access_to_credential_files.yml | 8 +- .../linux_possible_access_to_sudoers_file.yml | 8 +- .../linux_preload_hijack_library_calls.yml | 8 +- .../linux_sudoers_tmp_file_creation.yml | 8 +- ...hell_process___execution_policy_bypass.yml | 12 +-- ...e_process_accessing_chrome_default_dir.yml | 30 +++--- ...fox_process_access_firefox_profile_dir.yml | 28 +++--- .../endpoint/powershell_4104_hunting.yml | 30 +++--- .../registry_keys_used_for_persistence.yml | 62 ++++++------ .../remote_process_instantiation_via_wmi.yml | 10 +- ...eduled_task_deleted_or_created_via_cmd.yml | 42 ++++---- ...ious_regsvr32_register_suspicious_path.yml | 14 +-- ...s_scheduled_task_from_public_directory.yml | 24 ++--- ...ss_token_manipulation_sedebugprivilege.yml | 22 ++--- .../windows_anonymous_pipe_activity.yml | 34 ++++--- ...windows_archive_collected_data_via_rar.yml | 6 +- ...ial_access_from_browser_password_store.yml | 14 +-- ...ssword_stores_chrome_localstate_access.yml | 26 ++--- ...ssword_stores_chrome_login_data_access.yml | 26 ++--- ...ndows_curl_download_to_suspicious_path.yml | 12 +-- ...ows_process_execution_from_programdata.yml | 31 +++--- ...uery_registry_browser_list_application.yml | 8 +- ...ws_replication_through_removable_media.yml | 10 +- ...e_created_with_suspicious_service_path.yml | 26 ++--- ...ws_service_creation_on_remote_endpoint.yml | 12 +-- ..._service_creation_using_registry_entry.yml | 20 ++-- ...windows_snappybee_create_test_registry.yml | 32 +++--- .../windows_suspicious_process_file_path.yml | 91 +++++++++-------- .../windows_unsigned_dll_side_loading.yml | 10 +- ..._dll_side_loading_in_same_process_path.yml | 30 +++--- .../windows_unsigned_ms_dll_side_loading.yml | 6 +- ...swow64_process_run_system32_executable.yml | 34 ++++--- ..._scheduled_task_created_to_spawn_shell.yml | 18 ++-- ...eduled_task_created_within_public_path.yml | 34 +++---- stories/{ => deprecated}/earth_estries.yml | 0 stories/salt_typhoon.yml | 18 ++++ 49 files changed, 613 insertions(+), 580 deletions(-) rename stories/{ => deprecated}/earth_estries.yml (100%) create mode 100644 stories/salt_typhoon.yml diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 0cee497f25..799ce9388e 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,7 +1,7 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: '12' -date: '2025-02-24' +version: '13' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: TTP @@ -71,18 +71,18 @@ rba: type: process_name tags: analytic_story: - - Ingress Tool Transfer + - Data Destruction + - Malicious PowerShell - China-Nexus Threat Activity - - Crypto Stealer - Hermetic Wiper - DarkCrystal RAT - - Malicious PowerShell - - Earth Estries - Phemedrone Stealer - - Braodo Stealer - PXA Stealer - - Data Destruction - Log4Shell CVE-2021-44228 + - Salt Typhoon + - Braodo Stealer + - Crypto Stealer + - Ingress Tool Transfer asset_type: Endpoint cve: - CVE-2021-44228 diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index a19ca4ff86..ae3a38b762 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -1,7 +1,7 @@ name: Detect Rare Executables id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac -version: '8' -date: '2025-02-07' +version: '9' +date: '2025-03-19' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -58,12 +58,12 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee - - Rhysida Ransomware - China-Nexus Threat Activity - - Crypto Stealer - - Earth Estries - Unusual Processes + - SnappyBee + - Salt Typhoon + - Rhysida Ransomware + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1204 diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 9e1fbafe91..4a23a5c88b 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,7 +1,7 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: '12' -date: '2025-02-24' +version: '13' +date: '2025-03-19' author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production type: Hunting @@ -39,18 +39,18 @@ references: - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ tags: analytic_story: - - China-Nexus Threat Activity - - BlackByte Ransomware - - HAFNIUM Group - - DHS Report TA18-074A - - CISA AA22-320A - - DarkSide Ransomware - - Active Directory Lateral Movement - - DarkGate Malware - Sandworm Tools - - Rhysida Ransomware - - Earth Estries - SamSam Ransomware + - BlackByte Ransomware + - CISA AA22-320A + - China-Nexus Threat Activity + - Salt Typhoon + - DarkGate Malware + - Active Directory Lateral Movement + - HAFNIUM Group + - DarkSide Ransomware + - Rhysida Ransomware + - DHS Report TA18-074A asset_type: Endpoint mitre_attack_id: - T1569.002 diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index f676b4c7db..d34810ea42 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -1,7 +1,7 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: '10' -date: '2025-02-24' +version: '11' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: Hunting @@ -39,9 +39,9 @@ references: tags: analytic_story: - China-Nexus Threat Activity - - CISA AA22-277A - Collection and Staging - - Earth Estries + - CISA AA22-277A + - Salt Typhoon asset_type: Endpoint mitre_attack_id: - T1560.001 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 0fde8612a1..b0c1dd1a90 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: '12' -date: '2025-02-28' +version: '13' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,14 +15,15 @@ description: The following analytic identifies the creation of executables or sc a significant security threat. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") - AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", +search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", + "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", + "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*")) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from @@ -60,48 +61,48 @@ rba: type: file_name tags: analytic_story: - - BlackByte Ransomware - - Brute Ratel C4 - - Trickbot - - Snake Keylogger - - Graceful Wipe Out Attack - - PlugX - - Handala Wiper - - Earth Estries - - Warzone RAT - - ValleyRAT - - NjRAT - - LockBit Ransomware - - Double Zero Destructor - - Swift Slicer - - DarkCrystal RAT - - AsyncRAT - - Volt Typhoon - - Chaos Ransomware - - Hermetic Wiper - - Derusbi - - XMRig - - AgentTesla - - WinDealer RAT - - RedLine Stealer - - Remcos - - Rhysida Ransomware - - China-Nexus Threat Activity - - Crypto Stealer - - Qakbot - - IcedID - - Meduza Stealer - - AcidPour - - MoonPeak - - CISA AA23-347A - - DarkGate Malware - - Industroyer2 - - Azorult - - Data Destruction - - Amadey - - SnappyBee - - WhisperGate - SystemBC + - Snake Keylogger + - China-Nexus Threat Activity + - Remcos + - LockBit Ransomware + - AsyncRAT + - DarkCrystal RAT + - Derusbi + - WinDealer RAT + - DarkGate Malware + - Crypto Stealer + - ValleyRAT + - AcidPour + - PlugX + - Data Destruction + - Qakbot + - CISA AA23-347A + - Hermetic Wiper + - Volt Typhoon + - Double Zero Destructor + - NjRAT + - Trickbot + - AgentTesla + - Meduza Stealer + - SnappyBee + - Azorult + - WhisperGate + - Warzone RAT + - Swift Slicer + - Rhysida Ransomware + - Brute Ratel C4 + - BlackByte Ransomware + - Graceful Wipe Out Attack + - Chaos Ransomware + - Handala Wiper + - RedLine Stealer + - Salt Typhoon + - XMRig + - MoonPeak + - Industroyer2 + - Amadey + - IcedID asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 048578c69d..663ae176dd 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 11 -date: '2025-02-11' +version: '12' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,14 +15,13 @@ description: The following analytic identifies the creation of executables or sc a significant security threat. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") - AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*:\\Windows\\Temp\\*", "*:\\Temp*") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `executables_or_script_creation_in_temp_path_filter`' +search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", + "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", + "*:\\Windows\\Temp\\*", "*:\\Temp*") by Filesystem.file_create_time Filesystem.process_id + Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_temp_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -48,8 +47,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Potentially suspicious executable or script with file name $file_name$, $file_path$ - and process_id $process_id$ was created in temporary folder by $user$ + message: Potentially suspicious executable or script with file name $file_name$, + $file_path$ and process_id $process_id$ was created in temporary folder by $user$ risk_objects: - field: user type: user @@ -59,47 +58,47 @@ rba: type: file_name tags: analytic_story: - - Chaos Ransomware - - Trickbot - Snake Keylogger - - CISA AA23-347A - - Industroyer2 - - WinDealer RAT - - Qakbot - - Warzone RAT - - IcedID - - ValleyRAT - - Azorult - - Handala Wiper - - LockBit Ransomware - - Meduza Stealer - - Brute Ratel C4 - - AsyncRAT - - AcidPour - - Derusbi - - DarkGate Malware - - Graceful Wipe Out Attack - - NjRAT - - WhisperGate - - Data Destruction - - BlackByte Ransomware - - AgentTesla - - Swift Slicer - - Crypto Stealer - - Hermetic Wiper - - MoonPeak - - Double Zero Destructor - - XMRig - - PlugX - - Amadey - - DarkCrystal RAT - - Remcos - China-Nexus Threat Activity - - Earth Estries - - Rhysida Ransomware - - RedLine Stealer + - Remcos + - LockBit Ransomware + - AsyncRAT + - DarkCrystal RAT + - Derusbi + - WinDealer RAT + - DarkGate Malware + - AcidPour + - ValleyRAT + - Crypto Stealer + - PlugX + - Data Destruction + - Qakbot + - CISA AA23-347A + - Hermetic Wiper - Volt Typhoon + - Double Zero Destructor + - NjRAT + - Trickbot + - Meduza Stealer + - AgentTesla - SnappyBee + - Azorult + - WhisperGate + - Warzone RAT + - Swift Slicer + - Rhysida Ransomware + - Brute Ratel C4 + - BlackByte Ransomware + - Graceful Wipe Out Attack + - Chaos Ransomware + - Handala Wiper + - RedLine Stealer + - Salt Typhoon + - XMRig + - MoonPeak + - Industroyer2 + - Amadey + - IcedID asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index c67f79f8db..44f5a6a8a0 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -1,8 +1,8 @@ name: Linux Auditd File Permission Modification Via Chmod id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 -version: 9 -date: '2025-02-24' -author: Teoderick Contreras, Splunk, Ivar Nygård +version: '10' +date: '2025-03-19' +author: "Teoderick Contreras, Splunk, Ivar Nyg\xE5rd" status: production type: Anomaly description: The following analytic detects suspicious file permission modifications @@ -15,12 +15,10 @@ description: The following analytic detects suspicious file permission modificat actions on the system. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` proctitle="*chmod*" AND proctitle IN ("* 777 *", "* 755 *", "*+*x*", "* 754 *") - | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by proctitle dest - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_auditd_file_permission_modification_via_chmod_filter`' +search: '`linux_auditd` proctitle="*chmod*" AND proctitle IN ("* 777 *", "* 755 *", + "*+*x*", "* 754 *") | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by proctitle dest | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `linux_auditd_file_permission_modification_via_chmod_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should @@ -58,13 +56,13 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques - - XorDDos - - Linux Privilege Escalation - Compromised Linux Host + - China-Nexus Threat Activity - Linux Living Off The Land - - Earth Estries + - XorDDos + - Salt Typhoon + - Linux Privilege Escalation asset_type: Endpoint mitre_attack_id: - T1222.002 @@ -76,8 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/auditd_proctitle_chmod.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/auditd_proctitle_chmod.log source: auditd sourcetype: auditd - diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index e63b07e312..aad95585df 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b -version: 6 -date: '2025-02-24' +version: '7' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,11 +14,9 @@ description: The following analytic detects the addition of NOPASSWD entries to and potential compromise of sensitive data and system integrity. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` proctitle = "*NOPASSWD*" - | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by proctitle dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' +search: '`linux_auditd` proctitle = "*NOPASSWD*" | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by proctitle dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -57,11 +55,11 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques - - Linux Privilege Escalation - Compromised Linux Host - - Earth Estries + - China-Nexus Threat Activity + - Salt Typhoon + - Linux Privilege Escalation asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -73,8 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd2.log source: auditd sourcetype: auditd - diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 664b6dc24f..5e3d2312b2 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 -version: 7 -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,11 +14,10 @@ description: The following analytic detects attempts to access or dump the conte offline cracking, leading to unauthorized access and potential system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` proctitle IN ("*shadow*", "*passwd*") AND proctitle IN ("*cat *", "*nano *", "*vim *", "*vi *") - | rename host as dest - | stats count min(_time) as firstTime max(_time) as lastTime by proctitle dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_auditd_possible_access_to_credential_files_filter`' +search: '`linux_auditd` proctitle IN ("*shadow*", "*passwd*") AND proctitle IN ("*cat + *", "*nano *", "*vim *", "*vi *") | rename host as dest | stats count min(_time) + as firstTime max(_time) as lastTime by proctitle dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_auditd_possible_access_to_credential_files_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -48,8 +47,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$proctitle$] event occurred on host - [$dest$] to access or dump - the contents of /etc/passwd and /etc/shadow files. + message: A [$proctitle$] event occurred on host - [$dest$] to access or dump the + contents of /etc/passwd and /etc/shadow files. risk_objects: - field: dest type: system @@ -57,11 +56,11 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques - - Linux Privilege Escalation - Compromised Linux Host - - Earth Estries + - China-Nexus Threat Activity + - Salt Typhoon + - Linux Privilege Escalation asset_type: Endpoint mitre_attack_id: - T1003.008 @@ -73,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log source: auditd sourcetype: auditd - diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 7956cd39cd..fc9e2d1a8b 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 -version: 7 -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -56,11 +56,11 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques - - Linux Privilege Escalation - Compromised Linux Host - - Earth Estries + - China-Nexus Threat Activity + - Salt Typhoon + - Linux Privilege Escalation asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -72,8 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log source: auditd sourcetype: auditd - diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index 768f61b597..f4906c1255 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 -version: 7 -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,13 +15,10 @@ description: The following analytic detects the use of the LD_PRELOAD environmen access to the system. data_source: - Linux Auditd Execve -search: '`linux_auditd` execve_command = "*LD_PRELOAD*" - | rename host as dest - | rename comm as process_name - | rename exe as process - | stats count min(_time) as firstTime max(_time) as lastTime by argc execve_command dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `linux_auditd_preload_hijack_library_calls_filter`' +search: '`linux_auditd` execve_command = "*LD_PRELOAD*" | rename host as dest | rename + comm as process_name | rename exe as process | stats count min(_time) as firstTime + max(_time) as lastTime by argc execve_command dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `linux_auditd_preload_hijack_library_calls_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should @@ -59,11 +56,11 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques - - Linux Privilege Escalation - Compromised Linux Host - - Earth Estries + - China-Nexus Threat Activity + - Salt Typhoon + - Linux Privilege Escalation asset_type: Endpoint mitre_attack_id: - T1574.006 @@ -75,8 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/auditd_execve_ldpreload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/auditd_execve_ldpreload.log source: auditd sourcetype: auditd - diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index b823b6e94c..a0468a2efb 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -1,7 +1,7 @@ name: Linux Common Process For Elevation Control id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: '7' -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -44,11 +44,11 @@ references: - https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques - - Linux Privilege Escalation + - China-Nexus Threat Activity - Linux Living Off The Land - - Earth Estries + - Salt Typhoon + - Linux Privilege Escalation asset_type: Endpoint mitre_attack_id: - T1548.001 diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 90563b48db..09d260d67b 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux NOPASSWD Entry In Sudoers File id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: '7' -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,10 +58,10 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques + - China-Nexus Threat Activity + - Salt Typhoon - Linux Privilege Escalation - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index 14a2fe0df1..f13ed544a0 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Credential Files id: 16107e0e-71fc-11ec-b862-acde48001122 -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,11 +57,11 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques + - China-Nexus Threat Activity - XorDDos + - Salt Typhoon - Linux Privilege Escalation - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1003.008 diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index b9936bb72e..492e08f86f 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Sudoers File id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: '7' -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,10 +57,10 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques + - China-Nexus Threat Activity + - Salt Typhoon - Linux Privilege Escalation - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index 1d2059864e..018943b020 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Preload Hijack Library Calls id: cbe2ca30-631e-11ec-8670-acde48001122 -version: '7' -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,10 +57,10 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques + - China-Nexus Threat Activity + - Salt Typhoon - Linux Privilege Escalation - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.006 diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index ca24f2680e..b8637fa524 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Sudoers Tmp File Creation id: be254a5c-63e7-11ec-89da-acde48001122 -version: '7' -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,10 +51,10 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - Linux Persistence Techniques + - China-Nexus Threat Activity + - Salt Typhoon - Linux Privilege Escalation - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 5051787f4a..c29237f9c3 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,7 +1,7 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: '11' -date: '2025-02-24' +version: '12' +date: '2025-03-19' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: Anomaly @@ -61,12 +61,12 @@ rba: tags: analytic_story: - China-Nexus Threat Activity + - AsyncRAT + - DarkCrystal RAT + - Volt Typhoon + - Salt Typhoon - HAFNIUM Group - DHS Report TA18-074A - - DarkCrystal RAT - - AsyncRAT - - Earth Estries - - Volt Typhoon asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 061a40ecc7..fcc41a5bd0 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,7 +1,7 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,20 +49,20 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee - - Phemedrone Stealer - - Snake Keylogger - - NjRAT - - CISA AA23-347A - - 3CX Supply Chain Attack - - FIN7 - - Earth Estries - - Warzone RAT - - China-Nexus Threat Activity - - DarkGate Malware - - Remcos - - RedLine Stealer - AgentTesla + - Snake Keylogger + - CISA AA23-347A + - China-Nexus Threat Activity + - Remcos + - FIN7 + - Phemedrone Stealer + - SnappyBee + - RedLine Stealer + - Warzone RAT + - Salt Typhoon + - 3CX Supply Chain Attack + - DarkGate Malware + - NjRAT asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index c9e182d0f7..ea7222e188 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,7 +1,7 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: '7' -date: '2025-02-13' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -48,21 +48,21 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee - - Phemedrone Stealer - - Snake Keylogger - - NjRAT - - CISA AA23-347A - - 3CX Supply Chain Attack - - Azorult - - China-Nexus Threat Activity - - Warzone RAT - AgentTesla - - RedLine Stealer - - DarkGate Malware + - Snake Keylogger + - CISA AA23-347A + - China-Nexus Threat Activity - Remcos - - Earth Estries - FIN7 + - Phemedrone Stealer + - SnappyBee + - Azorult + - RedLine Stealer + - Warzone RAT + - Salt Typhoon + - 3CX Supply Chain Attack + - DarkGate Malware + - NjRAT asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index d03afb46b9..1092606308 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: '13' -date: '2025-02-28' +version: '14' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: Hunting @@ -59,20 +59,20 @@ references: - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ tags: analytic_story: - - China-Nexus Threat Activity - - CISA AA24-241A - - Malicious PowerShell - - Flax Typhoon - - CISA AA23-347A - - DarkGate Malware - - Earth Estries - - Cleo File Transfer Software - - Braodo Stealer - - Lumma Stealer - - Rhysida Ransomware - - Data Destruction - - Hermetic Wiper - SystemBC + - Data Destruction + - Malicious PowerShell + - China-Nexus Threat Activity + - CISA AA23-347A + - Cleo File Transfer Software + - Lumma Stealer + - CISA AA24-241A + - Hermetic Wiper + - Salt Typhoon + - DarkGate Malware + - Flax Typhoon + - Braodo Stealer + - Rhysida Ransomware asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 65ff7b2113..40476dc79a 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: '18' -date: '2025-02-28' +version: '19' +date: '2025-03-19' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -76,38 +76,38 @@ rba: threat_objects: [] tags: analytic_story: - - Amadey - - AsyncRAT - - Azorult - - BlackByte Ransomware - - BlackSuit Ransomware - - Braodo Stealer - - Chaos Ransomware - - China-Nexus Threat Activity - - CISA AA23-347A - - DarkGate Malware - - Derusbi - - DHS Report TA18-074A - - Earth Estries - - Emotet Malware DHS Report TA18-201A - - IcedID - - MoonPeak - - NjRAT - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Qakbot - - Ransomware - - RedLine Stealer - - Remcos - - Snake Keylogger - - SnappyBee - - Sneaky Active Directory Persistence Tricks - - Suspicious MSHTA Activity - - Suspicious Windows Registry Activities - SystemBC - - Warzone RAT - - WinDealer RAT + - Snake Keylogger + - China-Nexus Threat Activity + - Remcos + - AsyncRAT - Windows Persistence Techniques + - Derusbi + - WinDealer RAT + - Suspicious MSHTA Activity + - DarkGate Malware + - Suspicious Windows Registry Activities + - Qakbot + - CISA AA23-347A + - Ransomware + - NjRAT + - Emotet Malware DHS Report TA18-201A + - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + - Sneaky Active Directory Persistence Tricks + - SnappyBee + - Azorult + - Warzone RAT + - BlackByte Ransomware + - Chaos Ransomware + - RedLine Stealer + - BlackSuit Ransomware - Windows Registry Abuse + - Amadey + - Salt Typhoon + - MoonPeak + - Braodo Stealer + - DHS Report TA18-074A + - IcedID asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 677dae13f9..f540d7beaf 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: '12' -date: '2025-02-24' +version: '13' +date: '2025-03-19' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: TTP @@ -65,12 +65,12 @@ rba: threat_objects: [] tags: analytic_story: + - CISA AA23-347A - China-Nexus Threat Activity - Ransomware - - Active Directory Lateral Movement - - CISA AA23-347A - Suspicious WMI Use - - Earth Estries + - Salt Typhoon + - Active Directory Lateral Movement asset_type: Endpoint mitre_attack_id: - T1047 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index f8dd98ccb9..96d943d1d0 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,7 +1,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c -version: '13' -date: '2025-02-24' +version: '14' +date: '2025-03-19' author: Bhavin Patel, Splunk status: production type: TTP @@ -66,32 +66,32 @@ rba: threat_objects: [] tags: analytic_story: - - DHS Report TA18-074A - - Trickbot - - NOBELIUM Group - - Prestige Ransomware - - Earth Estries - - ShrinkLocker - - NjRAT - - CISA AA24-241A - - DarkCrystal RAT - Sandworm Tools - - Living Off The Land - - AsyncRAT - - Scheduled Tasks - - AgentTesla - - Windows Persistence Techniques - - RedLine Stealer - - Rhysida Ransomware - - Winter Vivern - China-Nexus Threat Activity + - CISA AA24-241A + - AsyncRAT + - DarkCrystal RAT + - Windows Persistence Techniques + - Scheduled Tasks - Qakbot - - CISA AA22-257A - - MoonPeak - CISA AA23-347A + - NjRAT + - Trickbot + - AgentTesla + - Living Off The Land + - Winter Vivern - Phemedrone Stealer - Azorult + - CISA AA22-257A + - Rhysida Ransomware + - Prestige Ransomware + - NOBELIUM Group + - ShrinkLocker + - RedLine Stealer - Amadey + - Salt Typhoon + - MoonPeak + - DHS Report TA18-074A asset_type: Endpoint mitre_attack_id: - T1053.005 diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index f4e90ec9b2..86b54afa05 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,7 +1,7 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: '13' -date: '2025-02-24' +version: '14' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: TTP @@ -73,13 +73,13 @@ rba: type: process_name tags: analytic_story: - - China-Nexus Threat Activity - - IcedID - - Qakbot - - Derusbi - Living Off The Land - - Earth Estries + - Qakbot + - China-Nexus Threat Activity + - Derusbi + - Salt Typhoon - Suspicious Regsvr32 Activity + - IcedID asset_type: Endpoint mitre_attack_id: - T1218.010 diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 2f4d734922..18683c8724 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -1,7 +1,7 @@ name: Suspicious Scheduled Task from Public Directory id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: '7' -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: Anomaly @@ -65,19 +65,19 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - - Crypto Stealer - - Ransomware - - MoonPeak - - DarkCrystal RAT - - CISA AA24-241A - - CISA AA23-347A - - Windows Persistence Techniques - Living Off The Land - - Azorult + - China-Nexus Threat Activity + - CISA AA23-347A - Ryuk Ransomware + - CISA AA24-241A + - Windows Persistence Techniques + - DarkCrystal RAT + - Ransomware + - Azorult - Scheduled Tasks - - Earth Estries + - Salt Typhoon + - MoonPeak + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1053.005 diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index cc2242510c..8d9c29e8b1 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,7 +1,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: '12' -date: '2025-02-24' +version: '13' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -56,18 +56,18 @@ rba: threat_objects: [] tags: analytic_story: + - Meduza Stealer + - PlugX + - CISA AA23-347A + - China-Nexus Threat Activity + - AsyncRAT - SnappyBee + - Derusbi + - WinDealer RAT + - Salt Typhoon + - DarkGate Malware - ValleyRAT - Brute Ratel C4 - - WinDealer RAT - - Meduza Stealer - - CISA AA23-347A - - AsyncRAT - - Derusbi - - PlugX - - China-Nexus Threat Activity - - DarkGate Malware - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1134.002 diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 1102c6ffa3..436311b403 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -1,23 +1,35 @@ name: Windows Anonymous Pipe Activity id: ee301e1e-cd81-4011-a911-e5f049b9e3d5 -version: 1 -date: '2025-02-11' +version: '2' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques. +description: "The following analytic detects the creation or connection of anonymous\ + \ pipes for inter-process communication (IPC) within a Windows environment. Anonymous\ + \ pipes are commonly used by legitimate system processes, services, and applications\ + \ to transfer data between related processes. However, adversaries frequently abuse\ + \ anonymous pipes to facilitate stealthy process injection, command-and-control\ + \ (C2) communication, credential theft, or privilege escalation. This detection\ + \ monitors for unusual anonymous pipe activity, particularly involving non-system\ + \ processes, unsigned executables, or unexpected parent-child process relationships.\ + \ While legitimate use cases exist\u2014such as Windows services, software installers,\ + \ or security tools\u2014unusual or high-frequency anonymous pipe activity should\ + \ be investigated for potential malware, persistence mechanisms, or lateral movement\ + \ techniques." data_source: - Sysmon EventID 17 - Sysmon EventID 18 -search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) - | stats min(_time) as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid ProcessId Image EventType - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") + PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) | stats min(_time) + as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid + ProcessId Image EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . -known_false_positives: Automation tool might use anonymous pipe for task orchestration or process communication. +known_false_positives: Automation tool might use anonymous pipe for task orchestration + or process communication. references: - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html drilldown_searches: @@ -36,9 +48,9 @@ drilldown_searches: latest_offset: $info_max_time$ tags: analytic_story: - - SnappyBee + - Salt Typhoon - China-Nexus Threat Activity - - Earth Estries + - SnappyBee asset_type: Endpoint mitre_attack_id: - T1559 diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml index cfda3ba9cf..5b7757909e 100644 --- a/detections/endpoint/windows_archive_collected_data_via_rar.yml +++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml @@ -1,7 +1,7 @@ name: Windows Archive Collected Data via Rar id: 2015de95-fe91-413d-9d62-2fe011b67e82 -version: '7' -date: '2025-02-24' +version: '8' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -62,8 +62,8 @@ rba: tags: analytic_story: - DarkGate Malware + - Salt Typhoon - China-Nexus Threat Activity - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1560.001 diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 61810fbdd1..b6507e816b 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,7 +1,7 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Bhavin Patel Splunk data_source: - Windows Event Log Security 4663 @@ -60,14 +60,14 @@ rba: threat_objects: [] tags: analytic_story: + - Meduza Stealer + - Snake Keylogger + - China-Nexus Threat Activity - SnappyBee + - PXA Stealer + - Salt Typhoon - MoonPeak - Braodo Stealer - - Snake Keylogger - - Meduza Stealer - - PXA Stealer - - China-Nexus Threat Activity - - Earth Estries asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index c8b4b527d4..a00adb48c6 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,20 +51,20 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee - - MoonPeak - - Phemedrone Stealer - - Braodo Stealer - - Snake Keylogger - Meduza Stealer - - NjRAT - - Amadey - - PXA Stealer - - Warzone RAT + - Snake Keylogger - China-Nexus Threat Activity - - DarkGate Malware + - Phemedrone Stealer + - SnappyBee + - PXA Stealer - RedLine Stealer - - Earth Estries + - Warzone RAT + - Salt Typhoon + - DarkGate Malware + - MoonPeak + - Braodo Stealer + - Amadey + - NjRAT asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 6db791d295..2ac51493f5 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,20 +52,20 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee - - MoonPeak - - Phemedrone Stealer - - Braodo Stealer - - Snake Keylogger - Meduza Stealer - - NjRAT - - Amadey - - PXA Stealer - - Warzone RAT + - Snake Keylogger - China-Nexus Threat Activity - - DarkGate Malware + - Phemedrone Stealer + - SnappyBee + - PXA Stealer - RedLine Stealer - - Earth Estries + - Warzone RAT + - Salt Typhoon + - DarkGate Malware + - MoonPeak + - Braodo Stealer + - Amadey + - NjRAT asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 95fd1c0638..5ac79dae69 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,7 +1,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: '11' -date: '2025-03-03' +version: '12' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: TTP @@ -70,13 +70,13 @@ rba: type: process_name tags: analytic_story: + - Black Basta Ransomware - China-Nexus Threat Activity + - Forest Blizzard + - Compromised Windows Host + - Salt Typhoon - Ingress Tool Transfer - IcedID - - Forest Blizzard - - Earth Estries - - Black Basta Ransomware - - Compromised Windows Host asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_process_execution_from_programdata.yml b/detections/endpoint/windows_process_execution_from_programdata.yml index 075bd21a58..3e87c3ce53 100644 --- a/detections/endpoint/windows_process_execution_from_programdata.yml +++ b/detections/endpoint/windows_process_execution_from_programdata.yml @@ -1,24 +1,29 @@ name: Windows Process Execution From ProgramData id: 237016fa-d8e6-47b4-80f9-70c4d42c72c0 -version: 1 -date: '2025-03-13' +version: '2' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies processes running from file paths within the ProgramData directory, a common location abused by adversaries for executing malicious code while evading detection. Threat actors often drop and execute payloads from this directory to bypass security controls, as it typically has write permissions for standard users. While this behavior can indicate malware execution or persistence techniques, it is important to note that some legitimate software, installers, and update mechanisms also run from ProgramData, leading to potential false positives. Security teams should validate detections by correlating with other indicators, such as unusual parent processes, unsigned binaries, or anomalous network activity. +description: The following analytic identifies processes running from file paths within + the ProgramData directory, a common location abused by adversaries for executing + malicious code while evading detection. Threat actors often drop and execute payloads + from this directory to bypass security controls, as it typically has write permissions + for standard users. While this behavior can indicate malware execution or persistence + techniques, it is important to note that some legitimate software, installers, and + update mechanisms also run from ProgramData, leading to potential false positives. + Security teams should validate detections by correlating with other indicators, + such as unusual parent processes, unsigned binaries, or anomalous network activity. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes - where Processes.process_path = "*:\\ProgramData\\*" - by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_process_execution_from_programdata_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*:\\ProgramData\\*" + by Processes.parent_process_name Processes.parent_process Processes.process_path + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_process_execution_from_programdata_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -47,8 +52,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious process $process_name$ running from a process path- - $process_path$ on host- $dest$ + message: Suspicious process $process_name$ running from a process path- $process_path$ + on host- $dest$ risk_objects: - field: dest type: system @@ -58,8 +63,8 @@ rba: type: parent_process_name tags: analytic_story: + - Salt Typhoon - China-Nexus Threat Activity - - Earth Estries - SnappyBee asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index 1672d23bfe..efe1db1c2d 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -1,7 +1,7 @@ name: Windows Query Registry Browser List Application id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb -version: '5' -date: '2025-02-07' +version: '6' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,10 +51,10 @@ rba: threat_objects: [] tags: analytic_story: + - China-Nexus Threat Activity - SnappyBee - RedLine Stealer - - Earth Estries - - China-Nexus Threat Activity + - Salt Typhoon asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 3d1e836554..40923909bc 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,7 +1,7 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: TTP @@ -60,12 +60,12 @@ rba: type: file_name tags: analytic_story: - - NjRAT + - PlugX - China-Nexus Threat Activity - Chaos Ransomware - Derusbi - - PlugX - - Earth Estries + - Salt Typhoon + - NjRAT asset_type: Endpoint mitre_attack_id: - T1091 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index af4539abce..11d6a0e95f 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,7 +1,7 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: '13' -date: '2025-02-24' +version: '14' +date: '2025-03-19' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -54,18 +54,18 @@ rba: type: service tags: analytic_story: - - China-Nexus Threat Activity - - Crypto Stealer - - Qakbot - - Snake Malware - - Brute Ratel C4 - - Derusbi - - Active Directory Lateral Movement - - Clop Ransomware - - Flax Typhoon - - CISA AA23-347A - PlugX - - Earth Estries + - Qakbot + - China-Nexus Threat Activity + - CISA AA23-347A + - Flax Typhoon + - Derusbi + - Salt Typhoon + - Active Directory Lateral Movement + - Snake Malware + - Clop Ransomware + - Crypto Stealer + - Brute Ratel C4 asset_type: Endpoint mitre_attack_id: - T1569.002 diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 1a143a424a..d69068f1e7 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -1,7 +1,7 @@ name: Windows Service Creation on Remote Endpoint id: e0eea4fa-4274-11ec-882b-3e22fbd008af -version: '7' -date: '2025-02-13' +version: '8' +date: '2025-03-19' author: Mauricio Velazco, Splunk status: production type: TTP @@ -62,11 +62,11 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee - - CISA AA23-347A - - Active Directory Lateral Movement - China-Nexus Threat Activity - - Earth Estries + - CISA AA23-347A + - SnappyBee + - Salt Typhoon + - Active Directory Lateral Movement asset_type: Endpoint mitre_attack_id: - T1543.003 diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index e3acea777d..d581089a9f 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: '13' -date: '2025-02-26' +version: '14' +date: '2025-03-19' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -52,18 +52,18 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee - - Windows Persistence Techniques - - Brute Ratel C4 - - CISA AA23-347A - - Suspicious Windows Registry Activities - - China-Nexus Threat Activity - - Derusbi - PlugX + - CISA AA23-347A + - China-Nexus Threat Activity + - Windows Persistence Techniques + - SnappyBee + - Derusbi - Windows Registry Abuse + - Salt Typhoon - Active Directory Lateral Movement + - Suspicious Windows Registry Activities - Crypto Stealer - - Earth Estries + - Brute Ratel C4 asset_type: Endpoint mitre_attack_id: - T1574.011 diff --git a/detections/endpoint/windows_snappybee_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml index 2854203d3f..c8b2f1b3ee 100644 --- a/detections/endpoint/windows_snappybee_create_test_registry.yml +++ b/detections/endpoint/windows_snappybee_create_test_registry.yml @@ -1,25 +1,33 @@ name: Windows SnappyBee Create Test Registry id: 80402396-d78a-4c6e-ade5-7697ea670adf -version: 1 -date: '2025-02-11' +version: '2' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration file, or system mark compromised. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior. +description: The following analytic detects modifications to the Windows registry + under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications + in a production environment. Monitoring this key is crucial, as adversaries may + create or alter values here for monitoring update of itself file path, updated configuration + file, or system mark compromised. The detection leverages **Sysmon Event ID 13** + (Registry Value Set) to identify unauthorized changes. Analysts should investigate + processes associated with these modifications, particularly unsigned executables + or suspicious command-line activity, as they may indicate malware or unauthorized + software behavior. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" - BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" + BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.registry_value_data Registry.process_guid Registry.dest Registry.user | + `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snappybee_create_test_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators and third party software may create this registry entry. +known_false_positives: Administrators and third party software may create this registry + entry. references: - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html drilldown_searches: @@ -48,9 +56,9 @@ rba: threat_objects: [] tags: analytic_story: - - SnappyBee + - Salt Typhoon - China-Nexus Threat Activity - - Earth Estries + - SnappyBee asset_type: Endpoint mitre_attack_id: - T1112 diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 07df20b513..12e4100504 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 8 -date: '2025-02-28' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: TTP @@ -19,13 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes - where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) - by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_suspicious_process_file_path_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", + "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", + "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND + NOT(Processes.process_path IN ("*\\temp\\*")) by Processes.parent_process_name Processes.parent_process + Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -69,44 +69,44 @@ rba: type: process_name tags: analytic_story: - - Double Zero Destructor - - Graceful Wipe Out Attack - - AsyncRAT - - WhisperGate - - Prestige Ransomware - - DarkGate Malware - - AgentTesla - - Brute Ratel C4 - - RedLine Stealer - - Rhysida Ransomware - - Swift Slicer - - IcedID - - DarkCrystal RAT - - Chaos Ransomware - - PlugX - - Industroyer2 - - Azorult - - Remcos - - XMRig - - Qakbot - - Volt Typhoon - - Hermetic Wiper - - Warzone RAT - - Trickbot - - Amadey - - BlackByte Ransomware - - LockBit Ransomware - - CISA AA23-347A - - Data Destruction - - Phemedrone Stealer - - Handala Wiper - - MoonPeak - - ValleyRAT - - Meduza Stealer - SystemBC - China-Nexus Threat Activity - - Earth Estries + - Remcos + - LockBit Ransomware + - AsyncRAT + - DarkCrystal RAT + - DarkGate Malware + - ValleyRAT + - PlugX + - Data Destruction + - Qakbot + - CISA AA23-347A + - Hermetic Wiper + - Volt Typhoon + - Double Zero Destructor + - AgentTesla + - Trickbot + - Meduza Stealer + - Phemedrone Stealer - SnappyBee + - Azorult + - WhisperGate + - Warzone RAT + - Swift Slicer + - Rhysida Ransomware + - Brute Ratel C4 + - Prestige Ransomware + - BlackByte Ransomware + - Graceful Wipe Out Attack + - Chaos Ransomware + - Handala Wiper + - RedLine Stealer + - Salt Typhoon + - XMRig + - MoonPeak + - Industroyer2 + - Amadey + - IcedID asset_type: Endpoint mitre_attack_id: - T1543 @@ -119,7 +119,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 579b67e6d4..7db6beff1b 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,11 +51,11 @@ rba: threat_objects: [] tags: analytic_story: - - Warzone RAT - - NjRAT - China-Nexus Threat Activity - Derusbi - - Earth Estries + - Warzone RAT + - Salt Typhoon + - NjRAT asset_type: Endpoint mitre_attack_id: - T1574.002 diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index d17df5a5bf..0a9c5a0bbb 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 8 -date: '2025-02-26' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -15,15 +15,15 @@ description: This detection identifies unsigned DLLs loaded through DLL side-loa potential security breaches. Regular security assessments, thorough monitoring, and implementing security best practices are essential in safeguarding systems from such threats. -search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) ImageLoaded = *.dll - | rex field=Image "(?.+\\\)" - | rex field=ImageLoaded "(?.+\\\)" - | where ImageFolderPath = ImageLoadedFolderPath - | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company Description Product Signed SignatureStatus - | rename Computer as dest - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_unsigned_dll_side_loading_in_same_process_path_filter`' +search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN + ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) + NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program + Files*")) ImageLoaded = *.dll | rex field=Image "(?.+\\\)" | rex + field=ImageLoaded "(?.+\\\)" | where ImageFolderPath = ImageLoadedFolderPath + | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid + ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company + Description Product Signed SignatureStatus | rename Computer as dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_in_same_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -54,12 +54,12 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - - Derusbi - - DarkGate Malware - PlugX - - Earth Estries + - China-Nexus Threat Activity - SnappyBee + - Derusbi + - Salt Typhoon + - DarkGate Malware asset_type: Endpoint mitre_attack_id: - T1574.002 diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 621a904a38..58aa027e16 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: '8' -date: '2025-02-24' +version: '9' +date: '2025-03-19' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -66,8 +66,8 @@ tags: analytic_story: - China-Nexus Threat Activity - Derusbi + - Salt Typhoon - APT29 Diplomatic Deceptions with WINELOADER - - Earth Estries group: - APT29 - Cozy Bear diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml index 87beb38b68..81941dcb41 100644 --- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -1,21 +1,26 @@ name: Windows Unusual SysWOW64 Process Run System32 Executable id: e4602172-db86-4315-86df-da66fb40bcde -version: 1 -date: '2025-02-11' +version: '2' +date: '2025-03-19' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects an unusual process execution pattern where a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. In a typical Windows environment, 32-bit processes under SysWOW64 should primarily interact with 32-bit binaries within the same directory. However, an execution flow where a 32-bit process spawns a 64-bit binary from System32 can indicate potential process injection, privilege escalation, evasion techniques, or unauthorized execution hijacking. +description: The following analytic detects an unusual process execution pattern where + a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. + In a typical Windows environment, 32-bit processes under SysWOW64 should primarily + interact with 32-bit binaries within the same directory. However, an execution flow + where a 32-bit process spawns a 64-bit binary from System32 can indicate potential + process injection, privilege escalation, evasion techniques, or unauthorized execution + hijacking. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_path = "*\\Windows\\SysWOW64\\*" AND Processes.process = "*windows\\system32\\*" - by Processes.parent_process_name Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_unusual_syswow64_process_run_system32_executable_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\SysWOW64\\*" + AND Processes.process = "*windows\\system32\\*" by Processes.parent_process_name + Processes.process_path Processes.process Processes.original_file_name Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_unusual_syswow64_process_run_system32_executable_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -25,7 +30,10 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: some legitimate system processes, software updaters, or compatibility tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual parent processes should be investigated for potential malware activity, persistence mechanisms, or execution flow hijacking. +known_false_positives: some legitimate system processes, software updaters, or compatibility + tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual + parent processes should be investigated for potential malware activity, persistence + mechanisms, or execution flow hijacking. references: - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html drilldown_searches: @@ -53,9 +61,9 @@ rba: type: process_name tags: analytic_story: - - China-Nexus Threat Activity - DarkGate Malware - - Earth Estries + - Salt Typhoon + - China-Nexus Threat Activity asset_type: Endpoint mitre_attack_id: - T1036.009 diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 515bdb1768..06140ef08d 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created to Spawn Shell id: 203ef0ea-9bd8-11eb-8201-acde48001122 -version: '11' -date: '2025-02-25' +version: '12' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: TTP @@ -54,17 +54,17 @@ rba: threat_objects: [] tags: analytic_story: + - SystemBC - China-Nexus Threat Activity - - CISA AA22-257A + - Ryuk Ransomware + - Winter Vivern + - Windows Persistence Techniques + - Ransomware - Windows Error Reporting Service Elevation of Privilege Vulnerability - Compromised Windows Host - - Ransomware - - Windows Persistence Techniques - - Ryuk Ransomware - Scheduled Tasks - - Earth Estries - - Winter Vivern - - SystemBC + - Salt Typhoon + - CISA AA22-257A asset_type: Endpoint mitre_attack_id: - T1053.005 diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 142adf55be..47f24ab338 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created Within Public Path id: 5d9c6eee-988c-11eb-8253-acde48001122 -version: '11' -date: '2025-02-28' +version: '12' +date: '2025-03-19' author: Michael Haag, Splunk status: production type: TTP @@ -54,23 +54,23 @@ rba: threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - - IcedID - - CISA AA22-257A - - Compromised Windows Host - - Ransomware - - Active Directory Lateral Movement - - CISA AA23-347A - - Windows Persistence Techniques - - Earth Estries - Prestige Ransomware - - Industroyer2 - - Ryuk Ransomware - - AsyncRAT - - Scheduled Tasks - - Data Destruction - - Winter Vivern - SystemBC + - Data Destruction + - China-Nexus Threat Activity + - CISA AA23-347A + - Ryuk Ransomware + - Winter Vivern + - Windows Persistence Techniques + - AsyncRAT + - Ransomware + - Compromised Windows Host + - Scheduled Tasks + - Salt Typhoon + - Active Directory Lateral Movement + - CISA AA22-257A + - Industroyer2 + - IcedID asset_type: Endpoint mitre_attack_id: - T1053.005 diff --git a/stories/earth_estries.yml b/stories/deprecated/earth_estries.yml similarity index 100% rename from stories/earth_estries.yml rename to stories/deprecated/earth_estries.yml diff --git a/stories/salt_typhoon.yml b/stories/salt_typhoon.yml new file mode 100644 index 0000000000..61150f3829 --- /dev/null +++ b/stories/salt_typhoon.yml @@ -0,0 +1,18 @@ +name: Salt Typhoon +id: 7df800b1-af23-4f65-ac36-abe87374ee72 +version: 1 +date: '2025-03-19' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Salt Typhoon, a sophisticated threat actor targeting various sectors with espionage-focused campaigns. Monitor for indicators such as spear-phishing emails, unauthorized access attempts, and lateral movement within your network. Investigate anomalous data exfiltration patterns and command-and-control (C2) traffic consistent with known tactics, techniques, and procedures (TTPs) of this group. Combining threat intelligence with advanced monitoring tools helps identify potential Salt Typhoon activity early, enabling swift response to mitigate risks effectively. +narrative: Salt Typhoon is a highly capable threat actor known for conducting targeted espionage campaigns against diverse sectors, including government, technology, and critical infrastructure. This group leverages sophisticated tactics such as spear-phishing, credential theft, and exploiting software vulnerabilities to gain initial access. Once inside a network, Salt Typhoon demonstrates expertise in lateral movement, privilege escalation, and covert data exfiltration. Their use of custom malware and command-and-control (C2) infrastructures highlights their adaptability. Detecting their activity requires robust threat intelligence and proactive monitoring of unusual behaviors and network anomalies. +references: +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file