Branch was auto-updated.

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -40,6 +40,7 @@ tags:
   - DarkCrystal RAT
   - ProxyNotShell
   - Qakbot
+  - Chaos Ransomware
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -25,6 +25,7 @@ tags:
   analytic_story:
   - DarkSide Ransomware
   - Ransomware
+  - LockBit Ransomware
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/cobalt_strike_named_pipes.yml

@@ -42,6 +42,7 @@ tags:
   - Cobalt Strike
   - Trickbot
   - DarkSide Ransomware
+  - LockBit Ransomware
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/common_ransomware_extensions.yml

@@ -35,6 +35,7 @@ tags:
   - Ransomware
   - Clop Ransomware
   - Prestige Ransomware
+  - LockBit Ransomware
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/common_ransomware_notes.yml

@@ -28,6 +28,8 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - Clop Ransomware
+  - Chaos Ransomware
+  - LockBit Ransomware
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/deleting_shadow_copies.yml

@@ -23,7 +23,8 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi
 known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
   with modern versions of windows. They may be used by administrators to legitimately
   delete old backup copies, although this is typically rare.
-references: []
+references: 
+- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
 tags:
   analytic_story:
   - Windows Log Manipulation
@@ -32,6 +33,8 @@ tags:
   - Clop Ransomware
   - CISA AA22-264A
   - Prestige Ransomware
+  - Chaos Ransomware
+  - LockBit Ransomware
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -50,6 +50,8 @@ tags:
   - Qakbot
   - IcedID
   - Trickbot
+  - Chaos Ransomware
+  - LockBit Ransomware
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/fsutil_zeroing_file.yml

@@ -22,9 +22,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: unknown
 references:
 - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
+- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
 tags:
   analytic_story:
   - Ransomware
+  - LockBit Ransomware
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/high_process_termination_frequency.yml

@@ -20,6 +20,7 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
+  - LockBit Ransomware
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/known_services_killed_by_ransomware.yml

@@ -12,7 +12,10 @@ description: This search detects a suspicioous termination of known services kil
   the targetted files it wants to encrypts because of the open handle of those services
   to the targetted file.
 search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*",
-  "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service
+  "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch", "ccEvtMgr",
+  "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS", "QBCFMonitorService"
+  "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExecVSSProvider", "BackupExecAgentAccelerator", "BackupExec*",
+  "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend", "wscsvc", "Sense", "sppsvc", "SecurityHealthService") Message="*service
   entered the stopped state*" | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `known_services_killed_by_ransomware_filter`'
@@ -23,10 +26,13 @@ known_false_positives: Admin activities or installing related updates may do a s
 references:
 - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
+- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
 tags:
   analytic_story:
   - Ransomware
   - BlackMatter Ransomware
+  - LockBit Ransomware
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/modification_of_wallpaper.yml

@@ -23,6 +23,7 @@ known_false_positives: 3rd party tool may used to changed the wallpaper of the m
 references:
 - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
 tags:
   analytic_story:
   - Ransomware
@@ -30,6 +31,7 @@ tags:
   - BlackMatter Ransomware
   - Windows Registry Abuse
   - Brute Ratel C4
+  - LockBit Ransomware
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Chaos Ransomware
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/ransomware_notes_bulk_creation.yml

@@ -29,6 +29,8 @@ tags:
   - Clop Ransomware
   - DarkSide Ransomware
   - BlackMatter Ransomware
+  - Chaos Ransomware
+  - LockBit Ransomware
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/recon_using_wmi_class.yml

@@ -29,12 +29,14 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
 tags:
   analytic_story:
   - Hermetic Wiper
   - Malicious PowerShell
   - Industroyer2
   - Qakbot
+  - LockBit Ransomware
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -55,6 +55,7 @@ tags:
   - Windows Registry Abuse
   - Azorult
   - Qakbot
+  - Chaos Ransomware
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_process_file_path.yml

@@ -48,6 +48,8 @@ tags:
   - Trickbot
   - Azorult
   - Prestige Ransomware
+  - Chaos Ransomware
+  - LockBit Ransomware
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/uac_bypass_with_colorui_com_object.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - LockBit Ransomware
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/wbadmin_delete_system_backups.yml

@@ -29,6 +29,7 @@ tags:
   - Ryuk Ransomware
   - Ransomware
   - Prestige Ransomware
+  - Chaos Ransomware
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/wbemprox_com_object_execution.yml

@@ -26,6 +26,7 @@ tags:
   analytic_story:
   - Ransomware
   - Revil Ransomware
+  - LockBit Ransomware
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml

@@ -0,0 +1,74 @@
+name: Windows Boot or Logon Autostart Execution In Startup Folder
+id: 99d157cb-923f-4a00-aee9-1f385412146f
+version: 1
+date: '2023-01-12'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious files dropped or created in the Windows %startup% folder. 
+  This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer 
+  abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. 
+  This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to 
+  verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation.
+search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where Filesystem.file_path = "*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" 
+  by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid Filesystem.dest
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: Administrators may allow creation of script or exe in this path.
+references:
+- https://attack.mitre.org/techniques/T1204/002/
+- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia
+tags:
+  analytic_story:
+  - Chaos Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: a process dropped a file in %startup% folder in $dest$
+  mitre_attack_id:
+  - T1547.001
+  - T1547
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time 
+  - Filesystem.process_id 
+  - Filesystem.file_name 
+  - Filesystem.user 
+  - Filesystem.file_path 
+  - Filesystem.process_guid 
+  - Filesystem.dest
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/windows_modify_registry_default_icon_setting.yml

@@ -0,0 +1,77 @@
+name: Windows Modify Registry Default Icon Setting
+id: a7a7afdb-3c58-45b6-9bff-63e5acfd9d40
+version: 1
+date: '2023-01-16'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is developed to detect suspicious registry modification
+  to change the default icon association of windows to ransomware . This technique
+  was seen in Lockbit ransomware where it modified the default icon association of 
+  the compromised Windows OS  host with its dropped ransomware icon file as part of 
+  its  defacement payload. This registry is not commonly modified by a normal user 
+  so having this anomaly detection may help to catch possible lockbit ransomware 
+  infection or other malware.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path ="*\\defaultIcon\\(Default)*" Registry.registry_path = "*HKCR\\*" 
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.action Registry.dest  Registry.user 
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `drop_dm_object_name(Registry)` 
+  | `windows_modify_registry_default_icon_setting_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
+- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
+tags:
+  analytic_story:
+  - LockBit Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: a registry $Registry.registry_path$ was modified or created to modify defaulticon settings of the $dest$
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml

@@ -0,0 +1,76 @@
+name: Windows Phishing PDF File Executes URL Link
+id: 2fa9dec8-9d8e-46d3-96c1-202c06f0e6e1
+version: 1
+date: '2023-01-18'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is developed to detect suspicious pdf viewer processes that have a browser application child processes. 
+  This event was seen in a pdf spear phishing attachment containing a malicious URL link to download the actual payload. 
+  When a user clicks the malicious link the pdf viewer application will execute a process of the host default browser 
+  to connect to the malicious site. This anomaly detection can be a good indicator that a possible pdf file has a link 
+  executed by a user. The pdf viewer and browser list in this detection is still in progress, add the common browser 
+  and pdf viewer you use in opening pdf in your network.  
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.parent_process_name  IN ("AcroRd32.exe", "FoxitPDFReader.exe") Processes.process_name IN ("firefox.exe", "chrome.exe", "iexplore.exe")  
+    by Processes.user Processes.parent_process_name Processes.process_name  Processes.parent_process Processes.process Processes.process_id Processes.dest 
+  |`drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_phishing_pdf_file_executes_url_link_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting
+  information on process that include the name of the process responsible for the
+  changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
+known_false_positives: False positives in PDF file opened PDF Viewer having legitimate URL link, however filter as needed.
+references:
+- https://twitter.com/pr0xylife/status/1615382907446767616?s=20
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Weaponization
+  message: a pdf file opened in pdf viewer process $parent_process_name$ has a child process of a browser $process_name$ in $dest$
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_replication_through_removable_media.yml

@@ -0,0 +1,88 @@
+name: Windows Replication Through Removable Media
+id: 60df805d-4605-41c8-bbba-57baa6a4eb97
+version: 1
+date: '2023-01-17'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is developed to detect suspicious executable or script files created or dropped 
+  in the root drive of a targeted host. This technique is commonly used by threat actors, adversaries or 
+  even red teamers to replicate or spread in possible removable drives. Back then, WORM malware was popular 
+  for this technique where it would drop a copy of itself in the root drive to be able to spread or to have 
+  a lateral movement in other network machines. Nowadays, Ransomware like CHAOS ransomware also use this 
+  technique to spread its malicious code in possible removable drives. Thi TTP detection can be a good 
+  indicator that a process might create a persistence technique or lateral movement of a targeted machine. 
+  We suggest checking the process name that creates this event, the file created, user type, and the reason 
+  why that executable or scripts are dropped in the root drive.
+search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys 
+  OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe 
+  OR Filesystem.file_name = *.js  OR Filesystem.file_name= *.bat OR Filesystem.file_name = *.cmd 
+  OR Filesystem.file_name = *.pif) 
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.user
+  | `drop_dm_object_name(Filesystem)`
+  | eval dropped_file_path = split(file_path, "\\")
+  | eval dropped_file_path_split_count = mvcount(dropped_file_path)
+  | eval root_drive = mvindex(dropped_file_path,0)
+  | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2  AND root_drive!= "C:"
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_replication_through_removable_media_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: Administrators may allow creation of script or exe in the paths
+  specified. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1204/002/
+- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia
+tags:
+  analytic_story:
+  - Chaos Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: executable or script $file_path$ was drop in root drive $root_drive$ in $dest$
+  mitre_attack_id:
+  - T1091
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_id
+    type: Process
+    role:
+    - Attacker
+  - name: file_name
+    type: File Name
+    role:
+    - Other
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml

@@ -0,0 +1,74 @@
+name: Windows User Execution Malicious URL Shortcut File
+id: 5c7ee6ad-baf4-44fb-b2f0-0cfeddf82dbc
+version: 1
+date: '2023-01-12'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious creation of URL shortcut link files.
+  This technique was seen in CHAOS ransomware where it will drop this .url link file in %startup% folder 
+  that contains the path of its malicious dropped file to execute upon the reboot of the targeted host. 
+  The creation of this file can be created by a normal application or software but it is a good practice to verify this type 
+  of file specially the resource it tries to execute which is commonly a website.
+search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where NOT(Filesystem.file_path IN ("*\\Program Files*")) Filesystem.file_name = *.url
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid Filesystem.dest
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_user_execution_malicious_url_shortcut_file_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: Administrators may allow creation of script or exe in this path.
+references:
+- https://attack.mitre.org/techniques/T1204/002/
+- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia
+tags:
+  analytic_story:
+  - Chaos Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: a process created URL shortcut file in $file_path$ of $dest$
+  mitre_attack_id:
+  - T1204.002
+  - T1204
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time 
+  - Filesystem.process_id 
+  - Filesystem.file_name 
+  - Filesystem.user 
+  - Filesystem.file_path 
+  - Filesystem.process_guid 
+  - Filesystem.dest
+  risk_score: 64
+  security_domain: endpoint

lookups/ransomware_notes.csv

@@ -67,4 +67,6 @@ TELEGRAM-RECOVER.txt,True
 FUSION-README.txt,True
 MILIHPEN-INSTRUCT.txt,True
 GANGBANG-NOTE.txt,True
-GET_YOUR_FILES_BACK.txt,True
+GET_YOUR_FILES_BACK.txt,True
+read_it.txt,True
+*.README.txt, True

stories/ransomware_chaos.yml

@@ -0,0 +1,28 @@
+name: Chaos Ransomware
+id: 153d7b8f-27f2-4e4d-bae8-dfafd93a22a8
+version: 1
+date: '2023-01-11'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Chaos ransomware, including looking for file writes (file encryption and ransomware notes), 
+  deleting shadow volume storage, registry key modification, dropping of files in startup folder, and more.
+narrative: CHAOS ransomware has been seen and monitored since 2021. This ransomware is purportedly a .NET version of Ryuk ransomware 
+  but upon closer look to its code and behavior, this malware sample reveals that it doesn't share much relation to the notorious RYUK 
+  ransomware. This ransomware is one of the known ransomware that was used in the ongoing geo-political war. 
+  This ransomware is capable to check that only one copy of itself is running on the targeted host, delay of execution as part of its 
+  defense evasion technique, persistence through registry and startup folder, drop a copy of itself in each root drive of the targeted host and also in 
+  %appdata% folder and many more. As of writing this ransomware is still active and keeps on infecting Windows Operating machines and Windows networks.
+references:
+- https://blog.qualys.com/vulnerabilities-threat-research/2022/01/17/the-chaos-ransomware-can-be-ravaging
+- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-in-fake-minecraft-alt-list-brings-destruction
+- https://marcoramilli.com/2021/06/14/the-allegedly-ryuk-ransomware-builder-ryukjoke/
+- https://www.trendmicro.com/en_us/research/21/h/chaos-ransomware-a-dangerous-proof-of-concept.html
+tags:
+  analytic_story: Chaos Ransomware
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/ransomware_lockbit.yml

@@ -0,0 +1,28 @@
+name: LockBit Ransomware
+id: 67e5b98d-16d6-46a6-8d00-070a3d1a5cfc
+version: 1
+date: '2023-01-16'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the LockBit ransomware, including looking for file writes (file encryption and ransomware notes), 
+  deleting services, terminating processes, registry key modification and more.
+narrative: LockBit ransomware was first seen in 2019. This ransomware was used by cybercriminal in targeting multiple sectors 
+  and organizations. Lockbit is one of the ransomware being offered as a Ransomware-as-a-Service(RaaS) and also known to affiliates 
+  to implement the 'double extortion' techniques by uploading the stolen and sensitive victim information to their dark website and then 
+  threatening to sell/release it in public if their demands are not met.
+  LockBit Ransomware advertised opportunities for threat actors that could provide credential access via RDP and VPN. Aside from this it is also 
+  uses threat emulation like Cobalt Strike and Metasploit to gain foot hold to the targeted host and persist if needed.
+references:
+- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
+- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
+- https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom
+- https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html
+tags:
+  analytic_story: LockBit Ransomware
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.test.yml

@@ -0,0 +1,13 @@
+name: Windows Boot or Logon Autostart Execution In Startup Folder Unit Test
+tests:
+- name: Windows Boot or Logon Autostart Execution In Startup Folder
+  file: endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_modify_registry_default_icon_setting.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry Default Icon Setting Unit Test
+tests:
+- name: Windows Modify Registry Default Icon Setting
+  file: endpoint/windows_modify_registry_default_icon_setting.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_phishing_pdf_file_executes_url_link.test.yml

@@ -0,0 +1,13 @@
+name: Windows Phishing PDF File Executes URL Link Unit Test
+tests:
+- name: Windows Phishing PDF File Executes URL Link
+  file: endpoint/windows_phishing_pdf_file_executes_url_link.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_replication_through_removable_media.test.yml

@@ -0,0 +1,13 @@
+name: Windows Replication Through Removable Media Unit Test
+tests:
+- name: Windows Replication Through Removable Media
+  file: endpoint/windows_replication_through_removable_media.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_user_execution_malicious_url_shortcut_file.test.yml

@@ -0,0 +1,13 @@
+name: Windows User Execution Malicious URL Shortcut File Unit Test
+tests:
+- name: Windows User Execution Malicious URL Shortcut File
+  file: endpoint/windows_user_execution_malicious_url_shortcut_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true