diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 75ca92e6aa..c19a9120a2 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -40,6 +40,7 @@ tags: - DarkCrystal RAT - ProxyNotShell - Qakbot + - Chaos Ransomware automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index 3bce2a6ac9..071ddb2a89 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -25,6 +25,7 @@ tags: analytic_story: - DarkSide Ransomware - Ransomware + - LockBit Ransomware confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 25bbb4a2bd..24921bdde0 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -42,6 +42,7 @@ tags: - Cobalt Strike - Trickbot - DarkSide Ransomware + - LockBit Ransomware asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 7bab6d3cf5..1272021186 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -35,6 +35,7 @@ tags: - Ransomware - Clop Ransomware - Prestige Ransomware + - LockBit Ransomware asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index b2ec69afa8..6242356df4 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -28,6 +28,8 @@ tags: - Ransomware - Ryuk Ransomware - Clop Ransomware + - Chaos Ransomware + - LockBit Ransomware asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 7f43d65e98..f3cb03beba 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -23,7 +23,8 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare. -references: [] +references: +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html tags: analytic_story: - Windows Log Manipulation @@ -32,6 +33,8 @@ tags: - Clop Ransomware - CISA AA22-264A - Prestige Ransomware + - Chaos Ransomware + - LockBit Ransomware asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 8c1c101d48..636a33c60c 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -50,6 +50,8 @@ tags: - Qakbot - IcedID - Trickbot + - Chaos Ransomware + - LockBit Ransomware automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index b4bfe13872..d030ac45a0 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -22,9 +22,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: unknown references: - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ tags: analytic_story: - Ransomware + - LockBit Ransomware confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 4761de2a67..fea8ad2a57 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -20,6 +20,7 @@ references: tags: analytic_story: - Clop Ransomware + - LockBit Ransomware confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index cf1a772082..73c83c11be 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -12,7 +12,10 @@ description: This search detects a suspicioous termination of known services kil the targetted files it wants to encrypts because of the open handle of those services to the targetted file. search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", - "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service + "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch", "ccEvtMgr", + "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS", "QBCFMonitorService" + "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExecVSSProvider", "BackupExecAgentAccelerator", "BackupExec*", + "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend", "wscsvc", "Sense", "sppsvc", "SecurityHealthService") Message="*service entered the stopped state*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' @@ -23,10 +26,13 @@ known_false_positives: Admin activities or installing related updates may do a s references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html tags: analytic_story: - Ransomware - BlackMatter Ransomware + - LockBit Ransomware confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 38ccf17f52..a0c6c4ef9b 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -23,6 +23,7 @@ known_false_positives: 3rd party tool may used to changed the wallpaper of the m references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ tags: analytic_story: - Ransomware @@ -30,6 +31,7 @@ tags: - BlackMatter Ransomware - Windows Registry Abuse - Brute Ratel C4 + - LockBit Ransomware confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index bc692cb9bb..34039280f2 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Ransomware + - Chaos Ransomware confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 7f18f31534..6f2c6922a7 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -29,6 +29,8 @@ tags: - Clop Ransomware - DarkSide Ransomware - BlackMatter Ransomware + - Chaos Ransomware + - LockBit Ransomware confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index b26be86d4d..d2097f3cea 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -29,12 +29,14 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html tags: analytic_story: - Hermetic Wiper - Malicious PowerShell - Industroyer2 - Qakbot + - LockBit Ransomware confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 26a6a1e9d8..f34b445490 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -55,6 +55,7 @@ tags: - Windows Registry Abuse - Azorult - Qakbot + - Chaos Ransomware asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index faa1253add..d7d110624c 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -48,6 +48,8 @@ tags: - Trickbot - Azorult - Prestige Ransomware + - Chaos Ransomware + - LockBit Ransomware automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 71d29c0821..08b8f787e5 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - Ransomware + - LockBit Ransomware confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 4c0c735e3a..0f247f45be 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -29,6 +29,7 @@ tags: - Ryuk Ransomware - Ransomware - Prestige Ransomware + - Chaos Ransomware asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 5d4fccd4ac..954a94377f 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -26,6 +26,7 @@ tags: analytic_story: - Ransomware - Revil Ransomware + - LockBit Ransomware confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml new file mode 100644 index 0000000000..b8c554c60b --- /dev/null +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -0,0 +1,74 @@ +name: Windows Boot or Logon Autostart Execution In Startup Folder +id: 99d157cb-923f-4a00-aee9-1f385412146f +version: 1 +date: '2023-01-12' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic will identify suspicious files dropped or created in the Windows %startup% folder. + This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer + abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. + This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to + verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_path = "*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid Filesystem.dest + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in this path. +references: +- https://attack.mitre.org/techniques/T1204/002/ +- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia +tags: + analytic_story: + - Chaos Ransomware + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: a process dropped a file in %startup% folder in $dest$ + mitre_attack_id: + - T1547.001 + - T1547 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + - Filesystem.process_guid + - Filesystem.dest + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/windows_modify_registry_default_icon_setting.yml b/detections/endpoint/windows_modify_registry_default_icon_setting.yml new file mode 100644 index 0000000000..2225c79eba --- /dev/null +++ b/detections/endpoint/windows_modify_registry_default_icon_setting.yml @@ -0,0 +1,77 @@ +name: Windows Modify Registry Default Icon Setting +id: a7a7afdb-3c58-45b6-9bff-63e5acfd9d40 +version: 1 +date: '2023-01-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is developed to detect suspicious registry modification + to change the default icon association of windows to ransomware . This technique + was seen in Lockbit ransomware where it modified the default icon association of + the compromised Windows OS host with its dropped ransomware icon file as part of + its defacement payload. This registry is not commonly modified by a normal user + so having this anomaly detection may help to catch possible lockbit ransomware + infection or other malware. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\defaultIcon\\(Default)*" Registry.registry_path = "*HKCR\\*" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.action Registry.dest Registry.user + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `windows_modify_registry_default_icon_setting_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ +tags: + analytic_story: + - LockBit Ransomware + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a registry $Registry.registry_path$ was modified or created to modify defaulticon settings of the $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.action + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml new file mode 100644 index 0000000000..3e9c1182ee --- /dev/null +++ b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml @@ -0,0 +1,76 @@ +name: Windows Phishing PDF File Executes URL Link +id: 2fa9dec8-9d8e-46d3-96c1-202c06f0e6e1 +version: 1 +date: '2023-01-18' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is developed to detect suspicious pdf viewer processes that have a browser application child processes. + This event was seen in a pdf spear phishing attachment containing a malicious URL link to download the actual payload. + When a user clicks the malicious link the pdf viewer application will execute a process of the host default browser + to connect to the malicious site. This anomaly detection can be a good indicator that a possible pdf file has a link + executed by a user. The pdf viewer and browser list in this detection is still in progress, add the common browser + and pdf viewer you use in opening pdf in your network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name IN ("AcroRd32.exe", "FoxitPDFReader.exe") Processes.process_name IN ("firefox.exe", "chrome.exe", "iexplore.exe") + by Processes.user Processes.parent_process_name Processes.process_name Processes.parent_process Processes.process Processes.process_id Processes.dest + |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_phishing_pdf_file_executes_url_link_filter`' +how_to_implement: To successfully implement this search you need to be ingesting + information on process that include the name of the process responsible for the + changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. +known_false_positives: False positives in PDF file opened PDF Viewer having legitimate URL link, however filter as needed. +references: +- https://twitter.com/pr0xylife/status/1615382907446767616?s=20 +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon.log + impact: 80 + kill_chain_phases: + - Weaponization + message: a pdf file opened in pdf viewer process $parent_process_name$ has a child process of a browser $process_name$ in $dest$ + mitre_attack_id: + - T1566.001 + - T1566 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml new file mode 100644 index 0000000000..a9ee284978 --- /dev/null +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -0,0 +1,88 @@ +name: Windows Replication Through Removable Media +id: 60df805d-4605-41c8-bbba-57baa6a4eb97 +version: 1 +date: '2023-01-17' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is developed to detect suspicious executable or script files created or dropped + in the root drive of a targeted host. This technique is commonly used by threat actors, adversaries or + even red teamers to replicate or spread in possible removable drives. Back then, WORM malware was popular + for this technique where it would drop a copy of itself in the root drive to be able to spread or to have + a lateral movement in other network machines. Nowadays, Ransomware like CHAOS ransomware also use this + technique to spread its malicious code in possible removable drives. Thi TTP detection can be a good + indicator that a process might create a persistence technique or lateral movement of a targeted machine. + We suggest checking the process name that creates this event, the file created, user type, and the reason + why that executable or scripts are dropped in the root drive. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys + OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe + OR Filesystem.file_name = *.js OR Filesystem.file_name= *.bat OR Filesystem.file_name = *.cmd + OR Filesystem.file_name = *.pif) + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") + | eval dropped_file_path_split_count = mvcount(dropped_file_path) + | eval root_drive = mvindex(dropped_file_path,0) + | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= "C:" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_replication_through_removable_media_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in the paths + specified. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1204/002/ +- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia +tags: + analytic_story: + - Chaos Ransomware + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: executable or script $file_path$ was drop in root drive $root_drive$ in $dest$ + mitre_attack_id: + - T1091 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: process_id + type: Process + role: + - Attacker + - name: file_name + type: File Name + role: + - Other + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml new file mode 100644 index 0000000000..517ab6f776 --- /dev/null +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -0,0 +1,74 @@ +name: Windows User Execution Malicious URL Shortcut File +id: 5c7ee6ad-baf4-44fb-b2f0-0cfeddf82dbc +version: 1 +date: '2023-01-12' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic will identify suspicious creation of URL shortcut link files. + This technique was seen in CHAOS ransomware where it will drop this .url link file in %startup% folder + that contains the path of its malicious dropped file to execute upon the reboot of the targeted host. + The creation of this file can be created by a normal application or software but it is a good practice to verify this type + of file specially the resource it tries to execute which is commonly a website. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where NOT(Filesystem.file_path IN ("*\\Program Files*")) Filesystem.file_name = *.url + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid Filesystem.dest + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_user_execution_malicious_url_shortcut_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in this path. +references: +- https://attack.mitre.org/techniques/T1204/002/ +- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia +tags: + analytic_story: + - Chaos Ransomware + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a process created URL shortcut file in $file_path$ of $dest$ + mitre_attack_id: + - T1204.002 + - T1204 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + - Filesystem.process_guid + - Filesystem.dest + risk_score: 64 + security_domain: endpoint diff --git a/lookups/ransomware_notes.csv b/lookups/ransomware_notes.csv index a01b0aae19..2b6fa28508 100644 --- a/lookups/ransomware_notes.csv +++ b/lookups/ransomware_notes.csv @@ -67,4 +67,6 @@ TELEGRAM-RECOVER.txt,True FUSION-README.txt,True MILIHPEN-INSTRUCT.txt,True GANGBANG-NOTE.txt,True -GET_YOUR_FILES_BACK.txt,True \ No newline at end of file +GET_YOUR_FILES_BACK.txt,True +read_it.txt,True +*.README.txt, True \ No newline at end of file diff --git a/stories/ransomware_chaos.yml b/stories/ransomware_chaos.yml new file mode 100644 index 0000000000..ac7a80f392 --- /dev/null +++ b/stories/ransomware_chaos.yml @@ -0,0 +1,28 @@ +name: Chaos Ransomware +id: 153d7b8f-27f2-4e4d-bae8-dfafd93a22a8 +version: 1 +date: '2023-01-11' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Chaos ransomware, including looking for file writes (file encryption and ransomware notes), + deleting shadow volume storage, registry key modification, dropping of files in startup folder, and more. +narrative: CHAOS ransomware has been seen and monitored since 2021. This ransomware is purportedly a .NET version of Ryuk ransomware + but upon closer look to its code and behavior, this malware sample reveals that it doesn't share much relation to the notorious RYUK + ransomware. This ransomware is one of the known ransomware that was used in the ongoing geo-political war. + This ransomware is capable to check that only one copy of itself is running on the targeted host, delay of execution as part of its + defense evasion technique, persistence through registry and startup folder, drop a copy of itself in each root drive of the targeted host and also in + %appdata% folder and many more. As of writing this ransomware is still active and keeps on infecting Windows Operating machines and Windows networks. +references: +- https://blog.qualys.com/vulnerabilities-threat-research/2022/01/17/the-chaos-ransomware-can-be-ravaging +- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-in-fake-minecraft-alt-list-brings-destruction +- https://marcoramilli.com/2021/06/14/the-allegedly-ryuk-ransomware-builder-ryukjoke/ +- https://www.trendmicro.com/en_us/research/21/h/chaos-ransomware-a-dangerous-proof-of-concept.html +tags: + analytic_story: Chaos Ransomware + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/ransomware_lockbit.yml b/stories/ransomware_lockbit.yml new file mode 100644 index 0000000000..93799525b1 --- /dev/null +++ b/stories/ransomware_lockbit.yml @@ -0,0 +1,28 @@ +name: LockBit Ransomware +id: 67e5b98d-16d6-46a6-8d00-070a3d1a5cfc +version: 1 +date: '2023-01-16' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the LockBit ransomware, including looking for file writes (file encryption and ransomware notes), + deleting services, terminating processes, registry key modification and more. +narrative: LockBit ransomware was first seen in 2019. This ransomware was used by cybercriminal in targeting multiple sectors + and organizations. Lockbit is one of the ransomware being offered as a Ransomware-as-a-Service(RaaS) and also known to affiliates + to implement the 'double extortion' techniques by uploading the stolen and sensitive victim information to their dark website and then + threatening to sell/release it in public if their demands are not met. + LockBit Ransomware advertised opportunities for threat actors that could provide credential access via RDP and VPN. Aside from this it is also + uses threat emulation like Cobalt Strike and Metasploit to gain foot hold to the targeted host and persist if needed. +references: +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ +- https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom +- https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html +tags: + analytic_story: LockBit Ransomware + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.test.yml b/tests/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.test.yml new file mode 100644 index 0000000000..7b43b835c8 --- /dev/null +++ b/tests/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.test.yml @@ -0,0 +1,13 @@ +name: Windows Boot or Logon Autostart Execution In Startup Folder Unit Test +tests: +- name: Windows Boot or Logon Autostart Execution In Startup Folder + file: endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_default_icon_setting.test.yml b/tests/endpoint/windows_modify_registry_default_icon_setting.test.yml new file mode 100644 index 0000000000..1b39e07477 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_default_icon_setting.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Default Icon Setting Unit Test +tests: +- name: Windows Modify Registry Default Icon Setting + file: endpoint/windows_modify_registry_default_icon_setting.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_phishing_pdf_file_executes_url_link.test.yml b/tests/endpoint/windows_phishing_pdf_file_executes_url_link.test.yml new file mode 100644 index 0000000000..5758d979d1 --- /dev/null +++ b/tests/endpoint/windows_phishing_pdf_file_executes_url_link.test.yml @@ -0,0 +1,13 @@ +name: Windows Phishing PDF File Executes URL Link Unit Test +tests: +- name: Windows Phishing PDF File Executes URL Link + file: endpoint/windows_phishing_pdf_file_executes_url_link.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_replication_through_removable_media.test.yml b/tests/endpoint/windows_replication_through_removable_media.test.yml new file mode 100644 index 0000000000..84096e3bf3 --- /dev/null +++ b/tests/endpoint/windows_replication_through_removable_media.test.yml @@ -0,0 +1,13 @@ +name: Windows Replication Through Removable Media Unit Test +tests: +- name: Windows Replication Through Removable Media + file: endpoint/windows_replication_through_removable_media.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_user_execution_malicious_url_shortcut_file.test.yml b/tests/endpoint/windows_user_execution_malicious_url_shortcut_file.test.yml new file mode 100644 index 0000000000..efa4ded98a --- /dev/null +++ b/tests/endpoint/windows_user_execution_malicious_url_shortcut_file.test.yml @@ -0,0 +1,13 @@ +name: Windows User Execution Malicious URL Shortcut File Unit Test +tests: +- name: Windows User Execution Malicious URL Shortcut File + file: endpoint/windows_user_execution_malicious_url_shortcut_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true