diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index e29c8a8020..b0e039625a 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -1,7 +1,7 @@ name: Batch File Write to System32 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -version: 3 -date: '2022-12-21' +version: 4 +date: '2023-4-11' author: Steven Dick, Michael Haag, Rico Valdez, Splunk status: production type: TTP @@ -9,16 +9,17 @@ description: The search looks for a batch file (.bat) written to the Windows sys directory tree. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=* by _time span=1h Processes.process_id Processes.process_name - Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| - tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*", - "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | fields _time dest file_create_time file_name file_path process_name process_path - process] | dedup file_create_time | table dest, file_create_time, file_name, file_path, - process_name | `batch_file_write_to_system32_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where +Processes.process_name=* by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` | join process_guid + [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*\\system32\\*", "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)`] +| table dest user file_create_time, file_name, file_path, process_name, firstTime, lastTime +| dedup file_create_time +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `batch_file_write_to_system32_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -63,6 +64,7 @@ tags: required_fields: - _time - Filesystem.dest + - Filesystem.file_create_time - Filesystem.file_name - Filesystem.user - Filesystem.file_path @@ -71,6 +73,7 @@ tags: - Filesystem.process_guid - Processes.process_guid - Processes.dest + - Processes.process_name risk_score: 63 security_domain: endpoint tests: diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 030fb33747..9d50af0797 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -5,9 +5,9 @@ date: '2022-07-15' author: Michael Haag, Splunk status: production type: TTP -description: This search is to identifies a modification in registry to disable the - windows denfender real time behavior monitoring. This event or technique is commonly - seen in RAT, bot, or Trojan to disable AV to evade detections. +description: This search identifies a modification in registry to disable the + windows defender real time behavior monitoring. This event or technique is commonly + seen in RATs, bots, or Trojans to disable AV to evade detections. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -34,12 +34,12 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: '' + message: Windows Defender Real-time Behavior Monitoring disabled on $dest$ mitre_attack_id: - T1562.001 - T1562 observable: - - name: ComputerName + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 83a13df36b..3e5c04d6df 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP description: This search is to detect a suspicious enabling of smb1protocol through - "powershell.exe". This technique was seen in some ransomware (like reddot) where + `powershell.exe`. This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. data_source: @@ -31,13 +31,13 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Powershell Enable SMB1Protocol Feature + message: Powershell Enable SMB1Protocol Feature on $Computer$ mitre_attack_id: - T1027 - T1027.005 observable: - - name: User - type: User + - name: Computer + type: Hostname role: - Victim product: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 1639b34fef..d680b0a4c3 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -44,10 +44,6 @@ tags: type: Hostname role: - Victim - - name: User - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index ed2f12552f..c40169a36e 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -56,10 +56,6 @@ tags: type: Hostname role: - Victim - - name: User - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 54481c0073..2ee1221ffb 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -32,12 +32,12 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Recursive Delete of Directory In Batch CMD + message: Recursive Delete of Directory In Batch CMD by $user$ on $dest$ mitre_attack_id: - T1070.004 - T1070 observable: - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 21ed72e938..bf129e38b3 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -30,13 +30,13 @@ tags: asset_type: Endpoint confidence: 70 impact: 90 - message: A process was started on a remote endpoint from $ComputerName by abusing + message: A process was started on a remote endpoint from $Computer$ by abusing WMI using PowerShell.exe mitre_attack_id: - T1021 - T1021.003 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim @@ -47,9 +47,9 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName - - User + - ScriptBlockText + - Computer + - user_id risk_score: 63 security_domain: endpoint tests: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index c53fa6baee..aa1ecc5e6e 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -31,12 +31,12 @@ tags: asset_type: Endpoint confidence: 70 impact: 90 - message: A process was started on a remote endpoint from $ComputerName by abusing + message: A process was started on a remote endpoint from $Computer$ by abusing WMI using PowerShell.exe mitre_attack_id: - T1047 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim @@ -48,8 +48,8 @@ tags: - _time - EventCode - Message - - ComputerName - - User + - Computer + - UserID risk_score: 63 security_domain: endpoint tests: @@ -57,4 +57,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index e25bdb9829..36ada24944 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: TTP description: This search is to detect a suspicious rundll32 process that drops executable - (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries + (.exe or .dll) files. This behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution. data_source: @@ -34,7 +34,7 @@ tags: - T1218 - T1218.011 observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml index 501a25ee70..018befafc8 100644 --- a/detections/network/remote_desktop_network_bruteforce.yml +++ b/detections/network/remote_desktop_network_bruteforce.yml @@ -27,7 +27,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: tbd + message: $dest$ may be the target of an RDP Bruteforce mitre_attack_id: - T1021.001 - T1021