Branch was auto-updated.

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -44,6 +44,7 @@ tags:
   - Industroyer2
   - Azorult
   - DarkCrystal RAT
+  - Brute Ratel C4
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/modification_of_wallpaper.yml

@@ -29,6 +29,7 @@ tags:
   - Revil Ransomware
   - BlackMatter Ransomware
   - Windows Registry Abuse
+  - Brute Ratel C4
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/suspicious_process_file_path.yml

@@ -40,6 +40,7 @@ tags:
   - Hermetic Wiper
   - Industroyer2
   - DarkCrystal RAT
+  - Brute Ratel C4
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/windows_iso_lnk_file_creation.yml

@@ -22,6 +22,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Brute Ratel C4
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -1,11 +1,11 @@
-name: Windows Service Created With Suspicious Service Path
+name: Windows Service Created with Suspicious Service Path
 id: 429141be-8311-11eb-adb6-acde48001122
-version: 2
-date: '2021-11-22'
+version: 3
+date: '2022-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
+description: The following analytics uses Windows Event Id 7045, `New Service Was Installed`,
   to identify the creation of a Windows Service where the service binary path path
   is located in a non-common Service folder in Windows. Red Teams and adversaries
   alike may create malicious Services for lateral movement or remote code execution
@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Clop Ransomware
   - Active Directory Lateral Movement
+  - Brute Ratel C4
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_service_creation_using_registry_entry.yml

@@ -39,6 +39,7 @@ tags:
   - Suspicious Windows Registry Activities
   - Windows Persistence Techniques
   - Windows Registry Abuse
+  - Brute Ratel C4
   cis20:
   - CIS 3
   - CIS 5

stories/brute_ratel.yml

@@ -0,0 +1,27 @@
+name: Brute Ratel C4 BRc4
+id: 0ec9dbfe-f64e-46bb-8eb8-04e92326f513
+version: 1
+date: '2022-08-23'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services,
+  collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, 
+  lock workstation, get clipboard or screenshot and much more.
+narrative: Brute RATEL BRC4 is the latest red-teaming tool that simulate several TTP's. It uses several techniques 
+  like syscall, patching ETW/AMSI and written in native C to minimize noise in process command-line. This tool was seen 
+  in the wild being abused by some ransomware (blackcat) and adversaries in their campaigns to install the BRC4 agent 
+  that can serve as remote admin tool to compromise the target host or network.
+references:
+- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
+tags:
+  analytic_story: Brute Ratel C4
+  category:
+  - Data Destruction
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection