diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 14cce5e19f..248106dffb 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -44,6 +44,7 @@ tags: - Industroyer2 - Azorult - DarkCrystal RAT + - Brute Ratel C4 automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 279433dd8c..38ccf17f52 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -29,6 +29,7 @@ tags: - Revil Ransomware - BlackMatter Ransomware - Windows Registry Abuse + - Brute Ratel C4 confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index d5cc4c4d33..1bb5a1c902 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -40,6 +40,7 @@ tags: - Hermetic Wiper - Industroyer2 - DarkCrystal RAT + - Brute Ratel C4 automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index 73c352f48f..74a3df3852 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -22,6 +22,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Brute Ratel C4 asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 5be65564e7..c7e80d176a 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,11 +1,11 @@ -name: Windows Service Created With Suspicious Service Path +name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: 2 -date: '2021-11-22' +version: 3 +date: '2022-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, +description: The following analytics uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution @@ -28,6 +28,7 @@ tags: analytic_story: - Clop Ransomware - Active Directory Lateral Movement + - Brute Ratel C4 confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index c41790becd..725386a061 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -39,6 +39,7 @@ tags: - Suspicious Windows Registry Activities - Windows Persistence Techniques - Windows Registry Abuse + - Brute Ratel C4 cis20: - CIS 3 - CIS 5 diff --git a/stories/brute_ratel.yml b/stories/brute_ratel.yml new file mode 100644 index 0000000000..b9adf892d6 --- /dev/null +++ b/stories/brute_ratel.yml @@ -0,0 +1,27 @@ +name: Brute Ratel C4 BRc4 +id: 0ec9dbfe-f64e-46bb-8eb8-04e92326f513 +version: 1 +date: '2022-08-23' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, + collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, + lock workstation, get clipboard or screenshot and much more. +narrative: Brute RATEL BRC4 is the latest red-teaming tool that simulate several TTP's. It uses several techniques + like syscall, patching ETW/AMSI and written in native C to minimize noise in process command-line. This tool was seen + in the wild being abused by some ransomware (blackcat) and adversaries in their campaigns to install the BRC4 agent + that can serve as remote admin tool to compromise the target host or network. +references: +- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ +tags: + analytic_story: Brute Ratel C4 + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection