diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml similarity index 99% rename from detections/endpoint/dump_lsass_via_procdump_rename.yml rename to detections/deprecated/dump_lsass_via_procdump_rename.yml index 0887b53a48..2b1e26203e 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml @@ -3,7 +3,7 @@ id: 21276daa-663d-11eb-ae93-0242ac130002 version: 1 date: '2021-02-01' author: Michael Haag, Splunk -type: TTP +type: Hunting datamodel: [] description: 'Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 3cfc940325..ba27a7007d 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -1,7 +1,7 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 -version: 1 -date: '2021-02-01' +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: @@ -17,14 +17,11 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe - OR Processes.process_name=procdump64.exe (Processes.process=*-ma* OR Processes.process=*-mm*) - Processes.process=*lsass* by Processes.user Processes.process_name Processes.process + as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*) + Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: None identified. references: - https://attack.mitre.org/techniques/T1003/001/ diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index 505ad8b723..f1723a4acf 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -1,7 +1,7 @@ name: Local Account Discovery with Net id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 1 -date: '2021-08-19' +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -10,7 +10,7 @@ description: This analytic looks for the execution of `net.exe` or `net1.exe` wi arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") + as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`' diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index 58ad212ff3..9f8983958d 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -1,7 +1,7 @@ name: Local Account Discovery With Wmic id: 4902d7aa-0134-11ec-9d65-acde48001122 -version: 1 -date: '2021-08-19' +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -10,7 +10,7 @@ description: This analytic looks for the execution of `wmic.exe` with command-li arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) + as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`' diff --git a/macros/process_procdump.yml b/macros/process_procdump.yml new file mode 100644 index 0000000000..16e72b4b41 --- /dev/null +++ b/macros/process_procdump.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_procdump \ No newline at end of file diff --git a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml index fd04f46735..b1225d12fd 100644 --- a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml +++ b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml @@ -1,7 +1,7 @@ name: Dump lsass via procdump rename Unit Test tests: - name: Dump lsass via procdump rename - file: endpoint/dump_lsass_via_procdump_rename.yml + file: deprecated/dump_lsass_via_procdump_rename.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'