From bd6a779b024881e49175f9b1a872011cd6bb0f99 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 12:06:20 -0600 Subject: [PATCH 1/3] no longer need sysmon procdump - updated superior procdump --- .../endpoint/dump_lsass_via_procdump.yml | 13 ++- .../dump_lsass_via_procdump_rename.yml | 81 ------------------- macros/process_procdump.yml | 3 + 3 files changed, 8 insertions(+), 89 deletions(-) delete mode 100644 detections/endpoint/dump_lsass_via_procdump_rename.yml create mode 100644 macros/process_procdump.yml diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 3cfc940325..ba27a7007d 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -1,7 +1,7 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 -version: 1 -date: '2021-02-01' +version: 2 +date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: @@ -17,14 +17,11 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe - OR Processes.process_name=procdump64.exe (Processes.process=*-ma* OR Processes.process=*-mm*) - Processes.process=*lsass* by Processes.user Processes.process_name Processes.process + as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*) + Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: None identified. references: - https://attack.mitre.org/techniques/T1003/001/ diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml deleted file mode 100644 index 0887b53a48..0000000000 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Dump LSASS via procdump Rename -id: 21276daa-663d-11eb-ae93-0242ac130002 -version: 1 -date: '2021-02-01' -author: Michael Haag, Splunk -type: TTP -datamodel: [] -description: 'Detect a renamed instance of procdump.exe dumping the lsass process. - This query looks for both -mm and -ma usage. -mm will produce a mini dump file and - -ma will write a dump file with all process memory. Both are highly suspect and - should be reviewed. Modify the query as needed.\ - - During triage, confirm this is procdump.exe executing. If it is the first time a - Sysinternals utility has been ran, it is possible there will be a -accepteula on - the command line. Review other endpoint data sources for cross process (injection) - into lsass.exe.' -search: '`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 - (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as - dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, - process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: None identified. -references: -- https://attack.mitre.org/techniques/T1003/001/ -- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - asset_type: Endpoint - automated_detection_testing: passed - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 100 - context: - - Source:Endpoint - - Stage:Defense Evasion - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log - impact: 80 - kill_chain_phases: - - Actions on Objectives - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$, attempting to dump lsass.exe. - mitre_attack_id: - - T1003.001 - nist: - - DE.CM - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - OriginalFileName - - process_name - - EventID - - CommandLine - - Computer - - parent_process_name - risk_score: 80 - security_domain: endpoint diff --git a/macros/process_procdump.yml b/macros/process_procdump.yml new file mode 100644 index 0000000000..16e72b4b41 --- /dev/null +++ b/macros/process_procdump.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_procdump \ No newline at end of file From 9c08c1f2f42878fc87574bba30e86d2774a8fbd9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 12:14:26 -0600 Subject: [PATCH 2/3] fixes --- .../dump_lsass_via_procdump_rename.yml | 81 +++++++++++++++++++ .../local_account_discovery_with_net.yml | 6 +- .../local_account_discovery_with_wmic.yml | 6 +- 3 files changed, 87 insertions(+), 6 deletions(-) create mode 100644 detections/deprecated/dump_lsass_via_procdump_rename.yml diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml new file mode 100644 index 0000000000..2b1e26203e --- /dev/null +++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml @@ -0,0 +1,81 @@ +name: Dump LSASS via procdump Rename +id: 21276daa-663d-11eb-ae93-0242ac130002 +version: 1 +date: '2021-02-01' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] +description: 'Detect a renamed instance of procdump.exe dumping the lsass process. + This query looks for both -mm and -ma usage. -mm will produce a mini dump file and + -ma will write a dump file with all process memory. Both are highly suspect and + should be reviewed. Modify the query as needed.\ + + During triage, confirm this is procdump.exe executing. If it is the first time a + Sysinternals utility has been ran, it is possible there will be a -accepteula on + the command line. Review other endpoint data sources for cross process (injection) + into lsass.exe.' +search: '`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 + (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as + dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, + process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: None identified. +references: +- https://attack.mitre.org/techniques/T1003/001/ +- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump +tags: + analytic_story: + - Credential Dumping + - HAFNIUM Group + asset_type: Endpoint + automated_detection_testing: passed + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$ on $dest$, attempting to dump lsass.exe. + mitre_attack_id: + - T1003.001 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - OriginalFileName + - process_name + - EventID + - CommandLine + - Computer + - parent_process_name + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index 505ad8b723..f1723a4acf 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -1,7 +1,7 @@ name: Local Account Discovery with Net id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 1 -date: '2021-08-19' +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -10,7 +10,7 @@ description: This analytic looks for the execution of `net.exe` or `net1.exe` wi arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") + as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`' diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index 58ad212ff3..9f8983958d 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -1,7 +1,7 @@ name: Local Account Discovery With Wmic id: 4902d7aa-0134-11ec-9d65-acde48001122 -version: 1 -date: '2021-08-19' +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -10,7 +10,7 @@ description: This analytic looks for the execution of `wmic.exe` with command-li arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) + as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`' From 6f9c536f8e870db76793fbe836043fe480423771 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 12:15:53 -0600 Subject: [PATCH 3/3] error --- tests/endpoint/dump_lsass_via_procdump_rename.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml index fd04f46735..b1225d12fd 100644 --- a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml +++ b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml @@ -1,7 +1,7 @@ name: Dump lsass via procdump rename Unit Test tests: - name: Dump lsass via procdump rename - file: endpoint/dump_lsass_via_procdump_rename.yml + file: deprecated/dump_lsass_via_procdump_rename.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'