Merge branch 'develop' into cyclopsblink_fix

.gitlab-ci.yml

@@ -15,9 +15,13 @@ publish_build_to_pre_qa:
   script:
     - mkdir -p artifacts
     - pip install requests
-    - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $CI_COMMIT_REF_NAME --builds DA-ESS-ContentUpdate
+    - VERSION=$(git tag --sort=-creatordate | head -n 1)
+    - echo "Build Version - $VERSION"
+    - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $VERSION --builds DA-ESS-ContentUpdate SSA_Content
   after_script:
     - cp publish_build_to_pre_qa.log artifacts/publish_build_to_pre_qa.log
   rules:
-    - if: '$CI_COMMIT_REF_NAME =~ /^v[0-9]+\.[0-9]+\.[0-9]$/'
+    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]$/'
+      when: always
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
       when: always

bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py

@@ -100,7 +100,8 @@ class ObjToYmlAdapter(Adapter):
                             'file_name': 'UPDATE',
                             'data': 'UPDATE',
                             'source': 'UPDATE',
-                            'sourcetype': 'UPDATE'
+                            'sourcetype': 'UPDATE',
+                            'update_timestamp': True
                         }
                     ]
                 }

detections/application/splunk_dos_via_malformed_s2s_request.yml

@@ -1,12 +1,12 @@
 name: Splunk DoS via Malformed S2S Request
 id: fc246e56-953b-40c1-8634-868f9e474cbd
-version: 1
+version: 2
 date: '2022-03-24'
 author: Lou Stella, Splunk
 type: TTP
 datamodel: []
 description: On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk. 
-search: '`splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | table host, src | `splunk_dos_via_malformed_s2s_request_filter`'
+search: '`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`'
 how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422.
 known_false_positives: None.
 references:

detections/endpoint/adsisearcher_account_discovery.yml

@@ -23,6 +23,7 @@ references:
 - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
 tags:
   analytic_story:
+  - Industroyer2
   - Active Directory Discovery
   confidence: 50
   context:

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -29,6 +29,7 @@ tags:
   - Credential Dumping
   - DarkSide Ransomware
   - Windows Registry Abuse
+  - Industroyer2
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -27,6 +27,7 @@ tags:
   - Suspicious Rundll32 Activity
   - HAFNIUM Group
   - Living Off The Land
+  - Industroyer2
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -34,6 +34,7 @@ tags:
   - Active Directory Lateral Movement
   - Trickbot
   - Hermetic Wiper
+  - Industroyer2
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -41,6 +41,7 @@ tags:
   - Remcos
   - WhisperGate
   - Hermetic Wiper
+  - Industroyer2
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -39,6 +39,7 @@ tags:
   analytic_story:
   - Active Directory Lateral Movement
   - WhisperGate
+  - Industroyer2
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/linux_dd_file_overwrite.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Data Destruction
+  - Industroyer2
   asset_type: endpoint
   cis20:
   - CIS 3

detections/endpoint/linux_system_network_discovery.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Network Discovery
+  - Industroyer2
   asset_type: endpoint
   cis20:
   - CIS 3

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Industroyer2
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/suspicious_process_file_path.yml

@@ -38,6 +38,7 @@ tags:
   - Remcos
   - WhisperGate
   - Hermetic Wiper
+  - Industroyer2
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -26,7 +26,7 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   to identify source.'
 search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
   ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*",
-  "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
+  "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
   dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -48,6 +48,7 @@ tags:
   - Ryuk Ransomware
   - IcedID
   - Active Directory Lateral Movement
+  - Industroyer2
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - IcedID
   - Windows Persistence Techniques
+  - Industroyer2
   confidence: 100
   context:
   - Source:Endpoint

detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Cyclops BLink
+  - Industroyer2
   asset_type: Endpoint
   cis20:
   - CIS 3

docs/Gemfile.lock

@@ -244,19 +244,19 @@ GEM
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     mercenary (0.3.6)
-    mini_portile2 (2.7.1)
+    mini_portile2 (2.8.0)
     minima (2.5.1)
       jekyll (>= 3.5, < 5.0)
       jekyll-feed (~> 0.9)
       jekyll-seo-tag (~> 2.1)
     minitest (5.15.0)
     multipart-post (2.1.1)
-    nokogiri (1.13.1)
-      mini_portile2 (~> 2.7.0)
+    nokogiri (1.13.4)
+      mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
-    nokogiri (1.13.1-x86_64-darwin)
+    nokogiri (1.13.4-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.13.1-x86_64-linux)
+    nokogiri (1.13.4-x86_64-linux)
       racc (~> 1.4)
     octokit (4.22.0)
       faraday (>= 0.9)

stories/industroyer2.yml

@@ -0,0 +1,25 @@
+name: Industroyer2
+id: 7ff7db2b-b001-498e-8fe8-caf2dbc3428a
+version: 1
+date: '2022-04-21'
+author: Teoderick Contreras, Splunk
+type: batch
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Industroyer2 attack, including file writes associated with its payload, 
+  lateral movement, persistence, privilege escalation and data destruction.
+narrative: Industroyer2 is part of continuous attack to ukraine targeting energy facilities.
+  This malware is a windows binary that implement IEC-104 protocol to communicate with industrial equipments.
+  This attack consist of several destructive linux script component to wipe or delete several linux critical files, 
+  powershell for domain enumeration and caddywiper to wipe boot sector of the targeted host.
+references:
+- https://cert.gov.ua/article/39518
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+tags:
+  analytic_story: Industroyer2
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection