diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index f729c0b34b..8712b4c148 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -15,9 +15,13 @@ publish_build_to_pre_qa: script: - mkdir -p artifacts - pip install requests - - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $CI_COMMIT_REF_NAME --builds DA-ESS-ContentUpdate + - VERSION=$(git tag --sort=-creatordate | head -n 1) + - echo "Build Version - $VERSION" + - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $VERSION --builds DA-ESS-ContentUpdate SSA_Content after_script: - cp publish_build_to_pre_qa.log artifacts/publish_build_to_pre_qa.log rules: - - if: '$CI_COMMIT_REF_NAME =~ /^v[0-9]+\.[0-9]+\.[0-9]$/' + - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]$/' + when: always + - if: '$CI_PIPELINE_SOURCE == "schedule"' when: always diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index c48708b448..49b8db76c1 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -100,7 +100,8 @@ class ObjToYmlAdapter(Adapter): 'file_name': 'UPDATE', 'data': 'UPDATE', 'source': 'UPDATE', - 'sourcetype': 'UPDATE' + 'sourcetype': 'UPDATE', + 'update_timestamp': True } ] } diff --git a/detections/application/splunk_dos_via_malformed_s2s_request.yml b/detections/application/splunk_dos_via_malformed_s2s_request.yml index d2d9bbcb34..caf3b5e9a5 100644 --- a/detections/application/splunk_dos_via_malformed_s2s_request.yml +++ b/detections/application/splunk_dos_via_malformed_s2s_request.yml @@ -1,12 +1,12 @@ name: Splunk DoS via Malformed S2S Request id: fc246e56-953b-40c1-8634-868f9e474cbd -version: 1 +version: 2 date: '2022-03-24' author: Lou Stella, Splunk type: TTP datamodel: [] description: On March 24th, 2022, Splunk published a security advisory for a possible Denial of Service stemming from the lack of validation in a specific key-value field in the Splunk-to-Splunk (S2S) protocol. This detection will alert on attempted exploitation in patched versions of Splunk. -search: '`splunkd` log_level=ERROR component=TcpInputProc thread_name=FwdDataReceiverThread | table host, src | `splunk_dos_via_malformed_s2s_request_filter`' +search: '`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`' how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422. known_false_positives: None. references: diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 10a6c955df..e9538f85fd 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -23,6 +23,7 @@ references: - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ tags: analytic_story: + - Industroyer2 - Active Directory Discovery confidence: 50 context: diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 280cd8db84..9547305518 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -29,6 +29,7 @@ tags: - Credential Dumping - DarkSide Ransomware - Windows Registry Abuse + - Industroyer2 asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 8c90706d14..fcb38967de 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -27,6 +27,7 @@ tags: - Suspicious Rundll32 Activity - HAFNIUM Group - Living Off The Land + - Industroyer2 asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 9a10c51742..e8c96f3fb8 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -34,6 +34,7 @@ tags: - Active Directory Lateral Movement - Trickbot - Hermetic Wiper + - Industroyer2 automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index a29cb171b9..c895a2846b 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -41,6 +41,7 @@ tags: - Remcos - WhisperGate - Hermetic Wiper + - Industroyer2 automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 6c612f9e3b..051e857767 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -39,6 +39,7 @@ tags: analytic_story: - Active Directory Lateral Movement - WhisperGate + - Industroyer2 confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index cda83ffe62..7c20077758 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Data Destruction + - Industroyer2 asset_type: endpoint cis20: - CIS 3 diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index a6b4430ada..c7ba8f4f58 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Network Discovery + - Industroyer2 asset_type: endpoint cis20: - CIS 3 diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index f9eadac1ff..f846173778 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - XMRig + - Industroyer2 confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index bb98c9ccf2..40cedea8de 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -38,6 +38,7 @@ tags: - Remcos - WhisperGate - Hermetic Wiper + - Industroyer2 automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index fe04448577..5f063fbc8e 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -26,7 +26,7 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s to identify source.' search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", - "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by + "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -48,6 +48,7 @@ tags: - Ryuk Ransomware - IcedID - Active Directory Lateral Movement + - Industroyer2 confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 2d1e5ce286..a021bdb930 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -31,6 +31,7 @@ tags: analytic_story: - IcedID - Windows Persistence Techniques + - Industroyer2 confidence: 100 context: - Source:Endpoint diff --git a/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml index d72e417d28..3d1f335194 100644 --- a/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ b/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Cyclops BLink + - Industroyer2 asset_type: Endpoint cis20: - CIS 3 diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock index eefbdcccab..fe8e8133c2 100644 --- a/docs/Gemfile.lock +++ b/docs/Gemfile.lock @@ -244,19 +244,19 @@ GEM rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) mercenary (0.3.6) - mini_portile2 (2.7.1) + mini_portile2 (2.8.0) minima (2.5.1) jekyll (>= 3.5, < 5.0) jekyll-feed (~> 0.9) jekyll-seo-tag (~> 2.1) minitest (5.15.0) multipart-post (2.1.1) - nokogiri (1.13.1) - mini_portile2 (~> 2.7.0) + nokogiri (1.13.4) + mini_portile2 (~> 2.8.0) racc (~> 1.4) - nokogiri (1.13.1-x86_64-darwin) + nokogiri (1.13.4-x86_64-darwin) racc (~> 1.4) - nokogiri (1.13.1-x86_64-linux) + nokogiri (1.13.4-x86_64-linux) racc (~> 1.4) octokit (4.22.0) faraday (>= 0.9) diff --git a/stories/industroyer2.yml b/stories/industroyer2.yml new file mode 100644 index 0000000000..af1406c14c --- /dev/null +++ b/stories/industroyer2.yml @@ -0,0 +1,25 @@ +name: Industroyer2 +id: 7ff7db2b-b001-498e-8fe8-caf2dbc3428a +version: 1 +date: '2022-04-21' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Industroyer2 attack, including file writes associated with its payload, + lateral movement, persistence, privilege escalation and data destruction. +narrative: Industroyer2 is part of continuous attack to ukraine targeting energy facilities. + This malware is a windows binary that implement IEC-104 protocol to communicate with industrial equipments. + This attack consist of several destructive linux script component to wipe or delete several linux critical files, + powershell for domain enumeration and caddywiper to wipe boot sector of the targeted host. +references: +- https://cert.gov.ua/article/39518 +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +tags: + analytic_story: Industroyer2 + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file