Branch was auto-updated.

detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml

@@ -0,0 +1,52 @@
+name: Allow File And Printing Sharing In Firewall
+id: ce27646e-d411-11eb-8a00-acde48001122
+version: 1
+date: '2021-06-23'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious modification of firewall to allow
+  file and printer sharing. This technique was seen in ransomware to be able to discover
+  more machine connected to the compromised host to encrypt more files
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
+  Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*"  Processes.process="*enable=Yes*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `allow_file_and_printing_sharing_in_firewall_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: network admin may modify this firewall feature that may cause
+  this rule to be triggered.
+references:
+- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+tags:
+  analytic_story:
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log

detections/endpoint/allow_network_discovery_in_firewall.yml

@@ -0,0 +1,54 @@
+name: Allow Network Discovery In Firewall
+id: ccd6a38c-d40b-11eb-85a5-acde48001122
+version: 1
+date: '2021-06-23'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious modification to the firewall to
+  allow network discovery on a machine. This technique was seen in couple of ransomware
+  (revil, reddot) to discover other machine connected to the compromised host to encrypt
+  more files.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
+  Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*"  Processes.process="*enable*" Processes.process="*Yes*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `allow_network_discovery_in_firewall_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: network admin may modify this firewall feature that may cause
+  this rule to be triggered.
+references:
+- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -11,7 +11,7 @@ description: This following analytic detects PowerShell command to delete shadow
   to deploy DarkSide Ransomware where it executed a child process of PowerShell to
   execute a hex encoded command to delete shadow copy. This hex encoded command was
   able to be decrypted by PowerShell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*"
+search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `delete_shadowcopy_with_powershell_filter`'

detections/endpoint/disable_amsi_through_registry.yml

@@ -0,0 +1,49 @@
+name: Disable AMSI Through Registry
+id: 9c27ec42-d338-11eb-9044-acde48001122
+version: 1
+date: '2021-06-22'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to identify modification in registry to disable AMSI windows
+  feature to evade detections. This technique was seen in several ransomware, RAT
+  and even APT to impaire defenses of the compromise machine and to be able to execute
+  payload with minimal alert as much as possible.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
+  Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)"
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: network operator may disable this feature of windows but not
+  so common.
+references:
+- https://blog.f-secure.com/hunting-for-amsi-bypasses/
+- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9
+tags:
+  analytic_story:
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log

detections/endpoint/disable_etw_through_registry.yml

@@ -0,0 +1,47 @@
+name: Disable ETW Through Registry
+id: f0eacfa4-d33f-11eb-8f9d-acde48001122
+version: 1
+date: '2021-06-22'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to identify modification in registry to disable ETW windows
+  feature to evade detections. This technique was seen in several ransomware, RAT
+  and even APT to impaire defenses of the compromise machine and to be able to execute
+  payload with minimal alert as much as possible.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
+  Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: network operator may disable this feature of windows but not
+  so common.
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+tags:
+  analytic_story:
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -10,11 +10,15 @@ description: This search is to identifies a modification in registry to disable
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
-  Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path=
-  "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
-  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
-  Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)"
+  as lastTime from datamodel=Endpoint.Registry where 
+  Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR 
+  Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR 
+  Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR 
+  Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR
+  Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR 
+  Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR 
+  Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" 
+  Registry.registry_value_name = "DWORD (0x00000001)"
   by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
   Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`'
@@ -28,6 +32,8 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Ransomware
+  - Revil Ransomware
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log

detections/endpoint/excessive_service_stop_attempt.yml

@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "net.exe"
   OR  Processes.process_name = "sc.exe" OR  Processes.process_name = "net1.exe" AND
-  Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name
+  Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name
   Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
   count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`'
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Ransomware
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log

detections/endpoint/excessive_usage_of_net_app.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Ransomware
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log

detections/endpoint/excessive_usage_of_nslookup_app.yml

@@ -46,10 +46,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
+  - Computer
+  - process_name
+  - EventCode
   security_domain: endpoint

detections/endpoint/excessive_usage_of_sc_service_utility.yml

@@ -0,0 +1,46 @@
+name: Excessive Usage Of SC Service Utility
+id: cb6b339e-d4c6-11eb-a026-acde48001122
+version: 1
+date: '2021-06-24'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious excessive usage of sc.exe in a
+  host machine. This technique was seen in several ransomware , xmrig and other malware
+  to create, modify, delete or disable a service may related to security application
+  or to gain privilege escalation.
+search: '`sysmon` EventCode = 1 process_name = "sc.exe" |  bucket _time span=15m |
+  stats values(process) as process count as numScExe by Computer, _time |  eventstats
+  avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer
+  |  eval upperThreshold=(avgScExe + stdScExe *3) |  eval isOutlier=if(avgScExe >
+  5 and avgScExe >= upperThreshold, 1, 0) |  search isOutlier=1 | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
+known_false_positives: excessive execution of sc.exe is quite suspicious since it
+  can modify or execute app in high privilege permission.
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+tags:
+  analytic_story:
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1569.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - process_name
+  - process
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log

detections/endpoint/execute_javascript_with_jscript_com_clsid.yml

@@ -0,0 +1,48 @@
+name: Execute Javascript With Jscript COM CLSID
+id: dc64d064-d346-11eb-8588-acde48001122
+version: 1
+date: '2021-06-22'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious process of cscript.exe where it
+  tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique
+  was seen in ransomware (reddot ransomware) where it execute javascript with this
+  com object with combination of amsi disabling technique.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe"
+  Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name
+  Processes.process_name Processes.process Processes.parent_process Processes.process_id
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: unknown
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+tags:
+  analytic_story:
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log

detections/endpoint/icacls_grant_command.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Ransomware
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log

detections/endpoint/msmpeng_application_dll_side_loading.yml

@@ -0,0 +1,48 @@
+name: Msmpeng Application DLL Side Loading
+id: 8bb3f280-dd9b-11eb-84d5-acde48001122
+version: 1
+date: '2021-07-05'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll
+  in non default windows defender folder. This technique was seen couple days ago
+  with revil ransomware in Kaseya Supply chain. The approach is to drop an old version
+  of msmpeng.exe to load the actual payload name as mspvc.dll which will load the
+  revil ransomware to the compromise machine
+search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
+  file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND
+  Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time
+  Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: quite minimal false positive expected.
+references:
+- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1574.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log

detections/endpoint/powershell_disable_security_monitoring.yml

@@ -0,0 +1,50 @@
+name: Powershell Disable Security Monitoring
+id: c148a894-dd93-11eb-bf2a-acde48001122
+version: 1
+date: '2021-07-05'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identifies a modification in registry to disable the
+  windows denfender real time behavior monitoring. This event or technique is commonly
+  seen in RAT, bot, or Trojan to disable AV to evade detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe",
+  "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") Processes.process="*set-mppreference*"
+  AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives. However, tune based on scripts that
+  may perform this action.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log

detections/endpoint/powershell_enable_smb1protocol_feature.yml

@@ -0,0 +1,44 @@
+name: Powershell Enable SMB1Protocol Feature
+id: afed80b2-d34b-11eb-a952-acde48001122
+version: 1
+date: '2021-06-22'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious enabling of smb1protocol through
+  "powershell.exe". This technique was seen in some ransomware (like reddot) where
+  it enable smb share to do the lateral movement and encrypt other files within the
+  compromise network system.
+search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message
+  = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime
+  by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `powershell_enable_smb1protocol_feature_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: network operator may enable or disable this windows feature.
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1027.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log

detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml

@@ -0,0 +1,50 @@
+name: Recursive Delete of Directory In Batch CMD
+id: ba570b3a-d356-11eb-8358-acde48001122
+version: 1
+date: '2021-06-22'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious commandline designed to delete
+  files or directory recursive using batch command. This technique was seen in ransomware
+  (reddot) where it it tries to delete the files in recycle bin to impaire user from
+  recovering deleted files.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  Processes.process=*/c*  Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*"
+  by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process
+  Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network operator may use this batch command to delete recursively
+  a directory or files within directory
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+tags:
+  analytic_story:
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1070.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log

detections/endpoint/revil_registry_entry.yml

@@ -13,7 +13,7 @@ description: This analytic identifies suspicious modification in registry entry
   notes file name in the compromised host.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
-  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*")
   AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary
   Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`'

lookups/ransomware_extensions.csv

@@ -295,4 +295,5 @@ Extensions,Name
 .TELEGRAM,Telegram
 .FUSION,Fusion
 .MILIHPEN,Milihpen
-.GANGBANG,Gangbang
+.GANGBANG,Gangbang
+.reddot,RedDot

tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml

@@ -0,0 +1,12 @@
+name: Allow File And Printing Sharing In Firewall Unit Test
+tests:
+- name: Allow File And Printing Sharing In Firewall
+  file: endpoint/allow_file_and_printing_sharing_in_firewall.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/allow_network_discovery_in_firewall.test.yml

@@ -0,0 +1,12 @@
+name: Allow Network Discovery In Firewall Unit Test
+tests:
+- name: Allow Network Discovery In Firewall
+  file: endpoint/allow_network_discovery_in_firewall.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/disable_amsi_through_registry.test.yml

@@ -0,0 +1,12 @@
+name: Disable AMSI Through Registry Unit Test
+tests:
+- name: Disable AMSI Through Registry
+  file: endpoint/disable_amsi_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/disable_etw_through_registry.test.yml

@@ -0,0 +1,12 @@
+name: Disable ETW Through Registry Unit Test
+tests:
+- name: Disable ETW Through Registry
+  file: endpoint/disable_etw_through_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/excessive_usage_of_sc_service_utility.test.yml

@@ -0,0 +1,12 @@
+name: Excessive Usage Of SC Service Utility Unit Test
+tests:
+- name: Excessive Usage Of SC Service Utility
+  file: endpoint/excessive_usage_of_sc_service_utility.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 

tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml

@@ -0,0 +1,12 @@
+name: Execute Javascript With Jscript COM CLSID Unit Test
+tests:
+- name: Execute Javascript With Jscript COM CLSID
+  file: endpoint/execute_javascript_with_jscript_com_clsid.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/msmpeng_application_dll_side_loading.test.yml

@@ -0,0 +1,14 @@
+name: Msmpeng Application DLL Side Loading Unit Test
+tests:
+- name: Msmpeng Application DLL Side Loading
+  file: endpoint/msmpeng_application_dll_side_loading.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+    

tests/endpoint/powershell_disable_security_monitoring.test.yml

@@ -0,0 +1,12 @@
+name: Powershell Disable Security Monitoring Unit Test
+tests:
+- name: Powershell Disable Security Monitoring
+  file: endpoint/powershell_disable_security_monitoring.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/powershell_enable_smb1protocol_feature.test.yml

@@ -0,0 +1,15 @@
+name: Powershell Enable SMB1Protocol Feature Unit Test
+tests:
+- name: Powershell Enable SMB1Protocol Feature
+  file: endpoint/powershell_enable_smb1protocol_feature.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog
+
+
+    

tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml

@@ -0,0 +1,12 @@
+name: Recursive Delete of Directory In Batch CMD Unit Test
+tests:
+- name: Recursive Delete of Directory In Batch CMD
+  file: endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog