diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml new file mode 100644 index 0000000000..6931d18528 --- /dev/null +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -0,0 +1,52 @@ +name: Allow File And Printing Sharing In Firewall +id: ce27646e-d411-11eb-8a00-acde48001122 +version: 1 +date: '2021-06-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious modification of firewall to allow + file and printer sharing. This technique was seen in ransomware to be able to discover + more machine connected to the compromised host to encrypt more files +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe + Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `allow_file_and_printing_sharing_in_firewall_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network admin may modify this firewall feature that may cause + this rule to be triggered. +references: +- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml new file mode 100644 index 0000000000..50bfc8ebc3 --- /dev/null +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -0,0 +1,54 @@ +name: Allow Network Discovery In Firewall +id: ccd6a38c-d40b-11eb-85a5-acde48001122 +version: 1 +date: '2021-06-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious modification to the firewall to + allow network discovery on a machine. This technique was seen in couple of ransomware + (revil, reddot) to discover other machine connected to the compromised host to encrypt + more files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe + Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `allow_network_discovery_in_firewall_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network admin may modify this firewall feature that may cause + this rule to be triggered. +references: +- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 175dd441d6..09d220b10c 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -11,7 +11,7 @@ description: This following analytic detects PowerShell command to delete shadow to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml new file mode 100644 index 0000000000..c565d442b8 --- /dev/null +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -0,0 +1,49 @@ +name: Disable AMSI Through Registry +id: 9c27ec42-d338-11eb-9044-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify modification in registry to disable AMSI windows + feature to evade detections. This technique was seen in several ransomware, RAT + and even APT to impaire defenses of the compromise machine and to be able to execute + payload with minimal alert as much as possible. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network operator may disable this feature of windows but not + so common. +references: +- https://blog.f-secure.com/hunting-for-amsi-bypasses/ +- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml new file mode 100644 index 0000000000..12636217c6 --- /dev/null +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -0,0 +1,47 @@ +name: Disable ETW Through Registry +id: f0eacfa4-d33f-11eb-8f9d-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify modification in registry to disable ETW windows + feature to evade detections. This technique was seen in several ransomware, RAT + and even APT to impaire defenses of the compromise machine and to be able to execute + payload with minimal alert as much as possible. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" + Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network operator may disable this feature of windows but not + so common. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 92760eaeea..eb1bab4b20 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -10,11 +10,15 @@ description: This search is to identifies a modification in registry to disable windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows - Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= - "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" - OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time - Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" + as lastTime from datamodel=Endpoint.Registry where + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR + Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' @@ -28,6 +32,8 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Ransomware + - Revil Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 1fd413062a..6517547594 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND - Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name + Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' @@ -28,6 +28,7 @@ references: tags: analytic_story: - XMRig + - Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 13a695deea..5a42e4f653 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - XMRig + - Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 502cb9aa07..ad992c7157 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -46,10 +46,7 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Computer + - process_name + - EventCode security_domain: endpoint diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml new file mode 100644 index 0000000000..660fa798af --- /dev/null +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -0,0 +1,46 @@ +name: Excessive Usage Of SC Service Utility +id: cb6b339e-d4c6-11eb-a026-acde48001122 +version: 1 +date: '2021-06-24' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious excessive usage of sc.exe in a + host machine. This technique was seen in several ransomware , xmrig and other malware + to create, modify, delete or disable a service may related to security application + or to gain privilege escalation. +search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | + stats values(process) as process count as numScExe by Computer, _time | eventstats + avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer + | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe > + 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: excessive execution of sc.exe is quite suspicious since it + can modify or execute app in high privilege permission. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1569.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - process_name + - process + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml new file mode 100644 index 0000000000..b44f56efbd --- /dev/null +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -0,0 +1,48 @@ +name: Execute Javascript With Jscript COM CLSID +id: dc64d064-d346-11eb-8588-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will identify suspicious process of cscript.exe where it + tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique + was seen in ransomware (reddot ransomware) where it execute javascript with this + com object with combination of amsi disabling technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" + Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name + Processes.process_name Processes.process Processes.parent_process Processes.process_id + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.parent_process + - Processes.process_id + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index f0065dbbe8..9b63e9eeb1 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - XMRig + - Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml new file mode 100644 index 0000000000..310ba559c5 --- /dev/null +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -0,0 +1,48 @@ +name: Msmpeng Application DLL Side Loading +id: 8bb3f280-dd9b-11eb-84d5-acde48001122 +version: 1 +date: '2021-07-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll + in non default windows defender folder. This technique was seen couple days ago + with revil ransomware in Kaseya Supply chain. The approach is to drop an old version + of msmpeng.exe to load the actual payload name as mspvc.dll which will load the + revil ransomware to the compromise machine +search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND + Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time + Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: quite minimal false positive expected. +references: +- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1574.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml new file mode 100644 index 0000000000..3f39baed5c --- /dev/null +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -0,0 +1,50 @@ +name: Powershell Disable Security Monitoring +id: c148a894-dd93-11eb-bf2a-acde48001122 +version: 1 +date: '2021-07-05' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies a modification in registry to disable the + windows denfender real time behavior monitoring. This event or technique is commonly + seen in RAT, bot, or Trojan to disable AV to evade detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe", + "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") Processes.process="*set-mppreference*" + AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives. However, tune based on scripts that + may perform this action. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell +tags: + analytic_story: + - Ransomware + - Revil Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml new file mode 100644 index 0000000000..6fa038868e --- /dev/null +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -0,0 +1,44 @@ +name: Powershell Enable SMB1Protocol Feature +id: afed80b2-d34b-11eb-a952-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious enabling of smb1protocol through + "powershell.exe". This technique was seen in some ransomware (like reddot) where + it enable smb share to do the lateral movement and encrypt other files within the + compromise network system. +search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message + = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_enable_smb1protocol_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: network operator may enable or disable this windows feature. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Malicious PowerShell + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml new file mode 100644 index 0000000000..c2f72a3484 --- /dev/null +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -0,0 +1,50 @@ +name: Recursive Delete of Directory In Batch CMD +id: ba570b3a-d356-11eb-8358-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious commandline designed to delete + files or directory recursive using batch command. This technique was seen in ransomware + (reddot) where it it tries to delete the files in recycle bin to impaire user from + recovering deleted files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe + Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" + by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process + Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator may use this batch command to delete recursively + a directory or files within directory +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1070.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.parent_process + - Processes.process_id + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index f0add73d4c..7690d913aa 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -13,7 +13,7 @@ description: This analytic identifies suspicious modification in registry entry notes file name in the compromised host. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index c50ec5dc9b..b2fdb16631 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -295,4 +295,5 @@ Extensions,Name .TELEGRAM,Telegram .FUSION,Fusion .MILIHPEN,Milihpen -.GANGBANG,Gangbang \ No newline at end of file +.GANGBANG,Gangbang +.reddot,RedDot \ No newline at end of file diff --git a/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml b/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml new file mode 100644 index 0000000000..33c74ef7e7 --- /dev/null +++ b/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml @@ -0,0 +1,12 @@ +name: Allow File And Printing Sharing In Firewall Unit Test +tests: +- name: Allow File And Printing Sharing In Firewall + file: endpoint/allow_file_and_printing_sharing_in_firewall.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/allow_network_discovery_in_firewall.test.yml b/tests/endpoint/allow_network_discovery_in_firewall.test.yml new file mode 100644 index 0000000000..6eab28d308 --- /dev/null +++ b/tests/endpoint/allow_network_discovery_in_firewall.test.yml @@ -0,0 +1,12 @@ +name: Allow Network Discovery In Firewall Unit Test +tests: +- name: Allow Network Discovery In Firewall + file: endpoint/allow_network_discovery_in_firewall.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_amsi_through_registry.test.yml b/tests/endpoint/disable_amsi_through_registry.test.yml new file mode 100644 index 0000000000..d76a167e24 --- /dev/null +++ b/tests/endpoint/disable_amsi_through_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable AMSI Through Registry Unit Test +tests: +- name: Disable AMSI Through Registry + file: endpoint/disable_amsi_through_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_etw_through_registry.test.yml b/tests/endpoint/disable_etw_through_registry.test.yml new file mode 100644 index 0000000000..bd586dade6 --- /dev/null +++ b/tests/endpoint/disable_etw_through_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable ETW Through Registry Unit Test +tests: +- name: Disable ETW Through Registry + file: endpoint/disable_etw_through_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_sc_service_utility.test.yml b/tests/endpoint/excessive_usage_of_sc_service_utility.test.yml new file mode 100644 index 0000000000..7add349bc8 --- /dev/null +++ b/tests/endpoint/excessive_usage_of_sc_service_utility.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of SC Service Utility Unit Test +tests: +- name: Excessive Usage Of SC Service Utility + file: endpoint/excessive_usage_of_sc_service_utility.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml b/tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml new file mode 100644 index 0000000000..6fe7cadb62 --- /dev/null +++ b/tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml @@ -0,0 +1,12 @@ +name: Execute Javascript With Jscript COM CLSID Unit Test +tests: +- name: Execute Javascript With Jscript COM CLSID + file: endpoint/execute_javascript_with_jscript_com_clsid.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/msmpeng_application_dll_side_loading.test.yml b/tests/endpoint/msmpeng_application_dll_side_loading.test.yml new file mode 100644 index 0000000000..f9e6e44a8d --- /dev/null +++ b/tests/endpoint/msmpeng_application_dll_side_loading.test.yml @@ -0,0 +1,14 @@ +name: Msmpeng Application DLL Side Loading Unit Test +tests: +- name: Msmpeng Application DLL Side Loading + file: endpoint/msmpeng_application_dll_side_loading.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + \ No newline at end of file diff --git a/tests/endpoint/powershell_disable_security_monitoring.test.yml b/tests/endpoint/powershell_disable_security_monitoring.test.yml new file mode 100644 index 0000000000..4e58c6d178 --- /dev/null +++ b/tests/endpoint/powershell_disable_security_monitoring.test.yml @@ -0,0 +1,12 @@ +name: Powershell Disable Security Monitoring Unit Test +tests: +- name: Powershell Disable Security Monitoring + file: endpoint/powershell_disable_security_monitoring.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml new file mode 100644 index 0000000000..1aadf2a95b --- /dev/null +++ b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml @@ -0,0 +1,15 @@ +name: Powershell Enable SMB1Protocol Feature Unit Test +tests: +- name: Powershell Enable SMB1Protocol Feature + file: endpoint/powershell_enable_smb1protocol_feature.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog + + + \ No newline at end of file diff --git a/tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml b/tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml new file mode 100644 index 0000000000..6d17d638da --- /dev/null +++ b/tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml @@ -0,0 +1,12 @@ +name: Recursive Delete of Directory In Batch CMD Unit Test +tests: +- name: Recursive Delete of Directory In Batch CMD + file: endpoint/recursive_delete_of_directory_in_batch_cmd.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file