From 2cf1d164d50a6f690294fb9a2a48f393586d312d Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Jun 2021 12:38:49 +0200 Subject: [PATCH 01/32] ransom_ttp_p2 --- ..._file_and_printing_sharing_in_firewall.yml | 47 ++++++++++++++++++ .../allow_network_discovery_in_firewall.yml | 49 +++++++++++++++++++ .../delete_shadowcopy_with_powershell.yml | 2 +- .../disable_amsi_through_registry.yml | 44 +++++++++++++++++ .../endpoint/disable_etw_through_registry.yml | 45 +++++++++++++++++ ...cute_javascript_with_jscript_com_clsid.yml | 44 +++++++++++++++++ ...powershell_enable_smb1protocol_feature.yml | 41 ++++++++++++++++ ...rsive_delete_of_directory_in_batch_cmd.yml | 45 +++++++++++++++++ ..._and_printing_sharing_in_firewall.test.yml | 12 +++++ ...low_network_discovery_in_firewall.test.yml | 12 +++++ .../disable_amsi_through_registry.test.yml | 12 +++++ .../disable_etw_through_registry.test.yml | 12 +++++ ...javascript_with_jscript_com_clsid.test.yml | 12 +++++ ...shell_enable_smb1protocol_feature.test.yml | 15 ++++++ ..._delete_of_directory_in_batch_cmd.test.yml | 12 +++++ 15 files changed, 403 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml create mode 100644 detections/endpoint/allow_network_discovery_in_firewall.yml create mode 100644 detections/endpoint/disable_amsi_through_registry.yml create mode 100644 detections/endpoint/disable_etw_through_registry.yml create mode 100644 detections/endpoint/execute_javascript_with_jscript_com_clsid.yml create mode 100644 detections/endpoint/powershell_enable_smb1protocol_feature.yml create mode 100644 detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml create mode 100644 tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml create mode 100644 tests/endpoint/allow_network_discovery_in_firewall.test.yml create mode 100644 tests/endpoint/disable_amsi_through_registry.test.yml create mode 100644 tests/endpoint/disable_etw_through_registry.test.yml create mode 100644 tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml create mode 100644 tests/endpoint/powershell_enable_smb1protocol_feature.test.yml create mode 100644 tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml new file mode 100644 index 0000000000..765ef5e42c --- /dev/null +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -0,0 +1,47 @@ +name: Allow File And Printing Sharing In Firewall +id: ed5e34f8-d40b-11eb-acd2-acde48001122 +version: 1 +date: '2021-06-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: UPDATE_DESCRIPTION +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `allow_file_andprinting_sharing_in_firewall_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered. +references: +- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + - Revil + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml new file mode 100644 index 0000000000..8028122834 --- /dev/null +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -0,0 +1,49 @@ +name: Allow Network Discovery In Firewall +id: ccd6a38c-d40b-11eb-85a5-acde48001122 +version: 1 +date: '2021-06-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. + This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host + to encrypt more files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable=Yes*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `allow_network_discovery_in_firewall_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered. +references: +- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + - Revil + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 175dd441d6..09d220b10c 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -11,7 +11,7 @@ description: This following analytic detects PowerShell command to delete shadow to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml new file mode 100644 index 0000000000..194fada226 --- /dev/null +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -0,0 +1,44 @@ +name: Disable AMSI Through Registry +id: 9c27ec42-d338-11eb-9044-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify modification in registry to disable AMSI windows feature to evade detections. + This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to + be able to execute payload with minimal alert as much as possible. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" + Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `disable_amsi_through_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network operator may disable this feature of windows but not so common. +references: +- https://blog.f-secure.com/hunting-for-amsi-bypasses/ +- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml new file mode 100644 index 0000000000..b825f9e24d --- /dev/null +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -0,0 +1,45 @@ +name: Disable ETW Through Registry +id: f0eacfa4-d33f-11eb-8f9d-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify modification in registry to disable ETW windows feature to evade detections. + This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to + be able to execute payload with minimal alert as much as possible. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" + Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `disable_etw_through_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network operator may disable this feature of windows but not so common. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml new file mode 100644 index 0000000000..8f8cec627c --- /dev/null +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -0,0 +1,44 @@ +name: Execute Javascript With Jscript COM CLSID +id: dc64d064-d346-11eb-8588-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). + This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" + by Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `execute_javascript_with_jscript_com_clsid_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.parent_process + - Processes.process_id + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml new file mode 100644 index 0000000000..c9c9abcc1e --- /dev/null +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -0,0 +1,41 @@ +name: Powershell Enable SMB1Protocol Feature +id: afed80b2-d34b-11eb-a952-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". + This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and + encrypt other files within the compromise network system. +search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message = "*SMB1Protocol*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_enable_smb1protocol_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: network operator may enable or disable this windows feature. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Malicious PowerShell + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml new file mode 100644 index 0000000000..017dbc22b0 --- /dev/null +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -0,0 +1,45 @@ +name: Recursive Delete of Directory In Batch CMD +id: ba570b3a-d356-11eb-8358-acde48001122 +version: 1 +date: '2021-06-22' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. + This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" + by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest + |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `recursive_delete_of_directory_in_batch_cmd_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator may use this batch command to delete recursively a directory or files within directory +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1070.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.parent_process + - Processes.process_id + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml b/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml new file mode 100644 index 0000000000..7f7b85fa36 --- /dev/null +++ b/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml @@ -0,0 +1,12 @@ +name: Allow File And Printing Sharing In Firewall Unit Test +tests: +- name: Allow File And Printing Sharing In Firewall + file: endpoint/allow_file_and_printing_sharing_in_firewall.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/allow_network_discovery_in_firewall.test.yml b/tests/endpoint/allow_network_discovery_in_firewall.test.yml new file mode 100644 index 0000000000..6eab28d308 --- /dev/null +++ b/tests/endpoint/allow_network_discovery_in_firewall.test.yml @@ -0,0 +1,12 @@ +name: Allow Network Discovery In Firewall Unit Test +tests: +- name: Allow Network Discovery In Firewall + file: endpoint/allow_network_discovery_in_firewall.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_amsi_through_registry.test.yml b/tests/endpoint/disable_amsi_through_registry.test.yml new file mode 100644 index 0000000000..d76a167e24 --- /dev/null +++ b/tests/endpoint/disable_amsi_through_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable AMSI Through Registry Unit Test +tests: +- name: Disable AMSI Through Registry + file: endpoint/disable_amsi_through_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_etw_through_registry.test.yml b/tests/endpoint/disable_etw_through_registry.test.yml new file mode 100644 index 0000000000..bd586dade6 --- /dev/null +++ b/tests/endpoint/disable_etw_through_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable ETW Through Registry Unit Test +tests: +- name: Disable ETW Through Registry + file: endpoint/disable_etw_through_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml b/tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml new file mode 100644 index 0000000000..6fe7cadb62 --- /dev/null +++ b/tests/endpoint/execute_javascript_with_jscript_com_clsid.test.yml @@ -0,0 +1,12 @@ +name: Execute Javascript With Jscript COM CLSID Unit Test +tests: +- name: Execute Javascript With Jscript COM CLSID + file: endpoint/execute_javascript_with_jscript_com_clsid.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml new file mode 100644 index 0000000000..1aadf2a95b --- /dev/null +++ b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml @@ -0,0 +1,15 @@ +name: Powershell Enable SMB1Protocol Feature Unit Test +tests: +- name: Powershell Enable SMB1Protocol Feature + file: endpoint/powershell_enable_smb1protocol_feature.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog + + + \ No newline at end of file diff --git a/tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml b/tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml new file mode 100644 index 0000000000..6d17d638da --- /dev/null +++ b/tests/endpoint/recursive_delete_of_directory_in_batch_cmd.test.yml @@ -0,0 +1,12 @@ +name: Recursive Delete of Directory In Batch CMD Unit Test +tests: +- name: Recursive Delete of Directory In Batch CMD + file: endpoint/recursive_delete_of_directory_in_batch_cmd.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From fd156a28bb3cd173a0d38d27a08f4aa21a7b59df Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Jun 2021 12:44:19 +0200 Subject: [PATCH 02/32] r+ttp2 --- .../endpoint/allow_file_and_printing_sharing_in_firewall.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 765ef5e42c..57ee467a08 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -6,7 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: UPDATE_DESCRIPTION +description: This search is to detect a suspicious modification of firewall to allow file and printer sharing. + This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name From d45f494438c7c39caed86928d7c3019112dc78b5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Jun 2021 12:58:56 +0200 Subject: [PATCH 03/32] rttp3 --- .../endpoint/allow_file_and_printing_sharing_in_firewall.yml | 4 ++-- .../allow_file_and_printing_sharing_in_firewall.test.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 57ee467a08..2b4d87e85d 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -1,5 +1,5 @@ name: Allow File And Printing Sharing In Firewall -id: ed5e34f8-d40b-11eb-acd2-acde48001122 +id: ce27646e-d411-11eb-8a00-acde48001122 version: 1 date: '2021-06-23' author: Teoderick Contreras, Splunk @@ -45,4 +45,4 @@ tags: - Processes.process_id - Processes.parent_process_id - Processes.parent_process_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml b/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml index 7f7b85fa36..33c74ef7e7 100644 --- a/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml +++ b/tests/endpoint/allow_file_and_printing_sharing_in_firewall.test.yml @@ -9,4 +9,4 @@ tests: - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog From 0091660097317180d71706fdcdbdeb61933d5773 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Jun 2021 13:03:31 +0200 Subject: [PATCH 04/32] rttp3 --- .../endpoint/allow_file_and_printing_sharing_in_firewall.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 2b4d87e85d..5b17d534e3 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `allow_file_andprinting_sharing_in_firewall_filter`' + | `allow_file_and_printing_sharing_in_firewall_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure From fc131342761c5e4c11725faee09a0d3fe8c2eb03 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 24 Jun 2021 10:43:36 +0200 Subject: [PATCH 05/32] rttp4 --- .../excessive_service_stop_attempt.yml | 3 +- .../endpoint/excessive_usage_of_net_app.yml | 1 + .../excessive_usage_of_nslookup_app.yml | 9 ++-- ...excessive_usage_of_sc_service_utility_.yml | 44 +++++++++++++++++++ detections/endpoint/icacls_grant_command.yml | 1 + ...sive_usage_of_sc_service_utility_.test.yml | 12 +++++ 6 files changed, 63 insertions(+), 7 deletions(-) create mode 100644 detections/endpoint/excessive_usage_of_sc_service_utility_.yml create mode 100644 tests/endpoint/excessive_usage_of_sc_service_utility_.test.yml diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 1fd413062a..6517547594 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND - Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name + Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' @@ -28,6 +28,7 @@ references: tags: analytic_story: - XMRig + - Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 13a695deea..5a42e4f653 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - XMRig + - Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 502cb9aa07..ad992c7157 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -46,10 +46,7 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Computer + - process_name + - EventCode security_domain: endpoint diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility_.yml b/detections/endpoint/excessive_usage_of_sc_service_utility_.yml new file mode 100644 index 0000000000..b66225d14b --- /dev/null +++ b/detections/endpoint/excessive_usage_of_sc_service_utility_.yml @@ -0,0 +1,44 @@ +name: Excessive Usage Of SC Service Utility +id: cb6b339e-d4c6-11eb-a026-acde48001122 +version: 1 +date: '2021-06-24' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious excessive usage of sc.exe in a host machine. + This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service + may related to security application or to gain privilege escalation. +search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | stats values(process) as process count as numScExe by Computer, _time + | eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer + | eval upperThreshold=(avgScExe + stdScExe *3) + | eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) + | search isOutlier=1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_usage_of_sc_service_utility__filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: excessive execution of sc.exe is quite suspicious since it can modify or execute app in high + privilege permission. +references: +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1569.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - process_name + - process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index f0065dbbe8..9b63e9eeb1 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - XMRig + - Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/tests/endpoint/excessive_usage_of_sc_service_utility_.test.yml b/tests/endpoint/excessive_usage_of_sc_service_utility_.test.yml new file mode 100644 index 0000000000..664885dbff --- /dev/null +++ b/tests/endpoint/excessive_usage_of_sc_service_utility_.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of SC Service Utility Unit Test +tests: +- name: Excessive Usage Of SC Service Utility + file: endpoint/excessive_usage_of_sc_service_utility_.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 1af19c52c718a369e8da2ed1d353a8e859fec939 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 24 Jun 2021 10:51:56 +0200 Subject: [PATCH 06/32] rttp5 --- ...ility_.yml => excessive_usage_of_sc_service_utility.yml} | 2 +- ...t.yml => excessive_usage_of_sc_service_utility.test.yml} | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{excessive_usage_of_sc_service_utility_.yml => excessive_usage_of_sc_service_utility.yml} (97%) rename tests/endpoint/{excessive_usage_of_sc_service_utility_.test.yml => excessive_usage_of_sc_service_utility.test.yml} (70%) diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility_.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml similarity index 97% rename from detections/endpoint/excessive_usage_of_sc_service_utility_.yml rename to detections/endpoint/excessive_usage_of_sc_service_utility.yml index b66225d14b..579d87ff9f 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility_.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -1,4 +1,4 @@ -name: Excessive Usage Of SC Service Utility +name: Excessive Usage Of SC Service Utility id: cb6b339e-d4c6-11eb-a026-acde48001122 version: 1 date: '2021-06-24' diff --git a/tests/endpoint/excessive_usage_of_sc_service_utility_.test.yml b/tests/endpoint/excessive_usage_of_sc_service_utility.test.yml similarity index 70% rename from tests/endpoint/excessive_usage_of_sc_service_utility_.test.yml rename to tests/endpoint/excessive_usage_of_sc_service_utility.test.yml index 664885dbff..7add349bc8 100644 --- a/tests/endpoint/excessive_usage_of_sc_service_utility_.test.yml +++ b/tests/endpoint/excessive_usage_of_sc_service_utility.test.yml @@ -1,7 +1,7 @@ -name: Excessive Usage Of SC Service Utility Unit Test +name: Excessive Usage Of SC Service Utility Unit Test tests: -- name: Excessive Usage Of SC Service Utility - file: endpoint/excessive_usage_of_sc_service_utility_.yml +- name: Excessive Usage Of SC Service Utility + file: endpoint/excessive_usage_of_sc_service_utility.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 66452f52c8081e474f926983a6c117465a6930f0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 24 Jun 2021 10:54:02 +0200 Subject: [PATCH 07/32] rtp5 --- detections/endpoint/excessive_usage_of_sc_service_utility.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 579d87ff9f..59f171f9e6 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -16,7 +16,7 @@ search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `excessive_usage_of_sc_service_utility__filter`' + | `excessive_usage_of_sc_service_utility_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From aecddd31b1eba211591a80ea269b68b164b40d40 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 09:27:04 +0000 Subject: [PATCH 08/32] Added detection testing service results inAllow File And Printing Sharing In Firewall --- ..._file_and_printing_sharing_in_firewall.yml | 37 +++++++++++-------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 5b17d534e3..554c0b6c26 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious modification of firewall to allow file and printer sharing. - This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious modification of firewall to allow + file and printer sharing. This technique was seen in ransomware to be able to discover + more machine connected to the compromised host to encrypt more files +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe + Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered. +known_false_positives: network admin may modify this firewall feature that may cause + this rule to be triggered. references: - https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ @@ -37,12 +39,15 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log From 2e0c274c4c3d018832e62223a43a8784d20f9a28 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 09:47:59 +0000 Subject: [PATCH 09/32] Added detection testing service results inAllow Network Discovery In Firewall --- .../allow_network_discovery_in_firewall.yml | 41 +++++++++++-------- 1 file changed, 23 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 8028122834..00e021769c 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -6,21 +6,23 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. - This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host - to encrypt more files. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable=Yes*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious modification to the firewall to + allow network discovery on a machine. This technique was seen in couple of ransomware + (revil, reddot) to discover other machine connected to the compromised host to encrypt + more files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe + Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable=Yes*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered. +known_false_positives: network admin may modify this firewall feature that may cause + this rule to be triggered. references: - https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469 - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ @@ -38,12 +40,15 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.parent_process_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log From 4539c6a06d1c439d4739c0974c7bdf78dbad3df5 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 09:58:24 +0000 Subject: [PATCH 10/32] Added detection testing service results inDisable AMSI Through Registry --- .../disable_amsi_through_registry.yml | 25 +++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 194fada226..c565d442b8 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to identify modification in registry to disable AMSI windows feature to evade detections. - This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to - be able to execute payload with minimal alert as much as possible. +description: this search is to identify modification in registry to disable AMSI windows + feature to evade detections. This technique was seen in several ransomware, RAT + and even APT to impaire defenses of the compromise machine and to be able to execute + payload with minimal alert as much as possible. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" - Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `disable_amsi_through_registry_filter`' + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network operator may disable this feature of windows but not so common. +known_false_positives: network operator may disable this feature of windows but not + so common. references: - https://blog.f-secure.com/hunting-for-amsi-bypasses/ - https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 @@ -41,4 +43,7 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log From 9cef2041f70b4037ec8fd33754bd5c4b7b633bfb Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 10:04:02 +0000 Subject: [PATCH 11/32] Added detection testing service results inDisable ETW Through Registry --- .../endpoint/disable_etw_through_registry.yml | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index b825f9e24d..12636217c6 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -6,22 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to identify modification in registry to disable ETW windows feature to evade detections. - This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to - be able to execute payload with minimal alert as much as possible. +description: this search is to identify modification in registry to disable ETW windows + feature to evade detections. This technique was seen in several ransomware, RAT + and even APT to impaire defenses of the compromise machine and to be able to execute + payload with minimal alert as much as possible. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `disable_etw_through_registry_filter`' + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network operator may disable this feature of windows but not so common. +known_false_positives: network operator may disable this feature of windows but not + so common. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: @@ -42,4 +41,7 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log From 177ed8339f46415d699abaceb5d21cfd53a98f96 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 10:19:05 +0000 Subject: [PATCH 12/32] Added detection testing service results inExecute Javascript With Jscript COM CLSID --- ...cute_javascript_with_jscript_com_clsid.yml | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 8f8cec627c..b44f56efbd 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -6,15 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). - This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" - by Processes.parent_process_name Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `execute_javascript_with_jscript_com_clsid_filter`' +description: This analytic will identify suspicious process of cscript.exe where it + tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique + was seen in ransomware (reddot ransomware) where it execute javascript with this + com object with combination of amsi disabling technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" + Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name + Processes.process_name Processes.process Processes.parent_process Processes.process_id + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -41,4 +42,7 @@ tags: - Processes.process_id - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log From d894ebbafa869f0bf720b10faa33572a811e5e8a Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 10:23:34 +0000 Subject: [PATCH 13/32] Added detection testing service results inPowershell Enable SMB1Protocol Feature --- ...powershell_enable_smb1protocol_feature.yml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index c9c9abcc1e..6fa038868e 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -6,13 +6,13 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". - This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and - encrypt other files within the compromise network system. -search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message = "*SMB1Protocol*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious enabling of smb1protocol through + "powershell.exe". This technique was seen in some ransomware (like reddot) where + it enable smb share to do the lateral movement and encrypt other files within the + compromise network system. +search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message + = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed @@ -38,4 +38,7 @@ tags: - Message - ComputerName - User - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log From 3372c1f2aa75a4c47e610bcda49eb41b7b0523ad Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 10:46:33 +0000 Subject: [PATCH 14/32] Added detection testing service results inRecursive Delete of Directory In Batch CMD --- ...rsive_delete_of_directory_in_batch_cmd.yml | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 017dbc22b0..c2f72a3484 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. - This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" - by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest - |`drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `recursive_delete_of_directory_in_batch_cmd_filter`' +description: This search is to detect a suspicious commandline designed to delete + files or directory recursive using batch command. This technique was seen in ransomware + (reddot) where it it tries to delete the files in recycle bin to impaire user from + recovering deleted files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe + Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" + by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process + Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: network operator may use this batch command to delete recursively a directory or files within directory +known_false_positives: network operator may use this batch command to delete recursively + a directory or files within directory references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: @@ -42,4 +44,7 @@ tags: - Processes.process_id - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log From 0e06923a615e8455071fa54baf0472a95efcd4b3 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 24 Jun 2021 10:54:36 +0000 Subject: [PATCH 15/32] Added detection testing service results inExcessive Usage Of SC Service Utility --- .../excessive_usage_of_sc_service_utility.yml | 30 ++++++++++--------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 59f171f9e6..660fa798af 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -6,23 +6,22 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious excessive usage of sc.exe in a host machine. - This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service - may related to security application or to gain privilege escalation. -search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | stats values(process) as process count as numScExe by Computer, _time - | eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer - | eval upperThreshold=(avgScExe + stdScExe *3) - | eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) - | search isOutlier=1 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_usage_of_sc_service_utility_filter`' +description: This search is to detect a suspicious excessive usage of sc.exe in a + host machine. This technique was seen in several ransomware , xmrig and other malware + to create, modify, delete or disable a service may related to security application + or to gain privilege escalation. +search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | + stats values(process) as process count as numScExe by Computer, _time | eventstats + avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer + | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe > + 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -known_false_positives: excessive execution of sc.exe is quite suspicious since it can modify or execute app in high - privilege permission. +known_false_positives: excessive execution of sc.exe is quite suspicious since it + can modify or execute app in high privilege permission. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: @@ -41,4 +40,7 @@ tags: - EventCode - process_name - process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log From 69b11d347138062b97a828dc2202d2b7e1effa1b Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 25 Jun 2021 10:21:04 +0200 Subject: [PATCH 16/32] rttp4 --- lookups/ransomware_extensions.csv | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index c50ec5dc9b..b2fdb16631 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -295,4 +295,5 @@ Extensions,Name .TELEGRAM,Telegram .FUSION,Fusion .MILIHPEN,Milihpen -.GANGBANG,Gangbang \ No newline at end of file +.GANGBANG,Gangbang +.reddot,RedDot \ No newline at end of file From bf0571d73803a80066002be948574b851a2e464d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Jul 2021 09:21:11 +0200 Subject: [PATCH 17/32] Update allow_network_discovery_in_firewall.yml --- detections/endpoint/allow_network_discovery_in_firewall.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 00e021769c..18e94ee9e2 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -12,7 +12,7 @@ description: This search is to detect a suspicious modification to the firewall more files. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe - Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable=Yes*" + Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 19ac15a4857bff5f4ba911b1870ea8a92e22e702 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 5 Jul 2021 14:44:35 +0200 Subject: [PATCH 18/32] add ttp --- .../endpoint/disable_windows_behavior_monitoring.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 92760eaeea..433726b8ca 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -10,11 +10,12 @@ description: This search is to identifies a modification in registry to disable windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows - Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= - "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" - OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time - Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" + as lastTime from datamodel=Endpoint.Registry where + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR + Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR + Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' From 0da7fdd61f2f3745fe1c98c95bfc8a198616171e Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 5 Jul 2021 14:46:16 +0200 Subject: [PATCH 19/32] add ttp3 --- detections/endpoint/disable_windows_behavior_monitoring.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 433726b8ca..0a5f7e52f2 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -29,6 +29,8 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Ransomware + - Revil automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log From c4befb2012249dc76820728473ed281d77cbe1cb Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 5 Jul 2021 15:01:10 +0200 Subject: [PATCH 20/32] mod disable defender --- detections/endpoint/disable_windows_behavior_monitoring.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 0a5f7e52f2..a875b904e6 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -14,7 +14,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR - Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" + Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR + Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` From c8284a3bb86cd09ad3cf16acfc8a8629b340998f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 5 Jul 2021 15:49:41 +0200 Subject: [PATCH 21/32] pwh disable --- ...powershell_disable_security_monitoring.yml | 50 +++++++++++++++++++ ...shell_disable_security_monitoring.test.yml | 12 +++++ 2 files changed, 62 insertions(+) create mode 100644 detections/endpoint/powershell_disable_security_monitoring.yml create mode 100644 tests/endpoint/powershell_disable_security_monitoring.test.yml diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml new file mode 100644 index 0000000000..a144056107 --- /dev/null +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -0,0 +1,50 @@ +name: Powershell Disable Security Monitoring +id: c148a894-dd93-11eb-bf2a-acde48001122 +version: 1 +date: '2021-07-05' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies a modification in registry to disable the + windows denfender real time behavior monitoring. This event or technique is commonly + seen in RAT, bot, or Trojan to disable AV to evade detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe", "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") + Processes.process="*set-mppreference*" AND + Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_disable_security_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives. However, tune based on scripts that may perform this action. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell +tags: + analytic_story: + - Ransomware + - Revil + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + + \ No newline at end of file diff --git a/tests/endpoint/powershell_disable_security_monitoring.test.yml b/tests/endpoint/powershell_disable_security_monitoring.test.yml new file mode 100644 index 0000000000..4e58c6d178 --- /dev/null +++ b/tests/endpoint/powershell_disable_security_monitoring.test.yml @@ -0,0 +1,12 @@ +name: Powershell Disable Security Monitoring Unit Test +tests: +- name: Powershell Disable Security Monitoring + file: endpoint/powershell_disable_security_monitoring.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 46e6caac0a585121642cc0bc6b6397660aea94c6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 5 Jul 2021 15:56:48 +0200 Subject: [PATCH 22/32] update revil reg --- detections/endpoint/revil_registry_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index f0add73d4c..7690d913aa 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -13,7 +13,7 @@ description: This analytic identifies suspicious modification in registry entry notes file name in the compromised host. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' From a0f05b57f1fa60b4103e0cc4cb18f38ddb3e4d0b Mon Sep 17 00:00:00 2001 From: root Date: Mon, 5 Jul 2021 14:13:03 +0000 Subject: [PATCH 23/32] Added detection testing service results inPowershell Enable SMB1Protocol Feature From 86f18d1e33230c6764fb0209261e4e9d76f62006 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 5 Jul 2021 16:27:36 +0200 Subject: [PATCH 24/32] side loading --- .../msmpeng_application_dll_side_loading.yml | 45 +++++++++++++++++++ ...peng_application_dll_side_loading.test.yml | 14 ++++++ 2 files changed, 59 insertions(+) create mode 100644 detections/endpoint/msmpeng_application_dll_side_loading.yml create mode 100644 tests/endpoint/msmpeng_application_dll_side_loading.test.yml diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml new file mode 100644 index 0000000000..072849d013 --- /dev/null +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -0,0 +1,45 @@ +name: Msmpeng Application DLL Side Loading +id: 8bb3f280-dd9b-11eb-84d5-acde48001122 +version: 1 +date: '2021-07-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. + This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the + actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine +search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `msmpeng_application_dll_side_loading_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: quite minimal false positive expected. +references: +- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers +tags: + analytic_story: + - Ransomware + - Revil + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1574.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + security_domain: endpoint diff --git a/tests/endpoint/msmpeng_application_dll_side_loading.test.yml b/tests/endpoint/msmpeng_application_dll_side_loading.test.yml new file mode 100644 index 0000000000..f9e6e44a8d --- /dev/null +++ b/tests/endpoint/msmpeng_application_dll_side_loading.test.yml @@ -0,0 +1,14 @@ +name: Msmpeng Application DLL Side Loading Unit Test +tests: +- name: Msmpeng Application DLL Side Loading + file: endpoint/msmpeng_application_dll_side_loading.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + \ No newline at end of file From f8e36f1f132f350c0a9ff92ce45ce7507c1907b8 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 5 Jul 2021 14:34:26 +0000 Subject: [PATCH 25/32] Added detection testing service results inPowershell Disable Security Monitoring --- ...powershell_disable_security_monitoring.yml | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index a144056107..79da1e604b 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -10,18 +10,17 @@ description: This search is to identifies a modification in registry to disable windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe", "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") - Processes.process="*set-mppreference*" AND - Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_disable_security_monitoring_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe", + "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") Processes.process="*set-mppreference*" + AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives. However, tune based on scripts that may perform this action. +known_false_positives: Limited false positives. However, tune based on scripts that + may perform this action. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell tags: @@ -46,5 +45,6 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - - \ No newline at end of file + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log From 8757c002fc5996113df990b920fb0a7df1ea217a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Jul 2021 16:45:13 +0200 Subject: [PATCH 26/32] Update allow_file_and_printing_sharing_in_firewall.yml --- .../endpoint/allow_file_and_printing_sharing_in_firewall.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 554c0b6c26..17401a0ab0 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -28,7 +28,7 @@ references: tags: analytic_story: - Ransomware - - Revil + - Revil Ransomware kill_chain_phases: - Exploitation mitre_attack_id: From f3097ae838f60d9112ff95fe27253658416f239c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Jul 2021 16:45:31 +0200 Subject: [PATCH 27/32] Update allow_file_and_printing_sharing_in_firewall.yml --- .../endpoint/allow_file_and_printing_sharing_in_firewall.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 17401a0ab0..6931d18528 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -28,7 +28,6 @@ references: tags: analytic_story: - Ransomware - - Revil Ransomware kill_chain_phases: - Exploitation mitre_attack_id: From e88845c1c5bec05300e759ef9cb95a67448d4168 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Jul 2021 16:45:45 +0200 Subject: [PATCH 28/32] Update allow_network_discovery_in_firewall.yml --- detections/endpoint/allow_network_discovery_in_firewall.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 18e94ee9e2..50bfc8ebc3 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -29,7 +29,7 @@ references: tags: analytic_story: - Ransomware - - Revil + - Revil Ransomware kill_chain_phases: - Exploitation mitre_attack_id: From bcda9adb5609cd9d25190c9134543012ccff6848 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Jul 2021 16:46:12 +0200 Subject: [PATCH 29/32] Update disable_windows_behavior_monitoring.yml --- detections/endpoint/disable_windows_behavior_monitoring.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index a875b904e6..eb1bab4b20 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -33,7 +33,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Ransomware - - Revil + - Revil Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log From 3e63f7325a245f4352f58cdd8b411a2ce5fe70f8 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Jul 2021 16:46:45 +0200 Subject: [PATCH 30/32] Update msmpeng_application_dll_side_loading.yml --- detections/endpoint/msmpeng_application_dll_side_loading.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 072849d013..f27adaf028 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -26,7 +26,7 @@ references: tags: analytic_story: - Ransomware - - Revil + - Revil Ransomware kill_chain_phases: - Exploitation mitre_attack_id: From 808eba05e497c234316e5a9e4737c6d31ad0deff Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Jul 2021 16:46:58 +0200 Subject: [PATCH 31/32] Update powershell_disable_security_monitoring.yml --- detections/endpoint/powershell_disable_security_monitoring.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 79da1e604b..3f39baed5c 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -26,7 +26,7 @@ references: tags: analytic_story: - Ransomware - - Revil + - Revil Ransomware kill_chain_phases: - Exploitation mitre_attack_id: From 2fbeb9c005b0d678b3d0ce9ea751cc534d4a30f1 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 5 Jul 2021 14:52:27 +0000 Subject: [PATCH 32/32] Added detection testing service results inMsmpeng Application DLL Side Loading --- .../msmpeng_application_dll_side_loading.yml | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 072849d013..7f9a9cd8fd 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -6,17 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. - This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the - actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine +description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll + in non default windows defender folder. This technique was seen couple days ago + with revil ransomware in Kaseya Supply chain. The approach is to drop an old version + of msmpeng.exe to load the actual payload name as mspvc.dll which will load the + revil ransomware to the compromise machine search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `msmpeng_application_dll_side_loading_filter`' + where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND + Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time + Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -37,9 +37,12 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.file_create_time - - Filesystem.process_id - - Filesystem.file_name + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name - Filesystem.user - - Filesystem.file_path + - Filesystem.file_path security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log