Branch was auto-updated.

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -41,6 +41,7 @@ tags:
   - ProxyNotShell
   - Qakbot
   - Chaos Ransomware
+  - AsyncRAT
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -52,6 +52,8 @@ tags:
   - Trickbot
   - Chaos Ransomware
   - LockBit Ransomware
+  - AsyncRAT
+  - Swift Slicer
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/execution_of_file_with_multiple_extensions.yml

@@ -2,7 +2,7 @@ name: Execution of File with Multiple Extensions
 id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
 version: 3
 date: '2020-11-18'
-author: Rico Valdez, Splunk
+author: Rico Valdez, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -10,21 +10,25 @@ description: This search looks for processes launched from files that have doubl
   extensions in the file name. This is typically done to obscure the "real" file extension
   and make it appear as though the file being accessed is a data file, as opposed
   to executable content.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe
-  OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process
-  = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by
-  Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", 
+  "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") 
+  by Processes.dest Processes.user Processes.process Processes.parent_process 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` 
+  | `execution_of_file_with_multiple_extensions_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records process activity from your hosts to populate the endpoint data model
   in the processes node.
 known_false_positives: None identified.
-references: []
+references: 
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Windows File Extension and Association Abuse
   - Masquerading - Rename System Utilities
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/loading_of_dynwrapx_module.yml

@@ -34,9 +34,11 @@ references:
 - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
 - https://tria.ge/210929-ap75vsddan
 - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Remcos
+  - AsyncRAT
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -30,6 +30,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkCrystal RAT
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml

@@ -20,9 +20,11 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
+search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_fileless_script_contains_base64_encoded_content_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -36,6 +38,7 @@ tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml

@@ -38,6 +38,7 @@ tags:
   - Hermetic Wiper 
   - Malicious PowerShell
   - AgentTesla
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/powershell_processing_stream_of_data.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/recon_using_wmi_class.yml

@@ -37,6 +37,7 @@ tags:
   - Industroyer2
   - Qakbot
   - LockBit Ransomware
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -56,6 +56,7 @@ tags:
   - Azorult
   - Qakbot
   - Chaos Ransomware
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml

@@ -35,6 +35,7 @@ tags:
   - Remcos
   - Hermetic Wiper
   - Living Off The Land
+  - AsyncRAT
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml

@@ -37,6 +37,7 @@ tags:
   - Remcos
   - Living Off The Land
   - Qakbot
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -39,6 +39,7 @@ tags:
   - Qakbot
   - Trickbot
   - Prestige Ransomware
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/suspicious_copy_on_system32.yml

@@ -32,6 +32,7 @@ tags:
   - Unusual Processes
   - Qakbot
   - IcedID
+  - AsyncRAT
   confidence: 90
   context:
   - Stage:Execution

detections/endpoint/suspicious_process_file_path.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process File Path
 id: 9be25988-ad82-11eb-a14f-acde48001122
 version: 1
-date: '2021-05-05'
+date: '2023-01-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -31,6 +31,7 @@ references:
 - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 - https://twitter.com/pr0xylife/status/1590394227758104576
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Data Destruction 
@@ -50,6 +51,8 @@ tags:
   - Prestige Ransomware
   - Chaos Ransomware
   - LockBit Ransomware
+  - AsyncRAT
+  - Swift Slicer
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/vbscript_execution_using_wscript_app.yml

@@ -26,10 +26,12 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: unknown
 references:
 - https://www.joesandbox.com/analysis/369332/0/html
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - FIN7
   - Remcos
+  - AsyncRAT
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml

@@ -22,9 +22,11 @@ references:
 - https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
 - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
 - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Brute Ratel C4
+  - AsyncRAT
   asset_type:  Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_powershell_cryptography_namespace.yml

@@ -0,0 +1,69 @@
+name: Windows Powershell Cryptography Namespace
+id: f8b482f4-6d62-49fa-a905-dfa15698317b
+version: 1
+date: '2023-01-26'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies suspicious PowerShell script execution
+  via EventCode 4104 that is processing cryptography namespace library. 
+  This technique was seen in several powershell malware, loader, downloader and stager that will decrypt or decode the next malicious stager or the actual payload. 
+  This Anomaly detection can be a good indicator that a powershell process to decrypt code. We recommend to further check the parent_process_name, the file or data 
+  it tries to decrypt, network connection and user who execute the script.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_powershell_cryptography_namespace_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited. Filter as needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A suspicious powershell script contains cryptography command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+  mitre_attack_id:
+  - T1059.001
+  - T1059
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCodes
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/windows_scheduled_task_with_highest_privileges.yml

@@ -0,0 +1,76 @@
+name: Windows Scheduled Task with Highest Privileges
+id: 2f15e1a4-0fc2-49dd-919e-cbbe60699218
+version: 1
+date: '2023-01-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies Schtasks.exe creating a new task with highest privilege execution. 
+  This techniques was seen in asyncrat where it uses the scheduled task as part of it persistence and privilege escalation. 
+  AsyncRAT will setup a scheduled task with parameter '/rl' and 'highest' to trigger this technique. This TTP detection can be a 
+  good indicator of malware or adversaries trying to gain persistence and privilege escalation through scheduled task. We recommend to always 
+  check and monitoring this type of events even filtering is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes 
+  where Processes.process_name = "schtasks.exe" Processes.process = "*/rl *" Processes.process = "* highest *"
+  by Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_scheduled_task_with_highest_privileges_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: False positives will be limited to legitimate applications
+  creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
+  the query to have world writeable paths to restrict it.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: a $process_name$ creating a schedule task $process$ with highest run level privilege in $dest$
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml

@@ -0,0 +1,70 @@
+name: 'Windows Spearphishing Attachment Connect To None MS Office Domain'
+id: 1cb40e15-cffa-45cc-abbd-e35884a49766
+version: 1
+date: '2023-01-27'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: this detection was designed to identifies suspicious office documents
+  that connect to a website aside from Microsoft Office Domain. This technique was seen in 
+  several malicious documents that abuses .rels xml properties of MS office to connect or download malicious files. 
+  This hunting query can a good pivot or guide to check what URL link it tries to connect, what domain, where the documents came from and 
+  how the connection happens.
+search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe","*\\onenote.exe",
+  "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe") 
+  AND NOT(QueryName IN ("*.office.com", "*.office.net"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus Computer
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Windows Office document may contain legitimate url link other than MS office Domain. filter is needed
+references:
+- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a office document process $Image$ connect to an URL link $QueryName$ in $Computer$
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - QueryName 
+  - QueryResults 
+  - QueryStatus 
+  - Computer
+  risk_score: 9
+  security_domain: endpoint

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -47,6 +47,7 @@ tags:
   - Industroyer2
   - CISA AA22-257A
   - Prestige Ransomware
+  - AsyncRAT
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -36,6 +36,7 @@ tags:
   - CISA AA22-257A
   - Qakbot
   - Prestige Ransomware
+  - AsyncRAT
   confidence: 100
   context:
   - Source:Endpoint

tests/endpoint/windows_powershell_cryptography_namespace.test.yml

@@ -0,0 +1,13 @@
+name: Windows Powershell Cryptography Namespace Unit Test
+tests:
+- name: Windows Powershell Cryptography Namespace
+  file: endpoint/windows_powershell_cryptography_namespace.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml.log
+    data:  https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml

@@ -0,0 +1,13 @@
+name: Windows Scheduled Task with Highest Privileges Unit Test
+tests:
+- name: Windows Scheduled Task with Highest Privileges
+  file: endpoint/windows_scheduled_task_with_highest_privileges.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml

@@ -0,0 +1,13 @@
+name: Windows Spearphishing Attachment Connect To None MS Office Domain Unit Test
+tests:
+- name: 'Windows Spearphishing Attachment Connect To None MS Office Domain'
+  file: endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true