From f1628eefd36ec0c01b570b0f49cc77b57eb1c2c1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Jan 2023 15:08:29 +0100 Subject: [PATCH 01/10] asyncrat-onenote-chain2 --- ...cmd_carry_out_string_command_parameter.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 1 + ...ution_of_file_with_multiple_extensions.yml | 20 +++++++++++-------- .../endpoint/loading_of_dynwrapx_module.yml | 2 ++ ...hell_process___execution_policy_bypass.yml | 1 + ...script_contains_base64_encoded_content.yml | 9 ++++++--- ...ding_dotnet_into_memory_via_reflection.yml | 1 + .../powershell_processing_stream_of_data.yml | 1 + detections/endpoint/recon_using_wmi_class.yml | 1 + ...2_silent_and_install_param_dll_loading.yml | 1 + ...svr32_with_known_silent_switch_cmdline.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/suspicious_copy_on_system32.yml | 1 + .../vbscript_execution_using_wscript_app.yml | 2 ++ ...eduled_task_created_within_public_path.yml | 1 + ...ws_task_scheduler_event_action_started.yml | 1 + 16 files changed, 34 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index c19a9120a2..1239ddecd3 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -41,6 +41,7 @@ tags: - ProxyNotShell - Qakbot - Chaos Ransomware + - AsyncRAT automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 636a33c60c..90c96e45b9 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -52,6 +52,7 @@ tags: - Trickbot - Chaos Ransomware - LockBit Ransomware + - AsyncRAT automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 12e3d27224..a6245ff28a 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -2,7 +2,7 @@ name: Execution of File with Multiple Extensions id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 version: 3 date: '2020-11-18' -author: Rico Valdez, Splunk +author: Rico Valdez, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,21 +10,25 @@ description: This search looks for processes launched from files that have doubl extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe - OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process - = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by - Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", + "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") + by Processes.dest Processes.user Processes.process Processes.parent_process + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` + | `execution_of_file_with_multiple_extensions_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. known_false_positives: None identified. -references: [] +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Windows File Extension and Association Abuse - Masquerading - Rename System Utilities + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index e0f0ca006b..089c1fa6db 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -34,9 +34,11 @@ references: - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ - https://tria.ge/210929-ap75vsddan - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Remcos + - AsyncRAT confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 0d1737fdd4..7161c76f83 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -30,6 +30,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - DarkCrystal RAT + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 6be2fe62a8..2739c8c549 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -20,9 +20,11 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*'gnirtS46esaBmorF'[-1..-16]*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_fileless_script_contains_base64_encoded_content_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -36,6 +38,7 @@ tags: analytic_story: - Hermetic Wiper - Malicious PowerShell + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index d75da6a33f..c7994cef85 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -38,6 +38,7 @@ tags: - Hermetic Wiper - Malicious PowerShell - AgentTesla + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index f1916b6e27..ef4b4a8c3b 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -30,6 +30,7 @@ tags: analytic_story: - Hermetic Wiper - Malicious PowerShell + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index d2097f3cea..35bbbeeae8 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -37,6 +37,7 @@ tags: - Industroyer2 - Qakbot - LockBit Ransomware + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 1aab04eb9a..256fa37499 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -35,6 +35,7 @@ tags: - Remcos - Hermetic Wiper - Living Off The Land + - AsyncRAT automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 4870a430ed..c5fe49ec9e 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -37,6 +37,7 @@ tags: - Remcos - Living Off The Land - Qakbot + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index b2fcb6a9ba..86658c58f1 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -39,6 +39,7 @@ tags: - Qakbot - Trickbot - Prestige Ransomware + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index cf42d1b659..27c4affdff 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -32,6 +32,7 @@ tags: - Unusual Processes - Qakbot - IcedID + - AsyncRAT confidence: 90 context: - Stage:Execution diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index bf7c985b7b..4f1cf24d68 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -26,10 +26,12 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: unknown references: - https://www.joesandbox.com/analysis/369332/0/html +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - FIN7 - Remcos + - AsyncRAT confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index ae08ecbce2..b696018c69 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -51,6 +51,7 @@ tags: - Industroyer2 - CISA AA22-257A - Prestige Ransomware + - AsyncRAT confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index ddfd760714..f07564c58f 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -36,6 +36,7 @@ tags: - CISA AA22-257A - Qakbot - Prestige Ransomware + - AsyncRAT confidence: 100 context: - Source:Endpoint From 24d3ef152a2ab2419b4b51674d4f1e3830d5a11f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 25 Jan 2023 15:11:30 +0100 Subject: [PATCH 02/10] Update powershell_fileless_script_contains_base64_encoded_content.yml --- ...wershell_fileless_script_contains_base64_encoded_content.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 2739c8c549..61a46593c3 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -20,7 +20,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*'gnirtS46esaBmorF'[-1..-16]*" +search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From f32b5bc51e433166b8a79c15f137ab5b830d9e94 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Jan 2023 15:14:05 +0100 Subject: [PATCH 03/10] asyncrat-onenote-chain2 --- detections/endpoint/registry_keys_used_for_persistence.yml | 1 + detections/endpoint/suspicious_process_file_path.yml | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index f34b445490..7cf8f71de9 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -56,6 +56,7 @@ tags: - Azorult - Qakbot - Chaos Ransomware + - AsyncRAT asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index d7d110624c..03fc872956 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Suspicious Process File Path id: 9be25988-ad82-11eb-a14f-acde48001122 version: 1 -date: '2021-05-05' +date: '2023-01-25' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -31,6 +31,7 @@ references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://twitter.com/pr0xylife/status/1590394227758104576 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Data Destruction @@ -50,6 +51,7 @@ tags: - Prestige Ransomware - Chaos Ransomware - LockBit Ransomware + - AsyncRAT automated_detection_testing: passed confidence: 50 context: From b8d7a20f319bb1df9a9d048fb03a8f4d4e40900f Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 26 Jan 2023 14:12:32 +0100 Subject: [PATCH 04/10] asyncrat-onenote-chain2 --- ...dows_powershell_cryptography_namespace.yml | 69 +++++++++++++++++ ...scheduled_task_with_highest_privileges.yml | 76 +++++++++++++++++++ ...powershell_cryptography_namespace.test.yml | 13 ++++ ...uled_task_with_highest_privileges.test.yml | 13 ++++ 4 files changed, 171 insertions(+) create mode 100644 detections/endpoint/windows_powershell_cryptography_namespace.yml create mode 100644 detections/endpoint/windows_scheduled_task_with_highest_privileges.yml create mode 100644 tests/endpoint/windows_powershell_cryptography_namespace.test.yml create mode 100644 tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml new file mode 100644 index 0000000000..24c9d0db46 --- /dev/null +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -0,0 +1,69 @@ +name: Windows Powershell Cryptography Namespace +id: f8b482f4-6d62-49fa-a905-dfa15698317b +version: 1 +date: '2023-01-26' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies suspicious PowerShell script execution + via EventCode 4104 that is processing cryptography namespace library. + This technique was seen in several powershell malware, loader, downloader and stager that will decrypt or decode the next malicious stager or the actual payload. + This Anomaly detection can be a good indicator that a powershell process to decrypt code. We recommend to further check the parent_process_name, the file or data + it tries to decrypt, network connection and user who execute the script. +search: '`powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_cryptography_namespace_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A suspicious powershell script contains cryptography command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ + mitre_attack_id: + - T1059.001 + - T1059 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: UserID + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Opcode + - Computer + - UserID + - EventCodes + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml new file mode 100644 index 0000000000..62488a1eca --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml @@ -0,0 +1,76 @@ +name: Windows Scheduled Task with Highest Privileges +id: 2f15e1a4-0fc2-49dd-919e-cbbe60699218 +version: 1 +date: '2023-01-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies Schtasks.exe creating a new task with highest privilege execution. + This techniques was seen in asyncrat where it uses the scheduled task as part of it persistence and privilege escalation. + AsyncRAT will setup a scheduled task with parameter '/rl' and 'highest' to trigger this technique. This TTP detection can be a + good indicator of malware or adversaries trying to gain persistence and privilege escalation through scheduled task. We recommend to always + check and monitoring this type of events even filtering is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "schtasks.exe" Processes.process = "*/rl *" Processes.process = "* highest *" + by Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_scheduled_task_with_highest_privileges_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +known_false_positives: False positives will be limited to legitimate applications + creating a task to run as SYSTEM. Filter as needed based on parent process, or modify + the query to have world writeable paths to restrict it. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a $process_name$ creating a schedule task $process$ with highest run level privilege in $dest$ + mitre_attack_id: + - T1053 + - T1053.005 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/windows_powershell_cryptography_namespace.test.yml b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml new file mode 100644 index 0000000000..d8b74bc1b7 --- /dev/null +++ b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml @@ -0,0 +1,13 @@ +name: Windows Powershell Cryptography Namespace Unit Test +tests: +- name: Windows Powershell Cryptography Namespace + file: endpoint/windows_powershell_cryptography_namespace.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml new file mode 100644 index 0000000000..b527dbd01d --- /dev/null +++ b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml @@ -0,0 +1,13 @@ +name: Windows Scheduled Task with Highest Privileges Unit Test +tests: +- name: Windows Scheduled Task with Highest Privileges + file: endpoint/windows_scheduled_task_with_highest_privileges.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From b6f2b630813a7a7e04d32fa850b03517e913dc73 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 26 Jan 2023 14:15:28 +0100 Subject: [PATCH 05/10] Update windows_powershell_cryptography_namespace.yml --- .../endpoint/windows_powershell_cryptography_namespace.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml index 24c9d0db46..22785d2a30 100644 --- a/detections/endpoint/windows_powershell_cryptography_namespace.yml +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -50,8 +50,8 @@ tags: type: Hostname role: - Victim - - name: UserID - type: UserID + - name: User + type: User role: - Victim product: From 6e695cb16e734d4aba6528fabb04a96864bcccfd Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 26 Jan 2023 18:00:00 +0100 Subject: [PATCH 06/10] asyncrat-onenote-chain2 --- .../windows_access_token_manipulation_sedebugprivilege.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 89c68e99d5..867efa92ea 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -22,9 +22,11 @@ references: - https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113 - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Brute Ratel C4 + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 From cf1ec25aefc2aa773ea7b17b8764e0c79e33e1cb Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Jan 2023 14:14:35 +0100 Subject: [PATCH 07/10] asyncrat-onenote-chain2 --- ...ment_connect_to_none_ms_office_domain_.yml | 70 +++++++++++++++++++ ..._connect_to_none_ms_office_domain.test.yml | 13 ++++ 2 files changed, 83 insertions(+) create mode 100644 detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml create mode 100644 tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml new file mode 100644 index 0000000000..cf9810daa7 --- /dev/null +++ b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml @@ -0,0 +1,70 @@ +name: 'Windows Spearphishing Attachment Connect To None MS Office Domain' +id: 1cb40e15-cffa-45cc-abbd-e35884a49766 +version: 1 +date: '2023-01-27' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious office documents + that connect to a website aside from Microsoft Office Domain. This technique was seen in + several malicious documents that abuses .rels xml properties of MS office to connect or download malicious files. + This hunting query can a good pivot or guide to check what URL link it tries to connect, what domain, where the documents came from and + how the connection happens. +search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe","*\\onenote.exe", + "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe") + AND NOT(QueryName IN ("*.office.com", "*.office.net")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Windows Office document may contain legitimate url link other than MS office Domain. filter is needed +references: +- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - Spearphishing Attachments + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: a office document process $Image$ connect to an URL link $QueryName$ in $Computer$ + mitre_attack_id: + - T1566.001 + - T1566 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryResults + - QueryStatus + - Computer + risk_score: 9 + security_domain: endpoint diff --git a/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml b/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml new file mode 100644 index 0000000000..6c0843d362 --- /dev/null +++ b/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml @@ -0,0 +1,13 @@ +name: Windows Spearphishing Attachment Connect To None MS Office Domain Unit Test +tests: +- name: 'Windows Spearphishing Attachment Connect To None MS Office Domain' + file: endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 5206d43c71f05ccf2460e2a296603e9f8e3f8c78 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Jan 2023 14:15:06 +0100 Subject: [PATCH 08/10] asyncrat-onenote-chain2 --- ...spearphishing_attachment_connect_to_none_ms_office_domain.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/endpoint/{windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml => windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml} (100%) diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml similarity index 100% rename from detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml rename to detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml From ecda0cb289c7eb6aed25869c3a0b59a960c27273 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 3 Feb 2023 09:15:35 +0100 Subject: [PATCH 09/10] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 03fc872956..4c86863b05 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -52,6 +52,7 @@ tags: - Chaos Ransomware - LockBit Ransomware - AsyncRAT + - Swift Slicer automated_detection_testing: passed confidence: 50 context: From af5c030cb37161cf33b2ce19e9b20a94ff12558b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 3 Feb 2023 09:17:11 +0100 Subject: [PATCH 10/10] Update executables_or_script_creation_in_suspicious_path.yml --- .../executables_or_script_creation_in_suspicious_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 90c96e45b9..0320a29342 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -53,6 +53,7 @@ tags: - Chaos Ransomware - LockBit Ransomware - AsyncRAT + - Swift Slicer automated_detection_testing: passed confidence: 50 context: