From 608172a95b5c9b279987104c577393ec809e9660 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 4 Jan 2023 11:43:16 -0800 Subject: [PATCH 1/2] patches from sanjay --- .../endpoint/msmpeng_application_dll_side_loading.yml | 6 +++--- .../remcos_rat_file_creation_in_remcos_folder.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index a5b5b822a9..8f9e8b0ec7 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -1,8 +1,8 @@ name: Msmpeng Application DLL Side Loading id: 8bb3f280-dd9b-11eb-84d5-acde48001122 -version: 1 +version: 2 date: '2021-07-05' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk, Sanjay Govind type: TTP datamodel: - Endpoint @@ -15,7 +15,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time - Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` + Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 99f25fd29a..7705e29e22 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -1,8 +1,8 @@ name: Remcos RAT File Creation in Remcos Folder id: 25ae862a-1ac3-11ec-94a1-acde48001122 -version: 1 +version: 2 date: '2021-09-21' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk, Sanjay Govind type: TTP datamodel: - Endpoint @@ -12,8 +12,8 @@ description: This search is to detect file creation in remcos folder in appdata clipboard grabbing and audio recording. search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") - Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path - Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` | + Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name c.file_path + Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your From 7fe88d721e9f27b9b80acbd97ef3de15b033a206 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 10 Jan 2023 11:47:40 -0800 Subject: [PATCH 2/2] Update remcos_rat_file_creation_in_remcos_folder.yml --- .../endpoint/remcos_rat_file_creation_in_remcos_folder.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 7705e29e22..ab6949542f 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -12,7 +12,7 @@ description: This search is to detect file creation in remcos folder in appdata clipboard grabbing and audio recording. search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") - Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name c.file_path + Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting