From 8fefd6a3f04cbf5e68c37d2c88f5e3e28c98171f Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 25 Apr 2023 16:47:38 +0200 Subject: [PATCH] do_not_step_on_the_redline --- .../disable_windows_behavior_monitoring.yml | 11 ++++--- ..._or_script_creation_in_suspicious_path.yml | 29 ++++++++-------- ...e_process_accessing_chrome_default_dir.yml | 11 ++++--- ...fox_process_access_firefox_profile_dir.yml | 23 ++++++------- .../endpoint/suspicious_process_file_path.yml | 33 ++++++++++--------- .../windows_disableantispyware_registry.yml | 9 ++--- .../windows_event_for_service_disabled.yml | 3 +- stories/redline.yml | 25 ++++++++++++++ 8 files changed, 88 insertions(+), 56 deletions(-) create mode 100644 stories/redline.yml diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 260c0fd8dc..253ae0f0e0 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,7 +1,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 version: 3 -date: '2022-11-14' +date: '2023-04-25' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -38,11 +38,12 @@ references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - - Windows Defense Evasion Tactics - - Ransomware - - Revil Ransomware - - Windows Registry Abuse - Azorult + - Windows Registry Abuse + - Revil Ransomware + - RedLine Stealer + - Ransomware + - Windows Defense Evasion Tactics asset_type: Endpoint confidence: 100 impact: 40 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 6d1289b8dc..81fdee3e91 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 version: 1 -date: '2023-04-14' +date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,24 +37,25 @@ references: - https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - - DarkCrystal RAT - - AsyncRAT - Azorult - - Brute Ratel C4 - - Double Zero Destructor - - Industroyer2 - - AgentTesla - - Qakbot - - IcedID - - Remcos + - AsyncRAT - XMRig - - Hermetic Wiper - - Trickbot - - Chaos Ransomware - Swift Slicer - - LockBit Ransomware + - DarkCrystal RAT + - Double Zero Destructor + - Trickbot - Data Destruction + - LockBit Ransomware + - Industroyer2 + - Remcos + - RedLine Stealer - WhisperGate + - IcedID + - Hermetic Wiper + - AgentTesla + - Brute Ratel C4 + - Qakbot + - Chaos Ransomware asset_type: Endpoint confidence: 50 impact: 40 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 3987a719e9..28ff767a07 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,7 +1,7 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 version: 1 -date: '2021-09-15' +date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -11,8 +11,8 @@ description: This search is to detect an anomaly event of a non-chrome process a the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring - this access to the folder, we observed noise that needs to be filter out and hence added - sqlite db browser and explorer .exe to make this detection more stable. + this access to the folder, we observed noise that needs to be filter out and hence + added sqlite db browser and explorer .exe to make this detection more stable. data_source: - Windows Security 4663 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", @@ -28,10 +28,11 @@ known_false_positives: other browser not listed related to firefox may catch by references: [] tags: analytic_story: - - FIN7 - Remcos - - AgentTesla - 3CX Supply Chain Attack + - AgentTesla + - RedLine Stealer + - FIN7 asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index e77d20fbd4..25dded39df 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,18 +1,18 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 version: 1 -date: '2021-09-15' +date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: Anomaly description: This search is to detect an anomaly event of a non-firefox process accessing - the files in the profile folder. This folder contains all the sqlite database of the - firefox browser related to users login, history, cookies and etc. Most of the RAT, - trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect - information on the compromised host. This SACL Event (4663) needs to be enabled to - the firefox profile directory to use this. Since this is monitoring the - access to the folder, we have obsevered noise and hence added `sqlite - db browser` and `explorer.exe` to make this detection more stable. + the files in the profile folder. This folder contains all the sqlite database of + the firefox browser related to users login, history, cookies and etc. Most of the + RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database + to collect information on the compromised host. This SACL Event (4663) needs to + be enabled to the firefox profile directory to use this. Since this is monitoring + the access to the folder, we have obsevered noise and hence added `sqlite db browser` + and `explorer.exe` to make this detection more stable. data_source: - Windows Security 4663 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", @@ -28,11 +28,12 @@ known_false_positives: other browser not listed related to firefox may catch by references: [] tags: analytic_story: - - FIN7 - - Remcos - Azorult - - AgentTesla + - Remcos - 3CX Supply Chain Attack + - AgentTesla + - RedLine Stealer + - FIN7 asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 2c4a9f0289..6e6cdf7a01 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Suspicious Process File Path id: 9be25988-ad82-11eb-a14f-acde48001122 version: 1 -date: '2023-04-14' +date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -35,25 +35,26 @@ references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - - AgentTesla - - Swift Slicer - - Prestige Ransomware - - Data Destruction - - AsyncRAT - - Brute Ratel C4 - - XMRig - - LockBit Ransomware - - WhisperGate - - DarkCrystal RAT - - Qakbot - - Hermetic Wiper - - Chaos Ransomware - Azorult + - AsyncRAT + - XMRig + - Swift Slicer + - DarkCrystal RAT - Double Zero Destructor - - Industroyer2 - - IcedID - Trickbot + - Data Destruction + - LockBit Ransomware + - Prestige Ransomware + - Industroyer2 - Remcos + - RedLine Stealer + - WhisperGate + - IcedID + - Hermetic Wiper + - AgentTesla + - Brute Ratel C4 + - Qakbot + - Chaos Ransomware asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index 01fbedec64..7a865e2d52 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -1,7 +1,7 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb version: 2 -date: '2021-03-02' +date: '2023-04-25' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk status: production type: TTP @@ -29,11 +29,12 @@ references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ tags: analytic_story: - - Ryuk Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - Azorult + - Windows Registry Abuse - CISA AA22-264A + - RedLine Stealer + - Windows Defense Evasion Tactics + - Ryuk Ransomware asset_type: Endpoint confidence: 80 impact: 30 diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index 010005dc64..2cb1593c03 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -1,7 +1,7 @@ name: Windows Event For Service Disabled id: 9c2620a8-94a1-11ec-b40c-acde48001122 version: 2 -date: '2022-04-04' +date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -25,6 +25,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - RedLine Stealer asset_type: Endpoint confidence: 60 impact: 60 diff --git a/stories/redline.yml b/stories/redline.yml new file mode 100644 index 0000000000..3ea0540be4 --- /dev/null +++ b/stories/redline.yml @@ -0,0 +1,25 @@ +name: RedLine Stealer +id: 12e31e8b-671b-4d6e-b362-a682812a71eb +version: 1 +date: '2023-04-24' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Redline Stealer trojan, including looking for file writes associated + with its payload, screencapture, registry modification, persistence + and data collection.. +narrative: RedLine Stealer is a malware available on underground forum and subscription basis that are compiled or written in C#. + This malware is capable of harvesting sensitive information from browsers such as saved credentials, auto file data, browser cookies + and credit card information. It also gathers system information of the targeted or compromised host like username, location IP, RAM size available, hardware configuration and software installed. + The current version of this malware contains features to steal wallet and crypto currency information. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +- https://blogs.blackberry.com/en/2021/10/threat-thursday-redline-infostealer-update +tags: + analytic_story: RedLine Stealer + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file