Branch was auto-updated.

detections/endpoint/windows_bootloader_inventory.yml

@@ -0,0 +1,40 @@
+name: Windows BootLoader Inventory
+id: 4f7e3913-4db3-4ccd-afe4-31198982305d
+version: 1
+date: '2023-04-14'
+author: Michael Haag, Splunk
+status: experimental
+type: Hunting
+data_source: []
+description: The following hunting query utilizes a PowerShell Scripted input that captures the bootloader paths for each Windows endpoint it is deployed to. The template inputs.conf is located in the references link.
+  By default, it only captures the path, but may be modified to capture everything that BCDedit provides. It can be verbose, but may be worth it.
+search: '`bootloader_inventory` | stats count min(_time) as firstTime max(_time)
+  as lastTime values(_raw) by host | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_bootloader_inventory_filter`'
+how_to_implement: To implement this analytic, a new stanza will need to be added to a inputs.conf and deployed to all or some Windows endpoints. https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707 provides the stanza. If modifying the sourcetype, be sure to update the Macro for this analytic. Recommend running it daily, or weekly, depending on threat model.
+known_false_positives: No false positives here, only bootloaders. Filter as needed or create a lookup as a baseline.
+references:
+  - https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707
+  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
+tags:
+  analytic_story:
+  - BlackLotus Campaign
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 90
+  impact: 90
+  message: A list of BootLoaders are present on $dest$
+  mitre_attack_id:
+  - T1542.001
+  - T1542
+  observable:
+  - name: host
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/windows_impair_defenses_disable_hvci.yml

@@ -0,0 +1,52 @@
+name: Windows Impair Defenses Disable HVCI
+id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79
+version: 1
+date: '2023-04-13'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 13
+description: The following analytic refers to a detection mechanism designed to identify when the Hypervisor-protected Code Integrity (HVCI) feature is disabled within the Windows registry. HVCI is a security feature in Windows 10 and Windows Server 2016 that helps protect the kernel and system processes from being tampered with by malicious code.
+  HVCI relies on hardware-assisted virtualization and Microsoft's Hyper-V hypervisor to ensure that only kernel-mode code that has been signed by Microsoft or the system's hardware manufacturer can be executed. This prevents attackers from exploiting vulnerabilities to run unsigned code, like kernel-mode rootkits or other malicious software, at the kernel level.
+  Disabling HVCI may expose the system to security risks and could be an indicator of a potential compromise or unauthorized activity. The analytic aims to detect and report events or configurations that lead to the disabling of HVCI.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000"  by  Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid Registry.action  Registry.user
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed.
+references:
+  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
+tags:
+  analytic_story:
+  - BlackLotus Campaign
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  atomic_guid: 
+  - 70bd71e6-eba4-4e00-92f7-617911dbe020
+  confidence: 100
+  impact: 70
+  message: HVCI has been disabled on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 70
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_rdp_connection_successful.yml

@@ -0,0 +1,50 @@
+name: Windows RDP Connection Successful
+id: ceaed840-56b3-4a70-b8e1-d762b1c5c08c
+version: 1
+date: '2023-04-17'
+author: Michael Haag, Splunk
+status: production
+type: Hunting
+data_source: []
+description: The following analytic identifies successful remote desktop connections. Utilize this analytic to hunt for successful attempts. In addition, the query may be modified for EventCode=1148 to potentially identify failed attempts. In testing, 1148 would not generate based on a failed logon attempt.
+  Note this analytic requires enabling and a stanza in a inputs.conf.
+search: '`remoteconnectionmanager` EventCode=1149
+  | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, Source_Network_Address, User, Message
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | rename ComputerName as dest | `windows_rdp_connection_successful_filter`'
+how_to_implement: The following analyic requires the WIndows TerminalServices RemoteConnectionManager Operational log to be enabled and ingested into Splunk. For the inputs, review https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706. 
+known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
+references:
+  - https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706
+  - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 50
+  impact: 50
+  message: A successful RDP connection on $dest$ occurred.
+  mitre_attack_id:
+  - T1563.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: Source_Network_Address
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/remoteconnectionmanager.log
+    source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
+    sourcetype: wineventlog

macros/bootloader_inventory.yml

@@ -0,0 +1,4 @@
+definition: sourcetype = PwSh:bootloader
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: bootloader_inventory

macros/remoteconnectionmanager.yml

@@ -0,0 +1,4 @@
+definition: source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: remoteconnectionmanager

stories/blacklotus_campaign.yml

@@ -0,0 +1,20 @@
+name: BlackLotus Campaign
+id: 8eb0e418-a2b6-4327-a387-85c976662c8f
+version: 1
+date: '2023-04-14'
+author: Michael Haag, Splunk
+description: The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality
+narrative: "The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn't gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature  UEFI Secure Boot  is now a reality. present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022. (ESET, 2023)
+  The following content aims to aid defenders in detecting suspicious bootloaders and understanding the diverse techniques employed in this campaign."
+references:
+  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
+  - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
+tags:
+  analytic_story: BlackLotus Campaign
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection