diff --git a/detections/endpoint/windows_bootloader_inventory.yml b/detections/endpoint/windows_bootloader_inventory.yml new file mode 100644 index 0000000000..a2b277fe1f --- /dev/null +++ b/detections/endpoint/windows_bootloader_inventory.yml @@ -0,0 +1,40 @@ +name: Windows BootLoader Inventory +id: 4f7e3913-4db3-4ccd-afe4-31198982305d +version: 1 +date: '2023-04-14' +author: Michael Haag, Splunk +status: experimental +type: Hunting +data_source: [] +description: The following hunting query utilizes a PowerShell Scripted input that captures the bootloader paths for each Windows endpoint it is deployed to. The template inputs.conf is located in the references link. + By default, it only captures the path, but may be modified to capture everything that BCDedit provides. It can be verbose, but may be worth it. +search: '`bootloader_inventory` | stats count min(_time) as firstTime max(_time) + as lastTime values(_raw) by host | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_bootloader_inventory_filter`' +how_to_implement: To implement this analytic, a new stanza will need to be added to a inputs.conf and deployed to all or some Windows endpoints. https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707 provides the stanza. If modifying the sourcetype, be sure to update the Macro for this analytic. Recommend running it daily, or weekly, depending on threat model. +known_false_positives: No false positives here, only bootloaders. Filter as needed or create a lookup as a baseline. +references: + - https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707 + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ +tags: + analytic_story: + - BlackLotus Campaign + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + impact: 90 + message: A list of BootLoaders are present on $dest$ + mitre_attack_id: + - T1542.001 + - T1542 + observable: + - name: host + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 81 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml new file mode 100644 index 0000000000..8e1854caf3 --- /dev/null +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -0,0 +1,52 @@ +name: Windows Impair Defenses Disable HVCI +id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 +version: 1 +date: '2023-04-13' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 13 +description: The following analytic refers to a detection mechanism designed to identify when the Hypervisor-protected Code Integrity (HVCI) feature is disabled within the Windows registry. HVCI is a security feature in Windows 10 and Windows Server 2016 that helps protect the kernel and system processes from being tampered with by malicious code. + HVCI relies on hardware-assisted virtualization and Microsoft's Hyper-V hypervisor to ensure that only kernel-mode code that has been signed by Microsoft or the system's hardware manufacturer can be executed. This prevents attackers from exploiting vulnerabilities to run unsigned code, like kernel-mode rootkits or other malicious software, at the kernel level. + Disabling HVCI may expose the system to security risks and could be an indicator of a potential compromise or unauthorized activity. The analytic aims to detect and report events or configurations that lead to the disabling of HVCI. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000" by Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid Registry.action Registry.user + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed. +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ +tags: + analytic_story: + - BlackLotus Campaign + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + atomic_guid: + - 70bd71e6-eba4-4e00-92f7-617911dbe020 + confidence: 100 + impact: 70 + message: HVCI has been disabled on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 70 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_rdp_connection_successful.yml b/detections/endpoint/windows_rdp_connection_successful.yml new file mode 100644 index 0000000000..a883ad9b02 --- /dev/null +++ b/detections/endpoint/windows_rdp_connection_successful.yml @@ -0,0 +1,50 @@ +name: Windows RDP Connection Successful +id: ceaed840-56b3-4a70-b8e1-d762b1c5c08c +version: 1 +date: '2023-04-17' +author: Michael Haag, Splunk +status: production +type: Hunting +data_source: [] +description: The following analytic identifies successful remote desktop connections. Utilize this analytic to hunt for successful attempts. In addition, the query may be modified for EventCode=1148 to potentially identify failed attempts. In testing, 1148 would not generate based on a failed logon attempt. + Note this analytic requires enabling and a stanza in a inputs.conf. +search: '`remoteconnectionmanager` EventCode=1149 + | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, Source_Network_Address, User, Message + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | rename ComputerName as dest | `windows_rdp_connection_successful_filter`' +how_to_implement: The following analyic requires the WIndows TerminalServices RemoteConnectionManager Operational log to be enabled and ingested into Splunk. For the inputs, review https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706. +known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter. +references: + - https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706 + - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + impact: 50 + message: A successful RDP connection on $dest$ occurred. + mitre_attack_id: + - T1563.002 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Source_Network_Address + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/remoteconnectionmanager.log + source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational + sourcetype: wineventlog diff --git a/macros/bootloader_inventory.yml b/macros/bootloader_inventory.yml new file mode 100644 index 0000000000..51a7eb40bc --- /dev/null +++ b/macros/bootloader_inventory.yml @@ -0,0 +1,4 @@ +definition: sourcetype = PwSh:bootloader +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: bootloader_inventory \ No newline at end of file diff --git a/macros/remoteconnectionmanager.yml b/macros/remoteconnectionmanager.yml new file mode 100644 index 0000000000..325ecd2e01 --- /dev/null +++ b/macros/remoteconnectionmanager.yml @@ -0,0 +1,4 @@ +definition: source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: remoteconnectionmanager \ No newline at end of file diff --git a/stories/blacklotus_campaign.yml b/stories/blacklotus_campaign.yml new file mode 100644 index 0000000000..41b8b6e651 --- /dev/null +++ b/stories/blacklotus_campaign.yml @@ -0,0 +1,20 @@ +name: BlackLotus Campaign +id: 8eb0e418-a2b6-4327-a387-85c976662c8f +version: 1 +date: '2023-04-14' +author: Michael Haag, Splunk +description: The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality +narrative: "The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn't gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature UEFI Secure Boot is now a reality. present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022. (ESET, 2023) + The following content aims to aid defenders in detecting suspicious bootloaders and understanding the diverse techniques employed in this campaign." +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ +tags: + analytic_story: BlackLotus Campaign + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection