From df736d2d087c4d5feff914fd653f3e8a32c45658 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:32:12 -0600 Subject: [PATCH 1/6] HVCI Disable and story --- .../windows_impair_defenses_disable_hvci.yml | 52 +++++++++++++++++++ stories/blacklotus_campaign.yml | 20 +++++++ 2 files changed, 72 insertions(+) create mode 100644 detections/endpoint/windows_impair_defenses_disable_hvci.yml create mode 100644 stories/blacklotus_campaign.yml diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml new file mode 100644 index 0000000000..b9f54b7d12 --- /dev/null +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -0,0 +1,52 @@ +name: Windows Impair Defenses Disable HVCI +id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 +version: 1 +date: '2023-04-13' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 13 +description: The following analytic refers to a detection mechanism designed to identify when the Hypervisor-protected Code Integrity (HVCI) feature is disabled within the Windows registry. HVCI is a security feature in Windows 10 and Windows Server 2016 that helps protect the kernel and system processes from being tampered with by malicious code. +HVCI relies on hardware-assisted virtualization and Microsoft's Hyper-V hypervisor to ensure that only kernel-mode code that has been signed by Microsoft or the system's hardware manufacturer can be executed. This prevents attackers from exploiting vulnerabilities to run unsigned code, like kernel-mode rootkits or other malicious software, at the kernel level. +Disabling HVCI may expose the system to security risks and could be an indicator of a potential compromise or unauthorized activity. The analytic aims to detect and report events or configurations that lead to the disabling of HVCI. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000" by Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid Registry.action Registry.user + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed. +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ +tags: + analytic_story: + - BlackLotus Campaign + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + atomic_guid: + - 70bd71e6-eba4-4e00-92f7-617911dbe020 + confidence: 100 + impact: 70 + message: HVCI has been disabled on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 70 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/stories/blacklotus_campaign.yml b/stories/blacklotus_campaign.yml new file mode 100644 index 0000000000..41b8b6e651 --- /dev/null +++ b/stories/blacklotus_campaign.yml @@ -0,0 +1,20 @@ +name: BlackLotus Campaign +id: 8eb0e418-a2b6-4327-a387-85c976662c8f +version: 1 +date: '2023-04-14' +author: Michael Haag, Splunk +description: The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality +narrative: "The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn't gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature UEFI Secure Boot is now a reality. present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022. (ESET, 2023) + The following content aims to aid defenders in detecting suspicious bootloaders and understanding the diverse techniques employed in this campaign." +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ +tags: + analytic_story: BlackLotus Campaign + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 3706e5562aa602940d55719ea34bb802d1744e61 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:42:04 -0600 Subject: [PATCH 2/6] Update windows_impair_defenses_disable_hvci.yml --- detections/endpoint/windows_impair_defenses_disable_hvci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml index b9f54b7d12..8e1854caf3 100644 --- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -8,8 +8,8 @@ type: TTP data_source: - Sysmon Event ID 13 description: The following analytic refers to a detection mechanism designed to identify when the Hypervisor-protected Code Integrity (HVCI) feature is disabled within the Windows registry. HVCI is a security feature in Windows 10 and Windows Server 2016 that helps protect the kernel and system processes from being tampered with by malicious code. -HVCI relies on hardware-assisted virtualization and Microsoft's Hyper-V hypervisor to ensure that only kernel-mode code that has been signed by Microsoft or the system's hardware manufacturer can be executed. This prevents attackers from exploiting vulnerabilities to run unsigned code, like kernel-mode rootkits or other malicious software, at the kernel level. -Disabling HVCI may expose the system to security risks and could be an indicator of a potential compromise or unauthorized activity. The analytic aims to detect and report events or configurations that lead to the disabling of HVCI. + HVCI relies on hardware-assisted virtualization and Microsoft's Hyper-V hypervisor to ensure that only kernel-mode code that has been signed by Microsoft or the system's hardware manufacturer can be executed. This prevents attackers from exploiting vulnerabilities to run unsigned code, like kernel-mode rootkits or other malicious software, at the kernel level. + Disabling HVCI may expose the system to security risks and could be an indicator of a potential compromise or unauthorized activity. The analytic aims to detect and report events or configurations that lead to the disabling of HVCI. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user From 59c4718b7e0eb8e064103833ecc6035aafc0eec8 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Apr 2023 12:02:42 -0600 Subject: [PATCH 3/6] inventory --- .../endpoint/windows_bootloader_inventory.yml | 40 +++++++++++++++++++ macros/bootloader_inventory.yml | 4 ++ 2 files changed, 44 insertions(+) create mode 100644 detections/endpoint/windows_bootloader_inventory.yml create mode 100644 macros/bootloader_inventory.yml diff --git a/detections/endpoint/windows_bootloader_inventory.yml b/detections/endpoint/windows_bootloader_inventory.yml new file mode 100644 index 0000000000..a2b277fe1f --- /dev/null +++ b/detections/endpoint/windows_bootloader_inventory.yml @@ -0,0 +1,40 @@ +name: Windows BootLoader Inventory +id: 4f7e3913-4db3-4ccd-afe4-31198982305d +version: 1 +date: '2023-04-14' +author: Michael Haag, Splunk +status: experimental +type: Hunting +data_source: [] +description: The following hunting query utilizes a PowerShell Scripted input that captures the bootloader paths for each Windows endpoint it is deployed to. The template inputs.conf is located in the references link. + By default, it only captures the path, but may be modified to capture everything that BCDedit provides. It can be verbose, but may be worth it. +search: '`bootloader_inventory` | stats count min(_time) as firstTime max(_time) + as lastTime values(_raw) by host | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_bootloader_inventory_filter`' +how_to_implement: To implement this analytic, a new stanza will need to be added to a inputs.conf and deployed to all or some Windows endpoints. https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707 provides the stanza. If modifying the sourcetype, be sure to update the Macro for this analytic. Recommend running it daily, or weekly, depending on threat model. +known_false_positives: No false positives here, only bootloaders. Filter as needed or create a lookup as a baseline. +references: + - https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707 + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ +tags: + analytic_story: + - BlackLotus Campaign + asset_type: Endpoint + atomic_guid: [] + confidence: 90 + impact: 90 + message: A list of BootLoaders are present on $dest$ + mitre_attack_id: + - T1542.001 + - T1542 + observable: + - name: host + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 81 + security_domain: endpoint \ No newline at end of file diff --git a/macros/bootloader_inventory.yml b/macros/bootloader_inventory.yml new file mode 100644 index 0000000000..51a7eb40bc --- /dev/null +++ b/macros/bootloader_inventory.yml @@ -0,0 +1,4 @@ +definition: sourcetype = PwSh:bootloader +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: bootloader_inventory \ No newline at end of file From 747bf67e8aade53406b0969fb7d718066541ed71 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 17 Apr 2023 15:18:40 -0600 Subject: [PATCH 4/6] I AM THE RDP --- .../windows_rdp_connection_successful.yml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 detections/endpoint/windows_rdp_connection_successful.yml diff --git a/detections/endpoint/windows_rdp_connection_successful.yml b/detections/endpoint/windows_rdp_connection_successful.yml new file mode 100644 index 0000000000..b431d6b81a --- /dev/null +++ b/detections/endpoint/windows_rdp_connection_successful.yml @@ -0,0 +1,51 @@ +name: Windows RDP Connection Successful +id: ceaed840-56b3-4a70-b8e1-d762b1c5c08c +version: 1 +date: '2023-04-17' +author: Michael Haag, Splunk +status: production +type: Hunting +data_source: +- 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' +description: The following analytic identifies successful remote desktop connections. Utilize this analytic to hunt for successful attempts. In addition, the query may be modified for EventCode=1148 to potentially identify failed attempts. In testing, 1148 would not generate based on a failed logon attempt. + Note this analytic requires enabling and a stanza in a inputs.conf. +search: 'index=win source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" EventCode=1149 + | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, Source_Network_Address, User, Message + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | rename ComputerName as dest | `windows_rdp_connection_successful_filter`' +how_to_implement: The following analyic requires the WIndows TerminalServices RemoteConnectionManager Operational log to be enabled and ingested into Splunk. For the inputs, review https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706. +known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter. +references: + - https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706 + - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 +tags: + analytic_story: + - Active Directory Lateral Movement + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + impact: 50 + message: A successful RDP connection on $dest$ occurred. + mitre_attack_id: + - T1563.002 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: Source_Network_Address + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/remoteconnectionmanager.log + source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational + sourcetype: wineventlog From cab29b15db6e16ffeefa252a911e8e1fe843ec74 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 18 Apr 2023 12:01:58 -0700 Subject: [PATCH 5/6] Update windows_rdp_connection_successful.yml --- detections/endpoint/windows_rdp_connection_successful.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/windows_rdp_connection_successful.yml b/detections/endpoint/windows_rdp_connection_successful.yml index b431d6b81a..345932f12d 100644 --- a/detections/endpoint/windows_rdp_connection_successful.yml +++ b/detections/endpoint/windows_rdp_connection_successful.yml @@ -5,8 +5,7 @@ date: '2023-04-17' author: Michael Haag, Splunk status: production type: Hunting -data_source: -- 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' +data_source: [] description: The following analytic identifies successful remote desktop connections. Utilize this analytic to hunt for successful attempts. In addition, the query may be modified for EventCode=1148 to potentially identify failed attempts. In testing, 1148 would not generate based on a failed logon attempt. Note this analytic requires enabling and a stanza in a inputs.conf. search: 'index=win source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" EventCode=1149 From 67f4155367409ea834272a3e112f340ade51b4b3 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 18 Apr 2023 13:17:55 -0600 Subject: [PATCH 6/6] the fox and the hen --- detections/endpoint/windows_rdp_connection_successful.yml | 4 ++-- macros/remoteconnectionmanager.yml | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 macros/remoteconnectionmanager.yml diff --git a/detections/endpoint/windows_rdp_connection_successful.yml b/detections/endpoint/windows_rdp_connection_successful.yml index 345932f12d..a883ad9b02 100644 --- a/detections/endpoint/windows_rdp_connection_successful.yml +++ b/detections/endpoint/windows_rdp_connection_successful.yml @@ -5,10 +5,10 @@ date: '2023-04-17' author: Michael Haag, Splunk status: production type: Hunting -data_source: [] +data_source: [] description: The following analytic identifies successful remote desktop connections. Utilize this analytic to hunt for successful attempts. In addition, the query may be modified for EventCode=1148 to potentially identify failed attempts. In testing, 1148 would not generate based on a failed logon attempt. Note this analytic requires enabling and a stanza in a inputs.conf. -search: 'index=win source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" EventCode=1149 +search: '`remoteconnectionmanager` EventCode=1149 | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, Source_Network_Address, User, Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename ComputerName as dest | `windows_rdp_connection_successful_filter`' diff --git a/macros/remoteconnectionmanager.yml b/macros/remoteconnectionmanager.yml new file mode 100644 index 0000000000..325ecd2e01 --- /dev/null +++ b/macros/remoteconnectionmanager.yml @@ -0,0 +1,4 @@ +definition: source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: remoteconnectionmanager \ No newline at end of file