From 37d0a8b7bdf93992f765db974aa044478db972d1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 29 Apr 2022 12:06:55 +0200 Subject: [PATCH 1/8] cyclopsblink_fix --- .../linux_iptables_firewall_modification.yml | 13 +++++---- ...rker_process_in_writable_process_path.yml} | 29 ++++++++++--------- ...process_in_writable_process_path.test.yml} | 6 ++-- 3 files changed, 26 insertions(+), 22 deletions(-) rename detections/endpoint/{linux_kworker_process_commandline.yml => linux_kworker_process_in_writable_process_path.yml} (73%) rename tests/endpoint/{linux_kworker_process_commandline.test.yml => linux_kworker_process_in_writable_process_path.test.yml} (66%) diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 7916b932c9..d972ad0835 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 1 -date: '2022-04-05' +version: 2 +date: '2022-04-30' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -10,12 +10,13 @@ description: This analytic looks for suspicious commandline that modify the ipta This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid Processes.dest Processes.user Processes.parent_process_name + where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "* tcp *" + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name + | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/linux_kworker_process_commandline.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml similarity index 73% rename from detections/endpoint/linux_kworker_process_commandline.yml rename to detections/endpoint/linux_kworker_process_in_writable_process_path.yml index 262de4698b..2dbca5bb57 100644 --- a/detections/endpoint/linux_kworker_process_commandline.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -1,23 +1,24 @@ -name: Linux Kworker Process CommandLine +name: Linux Kworker Process In Writable Process Path id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed -version: 1 -date: '2022-04-05' +version: 2 +date: '2022-04-30' author: Teoderick Contreras, Splunk -type: TTP +type: Hunting datamodel: - Endpoint description: This analytic looks for suspicious process kworker commandline in a linux machine. - kworker process name or thread are common name of kernel thread in linux process. So it is really a suspicious event a normal user process - contain this process commandline. This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal + kworker process name or thread are common name of kernel thread in linux process. This hunting detections can lead to investigate process + contains process path in writable directory in linux like /home/, /var/log and /tmp/. + This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*[kworker/*" OR Processes.parent_process = "*[kworker/*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_kworker_process_commandline_filter`' + | `security_content_ctime(lastTime)` + | `linux_kworker_process_in_writable_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -34,13 +35,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 80 + confidence: 60 context: - Source:Endpoint - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation message: a $process_name$ with kworker commandline in $dest$ @@ -67,5 +68,7 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 64 + - Processes.parent_process_path + - Processes.process_path + risk_score: 36 security_domain: endpoint diff --git a/tests/endpoint/linux_kworker_process_commandline.test.yml b/tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml similarity index 66% rename from tests/endpoint/linux_kworker_process_commandline.test.yml rename to tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml index 5dac30017f..0300f1c3d1 100644 --- a/tests/endpoint/linux_kworker_process_commandline.test.yml +++ b/tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml @@ -1,7 +1,7 @@ -name: Linux Kworker Process CommandLine Unit Test +name: Linux Kworker Process In Writable Process Unit Test tests: -- name: Linux Kworker Process CommandLine - file: endpoint/linux_kworker_process_commandline.yml +- name: Linux Kworker Process In Writable Process + file: endpoint/linux_kworker_process_in_writable_process_path.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 8c334270d838c00e455b00fcdcc14d2275267344 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 29 Apr 2022 12:11:29 +0200 Subject: [PATCH 2/8] cyclopsblink_fix --- .../linux_kworker_process_in_writable_process_path.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index 2dbca5bb57..ea3ad76690 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -7,10 +7,12 @@ type: Hunting datamodel: - Endpoint description: This analytic looks for suspicious process kworker commandline in a linux machine. - kworker process name or thread are common name of kernel thread in linux process. This hunting detections can lead to investigate process - contains process path in writable directory in linux like /home/, /var/log and /tmp/. - This technique was seen in cyclopsblink malware to blend its core and other of its child process as normal - kworker on the compromised machine. This detection might be a good pivot to look for other IOC related to cyclopsblink malware or attacks. + kworker process name or thread are common names of kernel threads in linux process. + This hunting detections can lead to investigate process contains process path in + writable directory in linux like /home/, /var/log and /tmp/. This technique was seen + in cyclopsblink malware to blend its core and other of its child process as normal + kworker on the compromised machine. This detection might be a good pivot to look for + other IOC related to cyclopsblink malware or attacks. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path From 87603878f8c7019c98d1788610b29b9fe7277bd6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 29 Apr 2022 15:39:41 +0200 Subject: [PATCH 3/8] Update linux_kworker_process_in_writable_process_path.test.yml --- .../linux_kworker_process_in_writable_process_path.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml b/tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml index 0300f1c3d1..ade29c2d35 100644 --- a/tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml +++ b/tests/endpoint/linux_kworker_process_in_writable_process_path.test.yml @@ -1,6 +1,6 @@ -name: Linux Kworker Process In Writable Process Unit Test +name: Linux Kworker Process In Writable Process Path Unit Test tests: -- name: Linux Kworker Process In Writable Process +- name: Linux Kworker Process In Writable Process Path file: endpoint/linux_kworker_process_in_writable_process_path.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h From 0785cb279f161ef2462462711092f312c703cfaf Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 29 Apr 2022 16:09:09 +0200 Subject: [PATCH 4/8] Update linux_iptables_firewall_modification.yml --- .../endpoint/linux_iptables_firewall_modification.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index d972ad0835..9a9d29c2c8 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -3,7 +3,7 @@ id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 version: 2 date: '2022-04-30' author: Teoderick Contreras, Splunk -type: Anomaly +type: Hunting datamodel: - Endpoint description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. @@ -35,13 +35,13 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 70 + confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - impact: 70 + impact: 50 kill_chain_phases: - Exploitation message: A commandline $process$ that may modify iptables firewall on $dest$ @@ -68,5 +68,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 49 + risk_score: 25 security_domain: endpoint From 0d9944051f895b02bf4fb96b224a02d1c7b0db88 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 29 Apr 2022 17:02:50 +0200 Subject: [PATCH 5/8] Update linux_iptables_firewall_modification.yml --- .../endpoint/linux_iptables_firewall_modification.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 9a9d29c2c8..7e32f00f97 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -10,10 +10,12 @@ description: This analytic looks for suspicious commandline that modify the ipta This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "* tcp *" - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name + where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" + AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest + Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user | where port_count >=3 + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From a1ad406a56fb827d8ac675564687f40ced8a73f0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 29 Apr 2022 17:10:53 +0200 Subject: [PATCH 6/8] Update linux_iptables_firewall_modification.yml --- detections/endpoint/linux_iptables_firewall_modification.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 7e32f00f97..f328965114 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -15,7 +15,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids + dc(port) as port_count count + by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user + Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 6194e9075d02541ef7f3f1899febca9b95bc3508 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 29 Apr 2022 17:40:36 +0200 Subject: [PATCH 7/8] Update linux_iptables_firewall_modification.yml --- .../endpoint/linux_iptables_firewall_modification.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index f328965114..06df72a3bd 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -3,22 +3,19 @@ id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 version: 2 date: '2022-04-30' author: Teoderick Contreras, Splunk -type: Hunting +type: Anomaly datamodel: - Endpoint description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" + where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids - dc(port) as port_count count - by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user - Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 1106c798a3ab2b0a3ae2448c5d1a8bb1607954ca Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 29 Apr 2022 17:47:59 +0200 Subject: [PATCH 8/8] cyclopsblink_fix --- .../endpoint/linux_stdout_redirection_to_dev_null_file.yml | 0 .../endpoint/linux_stdout_redirection_to_dev_null_file.test.yml | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename detections/{ => experimental}/endpoint/linux_stdout_redirection_to_dev_null_file.yml (100%) rename tests/{ => experimental}/endpoint/linux_stdout_redirection_to_dev_null_file.test.yml (100%) diff --git a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml similarity index 100% rename from detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml rename to detections/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.yml diff --git a/tests/endpoint/linux_stdout_redirection_to_dev_null_file.test.yml b/tests/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.test.yml similarity index 100% rename from tests/endpoint/linux_stdout_redirection_to_dev_null_file.test.yml rename to tests/experimental/endpoint/linux_stdout_redirection_to_dev_null_file.test.yml