diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml index fbd9951d54..2113d6e6d9 100644 --- a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml +++ b/detections/application/detect_risky_spl_using_pretrained_ml_model.yml @@ -5,16 +5,31 @@ date: '2022-06-16' author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk type: Anomaly datamodel: -- Splunk_Audit -description: 'The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.' -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. \" \" .'Search_Activity.user'. \" \" .'Search_Activity.search_type'| dedup spl_text -| apply risky_spl_pre_trained_model -| where risk_score > 0.5 -| `drop_dm_object_name(Search_Activity)` -| table search, user, search_type, risk_score -| `detect_risky_spl_using_pretrained_ml_model_filter`" -how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb. -known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. +- Splunk_Audit.Search_Activity +description: The following analytic uses a pretrained machine learning text classifier + to detect potentially risky commands. The model is trained independently and then + the model file is packaged within ESCU for usage. A command is deemed risky based + on the presence of certain trigger keywords, along with the context and the role + of the user (please see references). The model uses custom features to predict whether + a SPL is risky using text classification. The model takes as input the command text, + user and search type and outputs a risk score between [0,1]. A high score indicates + higher likelihood of a command being risky. This model is on-prem only. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc + Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user + Search_Activity.search_type | eval spl_text = ''Search_Activity.search''. " " .''Search_Activity.user''. + " " .''Search_Activity.search_type''| dedup spl_text | apply risky_spl_pre_trained_model + | where risk_score > ''0.5'' | `drop_dm_object_name(Search_Activity)` | table search, + user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`' +how_to_implement: This detection depends on the MLTK app which can be found here - + https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can + be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need + to be ingesting logs which include Search_Activity.search, Search_Activity.user, + Search_Activity.search_type from your endpoints. The risk score threshold should + be adjusted based on the environment. The detection uses a custom MLTK model hence + we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb. +known_false_positives: False positives may be present if suspicious behavior is observed, + as determined by frequent usage of risky keywords. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning tags: @@ -50,9 +65,8 @@ tags: - Splunk Cloud required_fields: - _time - - Search_Activity.search - - Search_Activity.user + - Search_Activity.search + - Search_Activity.user - Search_Activity.search_type risk_score: 20 security_domain: audit - diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 02c70d4444..1f30e62757 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -5,7 +5,7 @@ date: '2020-09-04' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for new commands from each user role. search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index e99c1c49e5..baf219e537 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -5,7 +5,7 @@ date: '2021-07-13' author: Rico Valdez, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud compute instances created by users who have not created them before. search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index e96e2311c8..40d7dba879 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -5,18 +5,18 @@ date: '2020-09-02' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created. search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) - as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region, - All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions - vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats - max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) - | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), - "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)` - | `cloud_compute_instance_created_in_previously_unused_region_filter`' + as dest, count from datamodel=Change.All_Changes where All_Changes.action=created + by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` + | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW + firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where + enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) + OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user, + dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`' how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 898d28937b..a8f7590622 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -5,7 +5,7 @@ date: '2020-07-29' author: Rico Valdez, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud instances being modified by users who have not previously modified them. search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index 47915d5b1b..70c5b3d0b4 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -5,7 +5,7 @@ date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something. diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index 8404779ef7..37c27e0c48 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -5,7 +5,7 @@ date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something. diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index cbcdabd898..39bb877ad9 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -5,14 +5,14 @@ date: '2020-08-16' author: Rico Valdez, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something. search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) - as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) - All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command - | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources + as object_id from datamodel=Change.All_Changes where (All_Changes.action=started + OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, + All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 62a7ce39ca..e69349812e 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -5,7 +5,7 @@ date: '2020-08-16' author: Rico Valdez, Bhavin Patel, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something. diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index e101bc6196..4e84fad189 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -5,7 +5,7 @@ date: '2022-05-10' author: Rico Valdez, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 1b42b9cbae..c0b166eac2 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -5,7 +5,7 @@ date: '2020-10-07' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 001715f190..ed5c785861 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -5,7 +5,7 @@ date: '2020-10-07' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 4d5f1c7667..90b7137396 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -5,7 +5,7 @@ date: '2020-10-07' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index 59f9728be9..a6fb4487d9 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -5,7 +5,7 @@ date: '2021-08-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious 7z process with commandline pointing to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. This search diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 664e37c811..a7b3da131f 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -5,7 +5,8 @@ date: '2021-09-16' author: Michael Haag, Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: The search looks for a batch file (.bat) written to the Windows system directory tree. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 0952d31305..6935599868 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -5,7 +5,7 @@ date: '2021-09-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index a43bdf170e..4f39299925 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -5,7 +5,7 @@ date: '2020-12-21' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 307e045316..157fc7de60 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index f1b6f78e05..3b942af6d7 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 6bbe7450e2..11c5f1e567 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -5,7 +5,7 @@ date: '2022-02-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index a1ac0e1293..247869f140 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -5,7 +5,7 @@ date: '2022-02-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 844968479d..56c2bbae60 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -5,14 +5,15 @@ date: '2022-07-15' author: Rod Soto, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="certutil.exe" Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="certutil.exe" + Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -21,8 +22,8 @@ known_false_positives: Unless there are specific use cases, manipulating or expo certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. references: - - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack - - https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html +- https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack +- https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html tags: analytic_story: - Windows Persistence Techniques diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 1fe6d13c13..47cd6e48b9 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -5,7 +5,7 @@ date: '2021-03-23' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 34c1cdecce..172294dab7 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -5,7 +5,7 @@ date: '2021-09-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, @@ -31,7 +31,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index 2de0a32604..0c2d507076 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -5,7 +5,7 @@ date: '2021-09-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index da1754878e..213d98e26c 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -5,7 +5,7 @@ date: '2021-07-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect execution of chcp.exe application. this utility is used to change the active code page of the console. This technique was seen in icedid malware to know the locale region/language/country of the compromise host. diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 73b14c9448..03d29718f6 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -5,7 +5,7 @@ date: '2021-09-15' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index 7d7a62ddb5..65e01092c6 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index ba8b92a48e..79665bbef6 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -5,7 +5,7 @@ date: '2021-03-17' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index 6fd13099f6..018ca17bd2 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-17' author: Teoderick Contreras type: TTP -datamodel: -- Endpoint +datamodel: [] description: This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 37830f5cf9..3945ae5d65 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -5,7 +5,7 @@ date: '2022-01-18' author: Teoderick Contreras, Bhavin Patel, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies command-line arguments where `cmd.exe /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and terminate after command or process completion. This technique is commonly seen in diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 66fb2b7243..42672199f5 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -5,7 +5,7 @@ date: '2021-05-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index c8f69706d3..e8bd99193a 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a non-standard parent process (not matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index 3bce2a6ac9..a1a6bb1854 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-13' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8b87759b90..8a148c6b89 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -5,7 +5,7 @@ date: '2020-11-09' author: David Dorsey, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for file modifications with extensions commonly used by Ransomware search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index b2ec69afa8..55bc19dcc2 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -5,7 +5,7 @@ date: '2020-11-09' author: David Dorsey, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 5ee2f9bb2b..ebcdbcc070 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -5,7 +5,7 @@ date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 4c7508f84d..858a068b67 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index f1051d92fc..e68335058d 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -5,17 +5,18 @@ date: '2021-09-08' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the creation of local administrator accounts using net.exe . search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process="*/add*" AND (Processes.process="*administrators*" - OR Processes.process="*administratoren*" OR Processes.process="*administrateurs*" OR - Processes.process="*administrador*" OR Processes.process="*amministratori*" OR Processes.process="*administratorer*") - by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`' + OR Processes.process="*administratoren*" OR Processes.process="*administrateurs*" + OR Processes.process="*administrador*" OR Processes.process="*amministratori*" OR + Processes.process="*administratorer*") by Processes.process Processes.process_name + Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 3826c9058d..6c1d9a9e93 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -5,7 +5,7 @@ date: '2020-09-16' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the creation or deletion of hidden shares using net.exe. search: '| tstats `security_content_summariesonly` count values(Processes.user) as diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 68eeea1233..582856f2d3 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-04' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect suspicious process injection in command shell. This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as banking trojan. It is really uncommon to have diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index e77d85045e..5cf4f568d6 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -5,16 +5,16 @@ date: '2019-12-10' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="vssadmin.exe" Processes.process="*create*" Processes.process="*shadow*") OR (Processes.process_name="wmic.exe" - Processes.process="*shadowcopy*" Processes.process="*create*") by Processes.dest Processes.user - Processes.process_name Processes.process Processes.parent_process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`' + Processes.process="*shadowcopy*" Processes.process="*create*") by Processes.dest + Processes.user Processes.process_name Processes.process Processes.parent_process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`' how_to_implement: You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 8abe81f2cd..568ffc3018 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects the use of wmic and Powershell to create a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index c8f3ff0337..55c4c6a094 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects credential dumping using copy command from a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 5768e0cb28..948e4fba2d 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects the creation of a symlink to a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink* diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml index 1634467345..e9373611c9 100644 --- a/detections/endpoint/csc_net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: this analytic is to detect a suspicious compile before delivery approach of .net compiler csc.exe. This technique was seen in several adversaries, malware and even in red teams to take advantage the csc.exe .net compiler tool to compile diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 17141a0adf..e05d3b4d86 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -5,7 +5,7 @@ date: '2021-12-10' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of curl on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index df1edaec4a..d712f79aaa 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -4,18 +4,16 @@ version: 2 date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. -search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*" - OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime - by Opcode Computer - UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `delete_shadowcopy_with_powershell_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText + = "*Delete*" OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime + max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 4598166d2f..3df4911e21 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 015155d4a8..308bbc2671 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -5,7 +5,7 @@ date: '2020-11-09' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index 8ecfc9d133..d02eeef7c4 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-06-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index f0f0dd93d0..0eaf20cd7e 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -5,7 +5,7 @@ date: '2021-06-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 104bd72ffd..e17825e825 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -5,7 +5,8 @@ date: '2021-10-05' author: Michael Haag, Shannon Davis, David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 7605c94c64..0633ea2812 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -5,7 +5,7 @@ date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -18,10 +18,11 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="hh.exe" AND Processes.original_file_name="HH.EXE" by Processes.dest - Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="hh.exe" + AND Processes.original_file_name="HH.EXE" by Processes.dest Processes.user Processes.parent_process_name + Processes.original_file_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index dfdabd7579..e328b4eb82 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -5,7 +5,7 @@ date: '2021-02-11' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 1772887629..642065ef16 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 7c1a5b5be0..5a112848e3 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index a27bb49389..e5d0b567d2 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Bhavin Patel, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 976d4380b8..359a1fc8f0 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -5,18 +5,18 @@ date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="mshta.exe" AND Processes.original_file_name="MSHTA.EXE" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.original_file_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_mshta_renamed_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name!="mshta.exe" + AND Processes.original_file_name="MSHTA.EXE" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 983ee69118..61623d7df4 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 3bea8d41bd..c8a5cc337a 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -5,7 +5,7 @@ date: '2020-07-03' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. ' diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index 8c053501e0..05c7cb858f 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -5,7 +5,7 @@ date: '2020-11-10' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for fast execution of processes used for system network configuration discovery on the endpoint. search: '| tstats `security_content_summariesonly` count values(Processes.process) diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index 7bfc7e0231..cc862275db 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -5,7 +5,7 @@ date: '2020-11-10' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. search: '| tstats `security_content_summariesonly` count values(Processes.process) diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 0e9d243b3a..d5dd5018b8 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 37048de5ad..f5dcb13b65 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -5,7 +5,7 @@ date: '2021-11-29' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index 494d0a4c5d..39fe10392b 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-02-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 751a1a8394..6eb8f4dfab 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index c8d269f8a1..1f2d9b181d 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-02-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index db0dfe8598..ff42c84059 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 4431ef3dac..599416ec37 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -5,7 +5,7 @@ date: '2021-01-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 097405a9c1..d5c9854073 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 65b5117576..16ee0e7af7 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -5,17 +5,18 @@ date: '2022-04-07' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. During triage, validate this is the legitimate version of `PsExec` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!="psexec.exe" OR Processes.process_name!="psexec64.exe") AND Processes.original_file_name="psexec.c" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.original_file_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!="psexec.exe" + OR Processes.process_name!="psexec64.exe") AND Processes.original_file_name="psexec.c" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_psexec_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 90eca600d7..0d6c08c70f 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -4,8 +4,8 @@ version: 2 date: '2021-09-16' author: Michael Haag, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: +- Endpoint.Processes description: The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index cd8e725e9b..02ef0574f4 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 916d615608..08099dd850 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -5,7 +5,7 @@ date: '2021-02-04' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 5baa5324b6..72cb2ca24e 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -5,7 +5,7 @@ date: '2021-02-04' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 4e207fb56c..68d8041c0c 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -5,7 +5,7 @@ date: '2021-02-04' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index b11e5a90bb..7a14c0de68 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -5,7 +5,7 @@ date: '2021-01-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index e45fc40419..d96221aca6 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-06-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index e220634ee9..f159c2cff6 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -5,7 +5,7 @@ date: '2021-05-27' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 1a886651a8..52da8d0547 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -5,7 +5,7 @@ date: '2021-05-27' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 5b1abc1f5c..935f8b1e27 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 7002c61662..235810007d 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 4aace03422..5d7d0586bf 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 67493e64e5..bad3cc219b 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 51543a90d4..af46419f68 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 15558e4857..0c8c01810a 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index d50493ac2d..56891ae80d 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index dc17013676..e5415672d0 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index bd0cb4a173..758346d3bf 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 39ac75511a..4360541116 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index f103d447f3..4af2a7993c 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 1dfe6d11e3..d7eb9717e2 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -5,7 +5,7 @@ date: '2021-10-18' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. @@ -14,10 +14,10 @@ description: This analytic is to detect a suspicious commandline to disable exis is disabled. parent child process is quite valuable in this scenario too. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="schtasks.exe" - Processes.process="*/change*" Processes.process="*/disable*" by Processes.user Processes.process_name - Processes.process Processes.parent_process_name Processes.parent_process Processes.dest - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `disable_schedule_task_filter`' + Processes.process="*/change*" Processes.process="*/disable*" by Processes.user + Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process + Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disable_schedule_task_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index cfe318454b..607328ff31 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index a1c0aabf8a..366abbb894 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 7274da1be8..e008d4faed 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 17512b19ff..c95cd6c616 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 7a3bca8c50..724bc718cf 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 1ec1b145e4..780ea18ba2 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 6ea9d3374a..d57c3e214f 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 1784fcf94e..82f61b471c 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 9194625692..97d3f36de4 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 64d2057372..aa40d60659 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -5,7 +5,7 @@ date: '2021-03-31' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 362e10f41e..ee762d646c 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index 0860d02134..4cabfc1048 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index dd31cbbe30..6e7903608d 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 3736b1281d..93a7d9378c 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -5,7 +5,7 @@ date: '2020-11-18' author: David Dorsey, Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 552d04ef06..dcb823c303 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 3c65b3339d..6969d497da 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index c4711550f5..7080dcaa26 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -5,7 +5,8 @@ date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Network_Traffic.All_Traffic description: The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, @@ -17,10 +18,10 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] - | table _time dest parent_process_name process_name process_path process process_id dest_port C2 - | `dllhost_with_no_command_line_arguments_with_network_filter`' + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != + 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` + | rename dest as C2 ] | table _time dest parent_process_name process_name process_path + process process_id dest_port C2 | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 48d6aa3ef3..5c0a52c2bb 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -5,7 +5,7 @@ date: '2021-04-15' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index c0b5b7a180..4c9c9859ef 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index 1e5d8d10c2..6bc72161ee 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 9252a2c6a3..abd790a0ed 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index a6cc699a08..a24d86fddf 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -5,7 +5,7 @@ date: '2021-08-30' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml index 7fa60f07c1..13e0e0d6d8 100644 --- a/detections/endpoint/domain_controller_discovery_with_wmic.yml +++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 5a2dd322b1..45423d39be 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index 3dc044760e..ba297be7b8 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index a175fb1f0a..91784c9b78 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 4fdb3cb0f4..b6dabcf243 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index 5f354529b2..6b93fb9458 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-30' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 1d8f6f6ea3..e1974db7e1 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -5,7 +5,7 @@ date: '2021-03-31' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 84b2873c69..61ea979db0 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -5,7 +5,7 @@ date: '2020-02-21' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Detect the usage of comsvcs.dll for dumping the lsass process. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process="*comsvcs.dll*" diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 42f12b5b6e..11ae00a22c 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index 4efca48be1..309ba611e9 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index e128f2b67a..4569ce7591 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 897386f6a7..5c8b209180 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 828b657127..27cb50737a 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index e020a18b9a..541a55bbe6 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index 53b132d169..40151b9990 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -5,7 +5,7 @@ date: '2021-08-18' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, review parallel processes and determine if legitimate activity. Upon determination diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 56af0e84d8..927b6f578b 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. @@ -38,7 +39,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 691b33b0c9..8f482fed3a 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index f2fa91c94d..1ade4315a8 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index d8eaaed74c..1d8053c4c6 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index f0be24f660..43d46d6810 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the diff --git a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml index 0b98699990..062715fb9f 100644 --- a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml +++ b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml @@ -5,7 +5,7 @@ date: '2022-02-28' author: Michael Hart, Mauricio Velazco, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index 4cf1f4553a..0b3dbc9474 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-01-20' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify excessive file deletion events in the Windows Defender folder. This technique was seen in the WhisperGate malware campaign in which adversaries abused Nirsofts advancedrun.exe to gain administrative privilege diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 2a7d63bfbb..552295e306 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -5,7 +5,7 @@ date: '2021-06-25' author: Michael Hart, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 40b1df3cd6..946aa74e69 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -5,7 +5,7 @@ date: '2021-06-07' author: Michael Hart type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index e56cda6396..4f12a08142 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 8e9522442c..6fa6325b74 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -5,7 +5,7 @@ date: '2021-05-07' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application to change file or folder permission. This behavior is commonly seen where the adversary attempts to impair some users from deleting or diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index cb8852cdb9..da40fe77d5 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -5,7 +5,7 @@ date: '2021-05-06' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies excessive usage of `net.exe` or `net1.exe` within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 3365a1cd69..5ae70dd796 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -4,24 +4,19 @@ version: 2 date: '2022-06-03' author: Teoderick Contreras, Stanislav Miskovic, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" - | bucket _time span=1m - | stats count as numNsLookup by Computer, _time - | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer - | eval upperThreshold=(avgNsLookup + stdNsLookup *3) - | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) - | search isOutlier=1 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=1m + | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as + avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | + eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(numNsLookup + > 20 and numNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 63dfe423c4..4a0678a73a 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-24' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 22c82d5e96..46e136e72e 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection. diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 3a16602257..13e47e6a2b 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -5,21 +5,20 @@ date: '2021-05-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts. search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", - "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", - "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", + "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", + "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", - "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `executables_or_script_creation_in_suspicious_path_filter`' + "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*") by Filesystem.file_create_time + Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 08feb0db3b..dd1c9f8140 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -5,7 +5,7 @@ date: '2021-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 95a3c1c32f..2de7850503 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -5,7 +5,7 @@ date: '2020-11-18' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed @@ -13,8 +13,8 @@ description: This search looks for processes launched from files that have doubl search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*.doc.exe" OR Processes.process = "*.htm.exe" OR Processes.process = "*.html.exe" OR Processes.process - = "*.txt.exe" OR Processes.process = "*.pdf.exe" OR Processes.process = "*.doc.exe" by - Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)` + = "*.txt.exe" OR Processes.process = "*.pdf.exe" OR Processes.process = "*.doc.exe" + by Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index 9c32749838..12a9ee945f 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -5,7 +5,7 @@ date: '2021-09-09' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 3526d02181..3d99abdd5b 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -5,7 +5,7 @@ date: '2018-12-14' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for file writes with extensions consistent with a SamSam ransomware attack. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index c20a9a07e1..299027a4d7 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic detects a potential suspicious modification of firewall rule allowing to execute specific application. This technique was identified when an adversary and red teams to bypassed firewall file execution restriction in a @@ -13,8 +13,8 @@ description: This analytic detects a potential suspicious modification of firewa testing or allowing legitimate tool or application. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" - Processes.process = "*allow*" Processes.process = "*add*" Processes.process - = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `firewall_allowed_program_enable_filter`' diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 3298b243be..01330608a5 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -5,7 +5,7 @@ date: '2021-03-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific registry keys upon execution, that do not exist. Therefore, an attacker can write its malicious commands in these registry keys to be executed by fodhelper.exe with diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index a7e44dd798..7478c777e5 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -5,7 +5,7 @@ date: '2021-08-11' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index c42aaecb4c..d89fe7f3f3 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index c4562f9a25..efa6ff1694 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index f0149891cd..b0a1bd6dfd 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 606737adb9..2865b0181a 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index f129d1717d..7d0671057c 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index a05c50b403..c445867daf 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 70dd718d8c..fa3966ccc4 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-02' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index ddad5b666c..d3a3a6d3b2 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml index 880b082e60..3f1a8f0d25 100644 --- a/detections/endpoint/getadcomputer_with_powershell.yml +++ b/detections/endpoint/getadcomputer_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index f2553b34bc..423f38d2f4 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index a1662b88c5..e1a1d49299 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml index 3fe6502b92..3ca3f8e239 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 3bfcab7965..a3df98aab1 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 52c661ebb2..6a2393f642 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 9536638619..3e0077c1bc 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-23' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml index bf756cc946..bedb3e8dbd 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index c6ba6a4b29..0bb5395c02 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index 09e61947f0..acdddb6000 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 8a6308afe6..041e349d87 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 2df30b1ba7..c42505c121 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-23' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index e07b4e1754..ea69069a9d 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -5,7 +5,8 @@ date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Network_Traffic.All_Traffic description: The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious @@ -18,10 +19,10 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] - | table _time dest parent_process_name process_name process_path process process_id dest_port C2 - | `gpupdate_with_no_command_line_arguments_with_network_filter`' + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != + 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` + | rename dest as C2 ] | table _time dest parent_process_name process_name process_path + process process_id dest_port C2 | `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 7f24e93935..2e40acdede 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index bb5794dec8..c1da84a6f7 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index ddac60620c..97c9d774b6 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-16' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytic is to detect a suspicious high frequency copying/moving of files in network share as part of information sabotage. This anomaly event can be a good indicator of insider trying to sabotage data by transfering classified diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index b204013bde..51a164e75d 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-16' author: Teoderick Contreras type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml index 0e494eaccd..3c4fa14b4e 100644 --- a/detections/endpoint/hunting_for_log4shell.yml +++ b/detections/endpoint/hunting_for_log4shell.yml @@ -5,7 +5,7 @@ date: '2021-12-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Web +- Web.Web description: 'The following hunting query assists with quickly assessing CVE-2021-44228, or Log4Shell, activity mapped to the Web Datamodel. This is a combination query attempting to identify, score and dashboard. Because the Log4Shell vulnerability diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 8cca9b176b..1d969504f8 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -5,7 +5,7 @@ date: '2021-04-29' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index cbe31702f3..3602be7453 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index a183c225cd..a87d49926e 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-30' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 0ef2da8938..12d6004458 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -5,7 +5,7 @@ date: '2022-01-18' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the presence of suspicious commandline parameters typically present when using Impacket tools. Impacket is a collection of python classes meant to be used with Microsoft network protocols. There are multiple scripts diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml index b419b77c99..d442d567ab 100644 --- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml +++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml @@ -5,14 +5,14 @@ date: '2021-12-13' author: Michael Haag, Splunk type: TTP datamodel: -- Web +- Web.Web description: The following analytic identifies a Java user agent performing a GET request for a .class file from the remote site. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). -search: '| tstats count from datamodel=Web where Web.http_user_agent="*Java*" Web.http_method="GET" - Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length - Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` +search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" + Web.http_method="GET" Web.url="*.class*" by Web.http_user_agent Web.http_method, + Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`' how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index d190e1b7af..3e49692554 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -5,21 +5,30 @@ date: '2022-06-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. - Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe") - by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid - Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats - `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where - Filesystem.file_name="*.jsp*" by _time Filesystem.dest Filesystem.file_create_time +- Endpoint.Filesystem +- Endpoint.Processes +description: The following analytic identifies the process java writing a .jsp to + disk. This is potentially indicative of a web shell being written to disk. Modify + and tune the analytic based on data ingested. For instance, it may be worth running + a broad query for jsp file writes first before performing a join. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.process_id + Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` + | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name="*.jsp*" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_writing_jsp_file_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment. + user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `java_writing_jsp_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` + node. In addition, confirm the latest CIM App 4.20 or higher is installed and the + latest TA for the endpoint product. +known_false_positives: False positives are possible and filtering may be required. + Restrict by assets or filter known jsp files that are common for the environment. references: - https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/ - https://github.com/TheGejr/SpringShell @@ -44,8 +53,8 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: An instance of $process_name$ was identified - on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation. + message: An instance of $process_name$ was identified on endpoint $dest$ writing + a jsp file to disk, potentially indicative of exploitation. mitre_attack_id: - T1190 nist: @@ -80,11 +89,11 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - - Filesystem.dest + - Filesystem.dest - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.file_path - - Filesystem.process_guid + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.process_guid - Filesystem.user risk_score: 42 security_domain: endpoint diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 7a0a6585a2..8ba7d64cf6 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index cf1a772082..0b36af96e8 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-04' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml index a6d9ced0e5..e573173b24 100644 --- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml @@ -5,25 +5,28 @@ date: '2022-04-12' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This analytic is to detect a deletion of ssh key in a linux machine. - attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine. - This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what - acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user - tries to delete this type of files which is not so common and need further investigation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted AND Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") - by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user - | `linux_account_manipulation_of_ssh_config_and_keys_filter`' + attacker may delete or modify ssh key to impair some security features or act as + defense evasion in compromised linux machine. This Anomaly can be also a good indicator + of a malware trying to wipe or delete several files in a compromised host as part + of its destructive payload like what acidrain malware does in linux or router machines. + This detection can be a good pivot to check what process and user tries to delete + this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted AND + Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by _time span=1h Filesystem.file_name + Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action | + `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid |join proc_guid, + _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.parent_process_name != unknown by _time span=1h Processes.process_id + Processes.process_name Processes.process Processes.dest Processes.parent_process_name + Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process + process_name process_path process proc_guid registry_path registry_value_name registry_value_data + registry_key_name action] | table process_name process proc_guid file_name file_path + action _time parent_process_name parent_process process_path dest user | `linux_account_manipulation_of_ssh_config_and_keys_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index 1313780fcd..d91b191336 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: The following analytic identifies a suspicious file creation in known cron table directories. This event is commonly abuse by malware, adversaries and red teamers to persist on the target or compromised host. crontab or cronjob is diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 653e6b0560..a44ec24a91 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for commands to create user accounts on the linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to persist on the targeted or compromised host by creating new user with diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml index 15196aad37..0293cef099 100644 --- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml +++ b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml @@ -5,18 +5,18 @@ date: '2022-04-22' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint -description: The following analytic identifies a suspicious cron jobs modification using crontab list parameters. - This command line parameter can be abused by malware like industroyer2, adversaries, and red teamers to add a - crontab entry to their malicious code to execute to the schedule they want. This event can also be executed by administrator - or normal user for automation purposes so filter is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "crontab" Processes.process= "* -l*" - by Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_adding_crontab_using_list_parameter_filter`' +- Endpoint.Processes +description: The following analytic identifies a suspicious cron jobs modification + using crontab list parameters. This command line parameter can be abused by malware + like industroyer2, adversaries, and red teamers to add a crontab entry to their + malicious code to execute to the schedule they want. This event can also be executed + by administrator or normal user for automation purposes so filter is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "crontab" + Processes.process= "* -l*" by Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_adding_crontab_using_list_parameter_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 12c13dfc3c..0e9f770e4a 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: The following analytic identifies a suspicious file creation of /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config files can restrict diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 8aadf11c46..b77155f777 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a suspicious process creation of At application. This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their malicious diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml index ea8315b0dc..620ff29dcd 100644 --- a/detections/endpoint/linux_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_change_file_owner_to_root.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for a commandline that change the file owner to root using chown utility tool. This technique is commonly abuse by adversaries, malware author and red teamers to escalate privilege to the targeted or compromised host diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index 2da48d919a..b2a557c82c 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -5,7 +5,7 @@ date: '2021-12-23' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index 7c20077758..295dbe8ba0 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -5,7 +5,7 @@ date: '2022-02-14' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability, services diff --git a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml index 7bd4f5126e..f32e2f7cf6 100644 --- a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml +++ b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml @@ -5,18 +5,20 @@ date: '2022-04-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies a suspicious deletion of a critical folder in Linux machine using rm command. - This technique was seen in industroyer2 campaign to wipe or destroy energy facilities of a targeted sector. Deletion in these list of folder - is not so common since it need some elevated privileges to access some of it. We recommend to look further events specially in file access or file deletion, - process commandline that may related to this technique. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name =rm AND Processes.process= "* -rf *" AND Processes.process IN ("*/boot/*", "*/var/log/*", "*/etc/*", "*/dev/*") - by Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_deleting_critical_directory_using_rm_command_filter`' +- Endpoint.Processes +description: The following analytic identifies a suspicious deletion of a critical + folder in Linux machine using rm command. This technique was seen in industroyer2 + campaign to wipe or destroy energy facilities of a targeted sector. Deletion in + these list of folder is not so common since it need some elevated privileges to + access some of it. We recommend to look further events specially in file access + or file deletion, process commandline that may related to this technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name =rm AND + Processes.process= "* -rf *" AND Processes.process IN ("*/boot/*", "*/var/log/*", + "*/etc/*", "*/dev/*") by Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_deleting_critical_directory_using_rm_command_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -45,7 +47,8 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: A deletion in known critical list of folder using rm command $process$ executed on $dest$ + message: A deletion in known critical list of folder using rm command $process$ + executed on $dest$ mitre_attack_id: - T1485 nist: diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index feb23356c2..df25d7f2e7 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -5,25 +5,29 @@ date: '2022-04-12' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a deletion of cron job in a linux machine. - This technique can be related to an attacker, threat actor or malware to disable scheduled cron jobs that might be related to security or - to evade some detections. We also saw that this technique can be a good indicator for malware that is trying to wipe or delete several files on the compromised host - like the acidrain malware. This anomaly detection can be a good pivot detection to look for process and user doing it why they doing. Take note that this event can be done - by administrator so filtering on those possible false positive event is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path ="/etc/cron.*" - by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user - | `linux_deletion_of_cron_jobs_filter`' +- Endpoint.Filesystem +- Endpoint.Processes +description: This analytic is to detect a deletion of cron job in a linux machine. + This technique can be related to an attacker, threat actor or malware to disable + scheduled cron jobs that might be related to security or to evade some detections. + We also saw that this technique can be a good indicator for malware that is trying + to wipe or delete several files on the compromised host like the acidrain malware. + This anomaly detection can be a good pivot detection to look for process and user + doing it why they doing. Take note that this event can be done by administrator + so filtering on those possible false positive event is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path + ="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename + process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time + dest user parent_process_name parent_process process_name process_path process proc_guid + registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name + parent_process process_path dest user | `linux_deletion_of_cron_jobs_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -31,7 +35,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - AcidRain diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index cee914c96d..415cb0cc04 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -5,26 +5,30 @@ date: '2022-04-12' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: This analytic is to detect a deletion of init daemon script in a linux machine. - daemon script that place in /etc/init.d/ is a directory that can start and stop some daemon services in linux machines. - attacker may delete or modify daemon script to impair some security features or act as defense evasion in a compromised linux machine. - This TTP can be also a good indicator of a malware trying to wipe or delete several files in compromised host as part of its destructive payload like what - acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user - tries to delete this type of files which is not so common and need further investigation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/init.d/*") - by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user - | `linux_deletion_of_init_daemon_script_filter`' +- Endpoint.Filesystem +- Endpoint.Processes +description: This analytic is to detect a deletion of init daemon script in a linux + machine. daemon script that place in /etc/init.d/ is a directory that can start + and stop some daemon services in linux machines. attacker may delete or modify daemon + script to impair some security features or act as defense evasion in a compromised + linux machine. This TTP can be also a good indicator of a malware trying to wipe + or delete several files in compromised host as part of its destructive payload like + what acidrain malware does in linux or router machines. This detection can be a + good pivot to check what process and user tries to delete this type of files which + is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path + IN ( "/etc/init.d/*") by _time span=1h Filesystem.file_name Filesystem.file_path + Filesystem.dest Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time + dest user parent_process_name parent_process process_name process_path process proc_guid + registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name + parent_process process_path dest user | `linux_deletion_of_init_daemon_script_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -32,7 +36,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - AcidRain diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 5b99f4d004..21d888dd65 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -5,25 +5,28 @@ date: '2022-04-12' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This analytic is to detect a deletion of services in a linux machine. - attacker may delete or modify services to impair some security features or act as defense evasion in a compromised linux machine. - This TTP can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what - acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user - tries to delete this type of files which is not so common and need further investigation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "/usr/lib/systemd/*") Filesystem.file_path = "*.service" - by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user - | `linux_deletion_of_services_filter`' + attacker may delete or modify services to impair some security features or act as + defense evasion in a compromised linux machine. This TTP can be also a good indicator + of a malware trying to wipe or delete several files in a compromised host as part + of its destructive payload like what acidrain malware does in linux or router machines. + This detection can be a good pivot to check what process and user tries to delete + this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path + IN ( "/etc/systemd/*", "/usr/lib/systemd/*") Filesystem.file_path = "*.service" + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid + Filesystem.action | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid + |join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.parent_process_name != unknown by _time span=1h Processes.process_id + Processes.process_name Processes.process Processes.dest Processes.parent_process_name + Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process + process_name process_path process proc_guid registry_path registry_value_name registry_value_data + registry_key_name action] | table process_name process proc_guid file_name file_path + action _time parent_process_name parent_process process_path dest user | `linux_deletion_of_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -31,7 +34,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - AcidRain diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index f90ac8ec8b..c6a4cd6c5a 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -5,25 +5,29 @@ date: '2022-04-12' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a deletion of ssl certificate in a linux machine. - attacker may delete or modify ssl certificate to impair some security features or act as defense evasion in compromised linux machine. - This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what - acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user - tries to delete this type of files which is not so common and need further investigation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") - by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user - | `linux_deletion_of_ssl_certificate_filter`' +- Endpoint.Filesystem +- Endpoint.Processes +description: This analytic is to detect a deletion of ssl certificate in a linux machine. + attacker may delete or modify ssl certificate to impair some security features or + act as defense evasion in compromised linux machine. This Anomaly can be also a + good indicator of a malware trying to wipe or delete several files in a compromised + host as part of its destructive payload like what acidrain malware does in linux + or router machines. This detection can be a good pivot to check what process and + user tries to delete this type of files which is not so common and need further + investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path + = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") by _time span=1h + Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid + Filesystem.action | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid + |join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.parent_process_name != unknown by _time span=1h Processes.process_id + Processes.process_name Processes.process Processes.dest Processes.parent_process_name + Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process + process_name process_path process proc_guid registry_path registry_value_name registry_value_data + registry_key_name action] | table process_name process proc_guid file_name file_path + action _time parent_process_name parent_process process_path dest user | `linux_deletion_of_ssl_certificate_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -31,7 +35,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - Acidrain @@ -83,4 +87,4 @@ tags: - Processes.process_id - Processes.parent_process_id risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/linux_disable_services.yml b/detections/endpoint/linux_disable_services.yml index 5893081854..39a388dfb9 100644 --- a/detections/endpoint/linux_disable_services.yml +++ b/detections/endpoint/linux_disable_services.yml @@ -5,18 +5,18 @@ date: '2022-04-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic is to detect events that attempts to disable a service. - This is typically identified in parallel with other instances of service enumeration of - attempts to stop a service and then delete it. Adversaries utilize this technique like industroyer2 - malware to terminate security services or other related services to continue there objective as a destructive payload. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name IN ("systemctl", "service", "svcadm") Processes.process = "* disable*" - by Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_disable_services_filter`' +- Endpoint.Processes +description: The following analytic is to detect events that attempts to disable a + service. This is typically identified in parallel with other instances of service + enumeration of attempts to stop a service and then delete it. Adversaries utilize + this technique like industroyer2 malware to terminate security services or other + related services to continue there objective as a destructive payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("systemctl", + "service", "svcadm") Processes.process = "* disable*" by Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_disable_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml index a4c824a395..ee5c5f9167 100644 --- a/detections/endpoint/linux_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -5,7 +5,7 @@ date: '2022-01-05' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic is to detect the creation of doas.conf file in linux host platform. This configuration file can be use by doas utility tool to allow or permit standard users to perform tasks as root, the same way sudo does. This tool is developed diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml index 5935355a28..361a1ca766 100644 --- a/detections/endpoint/linux_doas_tool_execution.yml +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -5,7 +5,7 @@ date: '2022-01-05' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does. This tool is developed as a minimalistic alternative to sudo application. diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index f57c71a39e..003703d784 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a suspicious cronjobs modification using crontab edit parameter. This commandline parameter can be abuse by malware author, adversaries, and red red teamers to add cronjob entry to their malicious diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml index b554277ada..1edf14e56f 100644 --- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml +++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation in kernel/driver directory in linux platform. This directory is known folder for all linux kernel module available within the system. so creation of file in this directory is a good indicator that diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index c315add12b..355e7f3e69 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation on init system directories for automatic execution of script or file upon boot up. This technique is commonly abuse by adversaries, malware author and red teamer to persist on the targeted or diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index 37777e4835..5977edffb6 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation in /etc/profile.d directory to automatically execute scripts by shell upon boot up of a linux machine. This technique is commonly abused by adversaries, malware and red teamers as a persistence diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index 97af6add1c..f9ec9a9f43 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -5,32 +5,35 @@ date: '2022-04-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: This analytic is to detect a high frequency of file deletion relative to process name and process id /boot/ folder. - These events was seen in industroyer2 wiper malware where it tries to delete all files in a critical directory in linux directory. - This detection already contains some filter that might cause false positive during our testing. -search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path = "/boot/*" - by _time span=1h Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", "/bin/rm", "*splunkd", "/usr/bin/mandb")) - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid action _time deletedFileNames deletedFilePath numOfDelFilePath parent_process_name parent_process process_path dest user - | where numOfDelFilePath >= 200 - | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`' +- Endpoint.Filesystem +- Endpoint.Processes +description: This analytic is to detect a high frequency of file deletion relative + to process name and process id /boot/ folder. These events was seen in industroyer2 + wiper malware where it tries to delete all files in a critical directory in linux + directory. This detection already contains some filter that might cause false positive + during our testing. +search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as + deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) + as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/boot/*" by _time span=1h Filesystem.dest + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename + process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", + "/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id + Processes.process_name Processes.process Processes.dest Processes.parent_process_name + Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process + process_name process_path process proc_guid registry_path registry_value_name registry_value_data + registry_key_name action] | table process_name process proc_guid action _time deletedFileNames + deletedFilePath numOfDelFilePath parent_process_name parent_process process_path + dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: linux package installer/uninstaller may cause this event. - Please update you filter macro to remove false positives. +known_false_positives: linux package installer/uninstaller may cause this event. Please + update you filter macro to remove false positives. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 0a1cf8a04a..c69067b907 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -5,34 +5,37 @@ date: '2022-04-12' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a high frequency of file deletion relative to process name and process id /etc/ folder. - These events was seen in acidrain wiper malware where it tries to delete all files in a non-standard directory in linux directory. - This detection already contains some filter that might cause false positive during our testing. But we recommend to add more filter if needed. -search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path = "/etc/*" - by _time span=1h Filesystem.dest Filesystem.process_guid Filesystem.action - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - |join proc_guid, _time [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", "/bin/rm", "*splunkd", "/usr/bin/mandb")) - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid action _time deletedFileNames deletedFilePath numOfDelFilePath parent_process_name parent_process process_path dest user - | where numOfDelFilePath >= 200 - | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' +- Endpoint.Filesystem +- Endpoint.Processes +description: This analytic is to detect a high frequency of file deletion relative + to process name and process id /etc/ folder. These events was seen in acidrain wiper + malware where it tries to delete all files in a non-standard directory in linux + directory. This detection already contains some filter that might cause false positive + during our testing. But we recommend to add more filter if needed. +search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as + deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) + as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/etc/*" by _time span=1h Filesystem.dest + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename + process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", + "/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id + Processes.process_name Processes.process Processes.dest Processes.parent_process_name + Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process + process_name process_path process proc_guid registry_path registry_value_name registry_value_data + registry_key_name action] | table process_name process proc_guid action _time deletedFileNames + deletedFilePath numOfDelFilePath parent_process_name parent_process process_path + dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: linux package installer/uninstaller may cause this event. - Please update you filter macro to remove false positives. +known_false_positives: linux package installer/uninstaller may cause this event. Please + update you filter macro to remove false positives. references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - AcidRain diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index 65721a9a8b..f1ba72bd1e 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for inserting of linux kernel module using insmod utility function. This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml index 78b36b25c8..5aa459c262 100644 --- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for possible installing a linux kernel module using modprobe utility function. This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index d5ee4e0533..9c41df187d 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -5,28 +5,30 @@ date: '2022-06-03' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. - This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow - traffic to its tcp port that will be used to communicate with its C2 server. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" - AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s - Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path - | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count - by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_iptables_firewall_modification_filter`' +- Endpoint.Processes +description: This analytic looks for suspicious commandline that modify the iptables + firewall setting of a linux machine. This technique was seen in cyclopsblink malware + where it modifies the firewall setting of the compromised machine to allow traffic + to its tcp port that will be used to communicate with its C2 server. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables + *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND + Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND + NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name Processes.parent_process_path + Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) + as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name + Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user + Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: administrator may do this commandline for auditing and testing purposes. - In this scenario filter is needed. +known_false_positives: administrator may do this commandline for auditing and testing + purposes. In this scenario filter is needed. references: - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index 186d6a47fc..a5ea926276 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -5,7 +5,7 @@ date: '2021-12-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the process name of Java, Apache, or Tomcat spawning a Linux shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index 0d82dbfbdc..6023cb8cdf 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -5,21 +5,21 @@ date: '2022-04-30' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint -description: This analytic looks for suspicious process kworker commandline in a linux machine. - kworker process name or thread are common names of kernel threads in linux process. - This hunting detections can lead to investigate process contains process path in - writable directory in linux like /home/, /var/log and /tmp/. This technique was seen - in cyclopsblink malware to blend its core and other of its child process as normal - kworker on the compromised machine. This detection might be a good pivot to look for - other IOC related to cyclopsblink malware or attacks. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path - Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +- Endpoint.Processes +description: This analytic looks for suspicious process kworker commandline in a linux + machine. kworker process name or thread are common names of kernel threads in linux + process. This hunting detections can lead to investigate process contains process + path in writable directory in linux like /home/, /var/log and /tmp/. This technique + was seen in cyclopsblink malware to blend its core and other of its child process + as normal kworker on the compromised machine. This detection might be a good pivot + to look for other IOC related to cyclopsblink malware or attacks. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = + "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") + Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_path Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_in_writable_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index f08ab010fc..6ebbcb77d4 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for suspicious command lines that may add entry to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml index a5dda31e5a..3c32eeba3b 100644 --- a/detections/endpoint/linux_pkexec_privilege_escalation.yml +++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml @@ -5,7 +5,7 @@ date: '2022-01-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `pkexec` spawning with no command-line arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 (PwnKit) which is present in the default configuration of all major Linux distributions diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml index a24fbd7d27..09e06bb54c 100644 --- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml @@ -5,7 +5,7 @@ date: '2022-01-11' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for suspicious process command-line that might be accessing or modifying sshd_config. This file is the ssh configuration file that might be modify by threat actors or adversaries to redirect port connection, allow diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index bc09a91333..aac72073e9 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -5,7 +5,7 @@ date: '2022-01-10' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a possible attempt to dump or access the content of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd" store user information within linux OS while "etc/shadow" contain the user passwords diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index 619f311f49..f8ed68d0ca 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -5,7 +5,7 @@ date: '2022-01-10' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a possible access or modification of /etc/sudoers file. "/etc/sudoers" file controls who can run what command as what users on what machine and can also control whether a specific user need a password for particular diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 211dcc40b8..f8a19bc8bc 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index 4e5abd35b3..dc2cf840f4 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious command-lines that can be possibly used to modify user profile files to automatically execute scripts/executables by shell upon reboot of the machine. This technique is commonly abused by adversaries, diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index e01bc1e396..778367c06b 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for possible suspicious commandline that may use to append a code to any existing cronjob files for persistence or privilege escalation. This technique is commonly abused by malware, adversaries and red teamers to automatically diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index 4434c494fd..735d7fbc44 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for possible modification of cronjobs file using editor. This event is can be seen in normal user but can also be a good hunting indicator for unwanted user modifying cronjobs for possible persistence or privilege diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml index a373484bf5..4da6ab31a2 100644 --- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml +++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml @@ -5,7 +5,7 @@ date: '2022-01-11' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. This technique is commonly abused by threat actors and adversaries to gain persistence and privilege escalation to the targeted host. by creating ssh private diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index 5a4b04d0b0..086b013bd2 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious command that may hijack a library function in linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to gain privileges and persist on the machine. This detection diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml index c4921a77dd..21b66436f6 100644 --- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation in systemd timer directory in linux platform. systemd is a system and service manager for Linux distributions. From the Windows perspective, this process fulfills the duties of wininit.exe and diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index 143a09119e..1158dcf5c5 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for restarted or re-enable services in linux platform. This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Windows services to repeatedly execute malicious diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml index 9929ea333a..463f0c26b8 100644 --- a/detections/endpoint/linux_service_started_or_enabled.yml +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for created or enable services in linux platform. This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Windows services to repeatedly execute malicious diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 20429f2a7e..8fcf57206f 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious chmod utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. For example, only the root account is allowed to change the password diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index 80401e0ebf..00752680be 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious setcap utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. For example, only the root account is allowed to change the password diff --git a/detections/endpoint/linux_shred_overwrite_command.yml b/detections/endpoint/linux_shred_overwrite_command.yml index 5939039349..a4a3c5139f 100644 --- a/detections/endpoint/linux_shred_overwrite_command.yml +++ b/detections/endpoint/linux_shred_overwrite_command.yml @@ -5,19 +5,20 @@ date: '2022-04-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: This analytic is to detect a shred process to overwrite a files in a linux machine. - Shred Linux application is designed to overwrite file to hide its contents or make the deleted file un-recoverable. - Weve seen this technique in industroyer2 malware that tries to wipe energy facilities of targeted sector as part of its destructive attack. - It might be some normal user may use this command for valid purposes but it is recommended to check what files, disk or folder it tries to shred - that might be good pivot for incident response in this type of destructive malware. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name =shred AND Processes.process IN ("*-n*", "*-u*", "*-z*", "*-s*") - by Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_shred_overwrite_command_filter`' +- Endpoint.Processes +description: This analytic is to detect a shred process to overwrite a files in a + linux machine. Shred Linux application is designed to overwrite file to hide its + contents or make the deleted file un-recoverable. Weve seen this technique in industroyer2 + malware that tries to wipe energy facilities of targeted sector as part of its destructive + attack. It might be some normal user may use this command for valid purposes but + it is recommended to check what files, disk or folder it tries to shred that might + be good pivot for incident response in this type of destructive malware. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name =shred + AND Processes.process IN ("*-n*", "*-u*", "*-z*", "*-s*") by Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_shred_overwrite_command_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from diff --git a/detections/endpoint/linux_stop_services.yml b/detections/endpoint/linux_stop_services.yml index 49d7dce761..aee20d9f6b 100644 --- a/detections/endpoint/linux_stop_services.yml +++ b/detections/endpoint/linux_stop_services.yml @@ -5,19 +5,18 @@ date: '2022-04-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic is to detect events that attempt to stop or clear a service. - This is typically identified in parallel with other instances of service enumeration of - attempts to stop a service and then delete it. Adversaries utilize this technique like industroyer2 - malware to terminate security services or other related services to continue there objective as a destructive payload. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name IN ("systemctl", "service", "svcadm") Processes.process ="*stop*" - by Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_stop_services_filter`' +- Endpoint.Processes +description: The following analytic is to detect events that attempt to stop or clear + a service. This is typically identified in parallel with other instances of service + enumeration of attempts to stop a service and then delete it. Adversaries utilize + this technique like industroyer2 malware to terminate security services or other + related services to continue there objective as a destructive payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("systemctl", + "service", "svcadm") Processes.process ="*stop*" by Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stop_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml index 61c82dc61a..a0340af98f 100644 --- a/detections/endpoint/linux_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -5,7 +5,7 @@ date: '2022-01-04' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect the execution of sudo or su command in linux operating system. The "sudo" command allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index 5dcbc7b13f..9e9e1b737e 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -5,7 +5,7 @@ date: '2021-12-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic is to looks for file creation of sudoers.tmp file cause by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index c7ba8f4f58..4fc58b9fd7 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -5,7 +5,7 @@ date: '2022-02-11' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for possible enumeration of local network configuration. This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further attack. This anomaly detections diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml index f50aa10129..39f6e2ae73 100644 --- a/detections/endpoint/linux_visudo_utility_execution.yml +++ b/detections/endpoint/linux_visudo_utility_execution.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to looks for suspicious commandline that add entry to /etc/sudoers by using visudo utility tool in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index e0f0ca006b..180c9f25fc 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-18' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index 6adef0d862..fd932fab65 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index 5ba9c2ef5c..f354c167db 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index c2789af5d0..7ac361e71c 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -5,7 +5,7 @@ date: '2021-09-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript @@ -28,7 +28,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 8c8ad272fc..c109d07d92 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. @@ -34,8 +33,8 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user - $user$. + message: mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by + user $user$. mitre_attack_id: - T1114 - T1114.001 diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index 4a6f2d0ce4..7824fbee42 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -5,7 +5,8 @@ date: '2021-10-05' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index cb502cdbaa..d3f2dee319 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-07' author: Ryan Becwar type: TTP -datamodel: -- Endpoint +datamodel: [] description: This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 4352f949f6..1acf6a00d0 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -5,7 +5,7 @@ date: '2022-01-18' author: David Dorsey, Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ @@ -40,7 +40,7 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - Hermetic Wiper + - Hermetic Wiper - Malicious PowerShell - NOBELIUM Group - WhisperGate diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index a4c8ef2564..46cb0496e9 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Rico Valdez, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index f2aab5c416..8eedfa9bde 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -5,7 +5,7 @@ date: '2021-01-19' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. search: '| tstats `security_content_summariesonly` count values(Processes.process) diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index b7bd73fc7f..bc74e6708e 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -5,7 +5,7 @@ date: '2022-02-01' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index 4362c44963..e3dcfc0b78 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-23' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 279433dd8c..b54bfbbbb4 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index b9cc64fa9e..884fe2e27b 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -5,7 +5,7 @@ date: '2022-03-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly @@ -16,10 +16,10 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe") - AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*" OR Processes.process = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") - by Processes.parent_process_name Processes.process_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `modify_acl_permission_to_files_or_folder_filter`' + AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*" OR Processes.process + = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.parent_process_name + Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index bbcccc4b3c..6169916452 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -5,7 +5,8 @@ date: '2020-01-28' author: Bhavin Patel, Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index f2dcbe9f8e..beae63168e 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-13' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 9454179e9b..13f02bc4dc 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-13' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index 5472eb5965..b620f826ce 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -5,7 +5,7 @@ date: '2021-10-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 1ddb54a7fd..8da43a1623 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -5,7 +5,7 @@ date: '2021-07-19' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 10ec4eb2d1..fa042a1fcb 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-06-01' author: Michael Haag, Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 043e3410ed..c85c3d727d 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -5,7 +5,7 @@ date: '2021-07-05' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index b84bab0afc..4ec33c3ad7 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index 72da2076d6..62f1ad6003 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -5,7 +5,7 @@ date: '2022-02-18' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml index 2402aa03ff..a40bc78910 100644 --- a/detections/endpoint/network_connection_discovery_arp.yml +++ b/detections/endpoint/network_connection_discovery_arp.yml @@ -5,7 +5,7 @@ date: '2021-09-10' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. diff --git a/detections/endpoint/network_connection_discovery_net.yml b/detections/endpoint/network_connection_discovery_net.yml index 29133265c6..7adc4872f5 100644 --- a/detections/endpoint/network_connection_discovery_net.yml +++ b/detections/endpoint/network_connection_discovery_net.yml @@ -5,7 +5,7 @@ date: '2021-09-10' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml index 59fcabd767..1cf53b88b7 100644 --- a/detections/endpoint/network_connection_discovery_netstat.yml +++ b/detections/endpoint/network_connection_discovery_netstat.yml @@ -5,7 +5,7 @@ date: '2021-09-10' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index ebf5e23634..3c12bef1b5 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic look for a spawned process of route.exe windows application. Adversaries and red teams alike abuse this application the recon or do a network discovery on a target host. but one possible false positive might be an automated diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index 47e1e170ce..9aaf26f3da 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -5,7 +5,7 @@ date: '2021-03-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 2a2e7744d4..932b369c8c 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -5,17 +5,18 @@ date: '2022-04-18' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process=""*/domain_trusts*"" OR Processes.process=""*/all_trusts*"") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process=""*/domain_trusts*"" + OR Processes.process=""*/all_trusts*"") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `nltest_domain_trust_discovery_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 89b066794c..343982c21c 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-15' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 57f268f033..0d2e428d58 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-15' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index fd4a87aa8f..95218e9c74 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -5,7 +5,7 @@ date: '2021-01-28' author: Michael Haag, Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 8fa06d009e..ffb2e691dc 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -5,7 +5,8 @@ date: '2021-09-13' author: Teoderick Contreras, Michael Haag Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index a9099039e9..add9387e49 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -5,7 +5,7 @@ date: '2021-07-30' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 41028c03bb..917387f65e 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -5,7 +5,7 @@ date: '2021-04-13' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index 13636ffc50..d8e810f38b 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-14' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index bd6d5aecb7..63ab6fa288 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-14' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office @@ -13,10 +12,10 @@ description: this detection was designed to identifies suspicious office documen or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") - ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) - as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count - by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` +search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", + "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") + | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded + count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index d26b64a7d2..cbe4338de2 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 61dce8802b..70b2d7a68c 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -5,7 +5,7 @@ date: '2021-07-19' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index 3c57516a33..801c9b0d68 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -5,7 +5,7 @@ date: '2021-04-26' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index daa22f2ea2..dece01c608 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -5,7 +5,7 @@ date: '2021-04-26' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 94829d3064..35f9071165 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -5,7 +5,7 @@ date: '2021-04-26' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index f594c3f59d..e6c9abd745 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -5,7 +5,7 @@ date: '2021-04-22' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index 9adedc663f..b744a50533 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index b906212777..7807ba521c 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -5,26 +5,24 @@ date: '2022-07-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid - | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid - | join proc_guid, _time [ - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.inf","*.cab") - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid - | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid - | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] - | dedup file_create_time - | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid - | `office_product_writing_cab_or_inf_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time + dest file_create_time file_name file_path process_name process_path process proc_guid] + | dedup file_create_time | table dest, process_name, process, file_create_time, + file_name, file_path, proc_guid | `office_product_writing_cab_or_inf_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index 019d441109..a3d99fddc8 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 114eb0db42..0f818979eb 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -5,8 +5,8 @@ date: '2022-06-28' author: Mauricio Velazco, Lou Stella, Splunk type: TTP datamodel: -- Endpoint -- Network_Traffic +- Endpoint.Processes +- Network_Traffic.All_Traffic description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving @@ -14,7 +14,17 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name="javaw.exe" OR Processes.process_name="javaw.exe") by _time Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port| `outbound_network_connection_from_java_using_default_ports_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where (Processes.process_name="java.exe" OR Processes.process_name="javaw.exe" OR + Processes.process_name="javaw.exe") by _time Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port + = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.process_id All_Traffic.dest + All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process connection_to_CNC + dest_port| `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 45725a4557..ac7877a19e 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml index bee655ff4f..72904b06c7 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index d46e1139cc..5ddec69e1d 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 6f8737c3ea..7aded83140 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -5,7 +5,7 @@ date: '2022-01-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify the possible execution of ping sleep batch commands. This technique was seen in several malware samples and is used to trigger sleep times without explicitly calling sleep functions or commandlets. The goal diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 40bd8bea88..e0c77bdde7 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will detect if a suspicious process contains a commandline parameter related to a web browser credential dumper. This technique is used by Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 901aaa5b6e..d40a9e5db4 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-29' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` @@ -19,11 +19,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name="wmiprvse.exe" OR Processes.parent_process_name="services.exe" OR Processes.parent_process_name="svchost.exe" OR Processes.parent_process_name="wsmprovhost.exe" OR Processes.parent_process_name="mmc.exe") - (Processes.process_name="powershell.exe" OR (Processes.process_name="cmd.exe" AND Processes.process="*powershell.exe*") - OR Processes.process_name="pwsh.exe" OR (Processes.process_name="cmd.exe" AND Processes.process="*pwsh.exe*")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`' + (Processes.process_name="powershell.exe" OR (Processes.process_name="cmd.exe" AND + Processes.process="*powershell.exe*") OR Processes.process_name="pwsh.exe" OR (Processes.process_name="cmd.exe" + AND Processes.process="*pwsh.exe*")) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `possible_lateral_movement_powershell_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index ee672b6ca4..8016a711fa 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -5,43 +5,34 @@ date: '2022-05-11' author: Mikael Bjerkeland, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search identifies users who have entered their passwords in username - fields. This is done by looking for failed authentication attempts using usernames with a length - longer than 7 characters and a high Shannon entropy, and looks for the next successful - authentication attempt from the same source system to the same destination system - as the failed attempt. -search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime - latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src - values(Authentication.dest) AS dest count FROM datamodel=Authentication - WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" - | `drop_dm_object_name(Authentication)` - | lookup ut_shannon_lookup word AS user - | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 - | sort count, - ut_shannon - | eval incorrect_password=user - | eval endtime=endtime+1000 - | map maxsearches=70 search="| tstats `security_content_summariesonly` - earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype - values(Authentication.src) AS src values(Authentication.dest) AS dest count - FROM datamodel=Authentication WHERE nodename=Authentication.Successful_Authentication - Authentication.src=\"$src$\" Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") - earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\" - | `drop_dm_object_name(\"Authentication\")` - | `potential_password_in_username_false_positive_reduction` - | eval incorrect_password=\"$incorrect_password$\" - | eval ut_shannon=\"$ut_shannon$\" - | sort count" - | where user!=incorrect_password - | outlier action=RM count - | `potential_password_in_username_filter`' + fields. This is done by looking for failed authentication attempts using usernames + with a length longer than 7 characters and a high Shannon entropy, and looks for + the next successful authentication attempt from the same source system to the same + destination system as the failed attempt. +search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) + AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) + AS dest count FROM datamodel=Authentication.Authentication WHERE nodename=Authentication.Failed_Authentication + BY "Authentication.user" | `drop_dm_object_name(Authentication)` | lookup ut_shannon_lookup + word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort + count, - ut_shannon | eval incorrect_password=user | eval endtime=endtime+1000 | + map maxsearches=70 search="| tstats `security_content_summariesonly` earliest(_time) + AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) + AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication.Authentication + WHERE nodename=Authentication.Successful_Authentication Authentication.src=\"$src$\" + Authentication.dest=\"$dest$\" sourcetype IN (\"$sourcetype$\") earliest=\"$starttime$\" + latest=\"$endtime$\" BY \"Authentication.user\" | `drop_dm_object_name(\"Authentication\")` + | `potential_password_in_username_false_positive_reduction` | eval incorrect_password=\"$incorrect_password$\" + | eval ut_shannon=\"$ut_shannon$\" | sort count" | where user!=incorrect_password + | outlier action=RM count | `potential_password_in_username_filter`' how_to_implement: To successfully implement this search, you need to have relevant - authentication logs mapped to the Authentication data model. You also need to - have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. - The detection must run with a time interval shorter than endtime+1000. -known_false_positives: Valid usernames with high entropy or source/destination system pairs - with multiple authenticating users will make it difficult to identify the real user - authenticating. + authentication logs mapped to the Authentication data model. You also need to have + the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. The + detection must run with a time interval shorter than endtime+1000. +known_false_positives: Valid usernames with high entropy or source/destination system + pairs with multiple authenticating users will make it difficult to identify the + real user authenticating. references: - https://medium.com/@markmotig/search-for-passwords-accidentally-typed-into-the-username-field-975f1a389928 tags: @@ -92,4 +83,4 @@ tags: - Authentication.dest - sourcetype risk_score: 21 - security_domain: access \ No newline at end of file + security_domain: access diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index 2ab5fa7e33..d4c0b90d42 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -5,7 +5,7 @@ date: '2022-01-14' author: Michael Hart, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines. The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell @@ -17,8 +17,8 @@ description: The following analytic uses a pretrained machine learning text clas found in normal usage of the commandline. The model will output a score where all values above zero are suspicious, anything greater than one particularly so. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name - Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | + as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name Processes.process_name + Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'', process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index dfa2a7cc75..2be3cac3f3 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -5,7 +5,7 @@ date: '2022-01-12' author: David Dorsey, Michael Haag Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell @@ -36,7 +36,7 @@ references: - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ tags: analytic_story: - - Hermetic Wiper + - Hermetic Wiper - Malicious PowerShell - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - HAFNIUM Group diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index f8e32a1f94..3ff0113a6e 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -5,17 +5,17 @@ date: '2022-07-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" - AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*drtm *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *") - by Processes.dest Processes.user Processes.parent_process Processes.original_file_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_disable_security_monitoring_filter`' + AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*drtm + *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *") by Processes.dest Processes.user + Processes.parent_process Processes.original_file_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 974bb42a8e..9643bcf4f2 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -4,16 +4,15 @@ version: 2 date: '2022-02-25' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. -search: '`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText - = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_enable_smb1protocol_feature_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" + ScriptBlockText = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -23,7 +22,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - - Hermetic Wiper + - Hermetic Wiper - Malicious PowerShell - Ransomware context: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index c3af3bf92f..5b5a05a8b1 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -4,17 +4,15 @@ version: 2 date: '2022-03-22' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. search: '`powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText + Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -26,7 +24,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html tags: analytic_story: - - Hermetic Wiper + - Hermetic Wiper - Malicious PowerShell - Ransomware confidence: 50 diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 053c2d78f7..3659b1d47a 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 55fb743ab0..acd4b85119 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index adf93972c7..7fd67c241c 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -4,15 +4,16 @@ version: 3 date: '2022-05-02' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation. -search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_remove_windows_defender_directory_filter` ' +search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText + = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) + as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter` ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 7d02b87096..3e7abf2ee4 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -5,7 +5,7 @@ date: '2021-03-29' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 989300131b..2ef4bcd575 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-25' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will detect a suspicious process commandline related to windows defender exclusion feature. This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index bc692cb9bb..47853e3231 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 824349bf6f..6f053f873f 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: 'The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 03692c30ac..abf57805fe 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index de054f6693..80b0190573 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -5,7 +5,8 @@ date: '2021-08-26' author: Jose Hernandez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index ee649e7d5b..274b81bfc4 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-02-18' author: Teoderick Contreras type: TTP -datamodel: -- Endpoint +datamodel: [] description: This detection is to identify a suspicious process that tries to delete the process file path related to its process. This technique is known to be defense evasion once a certain condition of malware is satisfied or not. Clop ransomware diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 8b9c2d4d40..e76e77dace 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -5,7 +5,7 @@ date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. During triage, review parallel processes for suspicious behavior diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 58c50c630c..95828b8440 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index a13b85c831..96a7bbf9e1 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -5,7 +5,8 @@ date: '2021-10-05' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 46770ffccf..6d76da71f0 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Josef Kuepker, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 7f18f31534..e27377d654 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-12' author: Teoderick Contreras type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 45e58f02e7..900a3224c4 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -5,7 +5,7 @@ date: '2021-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 54dd7eb939..08556cfd8f 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -5,7 +5,7 @@ date: '2020-11-26' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The search looks for reg.exe modifying registry keys that define Windows services and their configurations. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 9df5124d27..e2f660134b 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -4,8 +4,9 @@ version: 4 date: '2020-01-28' author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: +- Endpoint.Processes +- Endpoint.Registry description: This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index c1abc8b1f7..a065ac32eb 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 31b20c5995..b71b0ec524 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -4,8 +4,9 @@ version: 5 date: '2022-01-26' author: David Dorsey, Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: +- Endpoint.Processes +- Endpoint.Registry description: This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries @@ -41,7 +42,7 @@ tags: - Suspicious Windows Registry Activities - Cloud Federated Credential Abuse - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper cis20: - CIS 8 confidence: 95 diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 1aab04eb9a..0d877f698c 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -5,7 +5,7 @@ date: '2021-10-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index a862143fbc..b2049fbca7 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -5,7 +5,7 @@ date: '2021-07-27' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 5028c90de0..81a8ea1dda 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search detects registry key license at host where Remcos RAT agent is installed. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 99f25fd29a..1df7b8766e 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -5,7 +5,7 @@ date: '2021-09-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: This search is to detect file creation in remcos folder in appdata which is the keylog and clipboard logs that will be send to its c2 server. This is really a good TTP indicator that there is a remcos rat in the system that do keylogging, diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index e647cb490a..8f6289a3c4 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-11-15' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index 424c47b579..c57854db62 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-11-16' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 61b12995b7..6ac8a3583f 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `winrs.exe` with command-line arguments utilized to start a process on a remote endpoint. Red Teams and adversaries alike may abuse the WinRM protocol and this binary for lateral movement and remote diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 9bacd245c8..87de89973b 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Rico Valdez, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies wmic.exe being launched with parameters to spawn a process on a remote system. Red Teams and adversaries alike may abuse WMI and this binary for lateral movement and remote code execution. diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index 77554b636a..db59805ae7 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-11-15' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml index 2335225b7c..e640380769 100644 --- a/detections/endpoint/remote_system_discovery_with_dsquery.yml +++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml @@ -5,7 +5,7 @@ date: '2021-08-31' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml index 1378fa70b7..e877811a74 100644 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ b/detections/endpoint/remote_system_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-30' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml index c9ca773e42..c25b6564d0 100644 --- a/detections/endpoint/remote_system_discovery_with_wmic.yml +++ b/detections/endpoint/remote_system_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index d99426d2cf..9920c24b0f 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -5,7 +5,7 @@ date: '2018-12-03' author: Rico Valdez, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 5b8102197c..2688d13eea 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -5,7 +5,7 @@ date: '2021-03-12' author: Teoderick Contreras type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index bfcca758dc..921597fff1 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -5,7 +5,7 @@ date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index e0ae661df2..27f553c61d 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -5,7 +5,8 @@ date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 6e99edde4c..590dcb7408 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -5,7 +5,7 @@ date: '2022-02-01' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index 74202d6ecc..4079c0356c 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic look for a spawned runas.exe process with a administrator user option parameter. This parameter was abused by adversaries, malware author or even red teams to gain elevated privileges in target host. This is a good hunting @@ -31,7 +31,7 @@ references: tags: analytic_story: - Windows Privilege Escalation - - Hermetic Wiper + - Hermetic Wiper confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 08ce69d321..d8f1baeed9 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index db851af26e..296e1f0183 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 40862aa624..77527e787c 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-29' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process. This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 4330b1f658..84ce286dd8 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-26' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index e72827f5f6..309d0f5366 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-02-18' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 3a596146e7..b5fce65ee8 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -5,13 +5,13 @@ date: '2021-08-09' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common practice to lock a screen and maybe a good indicator of compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="rundll32.exe" Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` @@ -65,4 +65,4 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index b0fd862caf..deeec6dbc9 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-26' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index 5a4eb1959c..3ee82e7d97 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -5,7 +5,7 @@ date: '2021-10-05' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 4ece57a8bc..1511ac1cb5 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -5,7 +5,8 @@ date: '2022-03-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Network_Traffic.All_Traffic description: The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious @@ -17,12 +18,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" - | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] - | table _time dest parent_process_name process_name process_path process process_id dest_port C2 - | `rundll32_with_no_command_line_arguments_with_network_filter`' + | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name + process_name process_path process process_id dest_port C2 | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 2c40265a4a..5b31c5cad2 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -5,7 +5,7 @@ date: '2022-02-08' author: Michael Haag, David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index fbe835cad6..95a08d7982 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -5,7 +5,7 @@ date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 6b94183a53..2744b6fb57 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -5,7 +5,7 @@ date: '2021-03-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 44b59e6cc7..d45bd3fa19 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This @@ -39,7 +40,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse - - Hermetic Wiper + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 292aa13b47..7c27df57da 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-26' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index 7fac70b705..4078c1fd0d 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-12' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 71d29c0821..ca1131af3d 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-13' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index 6848554959..5ca033b6f5 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index be94626b83..6710086c4f 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -5,7 +5,7 @@ date: '2021-08-09' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index a6836e975b..04e6d7072e 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -5,23 +5,26 @@ date: '2022-03-09' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint -- Network_Traffic -description: The following analytic identifies a process performing an outbound connection on port 88 used by default by the network authentication protocol - Kerberos. Typically, on a regular Windows endpoint, only the lsass.exe process is the one tasked with connecting to the Kerberos Distribution Center - to obtain Kerberos tickets. Identifying an unknown process using this protocol may be evidence of an adversary abusing the Kerberos protocol. +- Endpoint.Processes +- Network_Traffic.All_Traffic +description: The following analytic identifies a process performing an outbound connection + on port 88 used by default by the network authentication protocol Kerberos. Typically, + on a regular Windows endpoint, only the lsass.exe process is the one tasked with + connecting to the Kerberos Distribution Center to obtain Kerberos tickets. Identifying + an unknown process using this protocol may be evidence of an adversary abusing the + Kerberos protocol. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name!="lsass.exe" by _time Processes.process_id - Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + where Processes.process_name!="lsass.exe" by _time Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 88 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` ] - | table _time dest parent_process_name process_name process_path process process_id dest_port - | `unknown_process_using_the_kerberos_protocol_filter`' + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port = 88 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` ] | table _time dest parent_process_name process_name + process_path process process_id dest_port | `unknown_process_using_the_kerberos_protocol_filter`' how_to_implement: To successfully implement this search, you must be ingesting your endpoint events and populating the Endpoint and Network data models. -known_false_positives: Custom applications may leverage the Kerberos protocol. Filter as needed. +known_false_positives: Custom applications may leverage the Kerberos protocol. Filter + as needed. references: - https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/ - https://www.thehacker.recipes/ad/movement/kerberos/ptk diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 2875a6b18d..9435714268 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -5,7 +5,7 @@ date: '2022-06-01' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. @@ -22,9 +22,9 @@ how_to_implement: You must be ingesting data that records process activity from The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. -known_false_positives: 'Unknown at the moment' -references: - - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver +known_false_positives: Unknown at the moment +references: +- https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver tags: analytic_story: - Disabling Security Tools diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml index 839bad7907..d8e79290ec 100644 --- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index 0633e616c5..2ab98aefb6 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -5,7 +5,7 @@ date: '2018-12-03' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index bf7c985b7b..fa72b2681f 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -5,7 +5,7 @@ date: '2021-10-01' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 1436787c93..2ac693393f 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -5,7 +5,7 @@ date: '2021-09-29' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 4476a49794..b84990e777 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -5,7 +5,7 @@ date: '2021-03-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 8f820aaebc..504bec854f 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -5,7 +5,7 @@ date: '2021-01-22' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 5d4fccd4ac..f7e43a8091 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect potential malicious process loading COM object to wbemprox.dll, search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 11076f1cc1..51b763ed2d 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-06-01' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address @@ -17,9 +16,9 @@ search: '`sysmon` EventCode =22 process_name = "wermgr.exe" QueryName IN ("*wtfi "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") - | stats min(_time) as firstTime max(_time) as lastTime count by Image - process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' + | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name + ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 1f6e626961..d4e8572bc6 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index 19baae8d94..63d1b43a0a 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -5,7 +5,7 @@ date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index 788d7fd115..128d4b06ef 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -5,7 +5,7 @@ date: '2021-12-11' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of wget on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index f0faeb2522..689a8a707b 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -5,7 +5,7 @@ date: '2021-11-03' author: Jose Hernandez, Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml index f5b9708fc1..38b55b0199 100644 --- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml +++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml @@ -4,22 +4,26 @@ version: 1 date: '2022-06-24' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic identifies the use of default or publicly known named pipes used by RMX remote admin tool. - A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. RMX Tool uses named pipes in many way - as part of its communication for its server and client component. This tool was abuse by several adversaries and malware like Azorult to collect data to the targeted host. - This TTP is a good indicator that this tool was install in production premise and need to check if the user has a valid reason why it need to install this legitimate application. -search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") - | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessId PipeName Computer UserID - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +datamodel: [] +description: The following analytic identifies the use of default or publicly known + named pipes used by RMX remote admin tool. A named pipe is a named, one-way or duplex + pipe for communication between the pipe server and one or more pipe clients. RMX + Tool uses named pipes in many way as part of its communication for its server and + client component. This tool was abuse by several adversaries and malware like Azorult + to collect data to the targeted host. This TTP is a good indicator that this tool + was install in production premise and need to check if the user has a valid reason + why it need to install this legitimate application. +search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") + PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") + | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType + ProcessId PipeName Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: False positives may be present. Filter based on pipe name or process. +known_false_positives: False positives may be present. Filter based on pipe name or + process. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://attack.mitre.org/techniques/T1071/ @@ -56,11 +60,11 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - EventType - - ProcessId - - PipeName - - Computer + - Image + - EventType + - ProcessId + - PipeName + - Computer - UserID risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index dd84570d4d..8c46fdc041 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -5,24 +5,32 @@ date: '2022-07-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). - In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. - During triage, review file modifcations and parallel processes. +- Endpoint.Processes +description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running + processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution + (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition + to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import + descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe + PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an + import table entry consisting of the specified DLL into the module at the given + base address. During triage, review file modifcations and parallel processes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_binary_proxy_execution_mavinject_dll_injection_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present, filter on DLL name or parent process. + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="mavinject.exe" + Processes.process IN ("*injectrunning*", "*hmodule=0x*") by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_binary_proxy_execution_mavinject_dll_injection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present, filter on DLL name or parent + process. references: - - https://attack.mitre.org/techniques/T1218/013/ - - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process +- https://attack.mitre.org/techniques/T1218/013/ +- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process tags: analytic_story: - Living Off The Land @@ -40,7 +48,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting load a DLL. mitre_attack_id: - T1218.013 - T1218 @@ -71,11 +80,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index ff4c9749ac..79f84038c0 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -5,29 +5,31 @@ date: '2022-06-01' author: Teoderick Contreras, Michael Haag, Splunk type: Hunting datamodel: -- Endpoint -description: The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line - that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes by - Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) - | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1) - | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) - | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) - | search count_of_pattern1 > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 - | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' +- Endpoint.Processes +description: The following analytic identifies path traversal command-line execution + and should be used to tune and driver other more higher fidelity analytics. This + technique was seen in malicious document that execute malicious code using msdt.exe + and path traversal technique that serve as defense evasion. This Hunting query is + a good pivot to look for possible suspicious process and command-line that runs + execute path traversal technique to run malicious code. This may help you to find + possible downloaded malware or other lolbin execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes by Processes.original_file_name Processes.process_id + Processes.parent_process_id Processes.process_hash Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval + count_of_pattern1 = (mvcount(split(process,"/.."))-1) | eval count_of_pattern2 = + (mvcount(split(process,"\.."))-1) | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) + | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) | search count_of_pattern1 + > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 | + `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product -known_false_positives: false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better. +known_false_positives: false positive may vary depends on the score you want to check. + The bigger number of path traversal string count the better. references: - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ tags: @@ -48,7 +50,8 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ + message: A parent process $parent_process_name$ has spawned a child $process_name$ + with path traversal commandline $process$ in $dest$ mitre_attack_id: - T1059 nist: @@ -66,11 +69,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index f084d38485..4b014420de 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -5,24 +5,26 @@ date: '2022-06-01' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line - that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +- Endpoint.Processes +description: The following analytic identifies path traversal command-line execution. + This technique was seen in malicious document that execute malicious code using + msdt.exe and path traversal technique that serve as defense evasion. This TTP is + a good pivot to look for more suspicious process and command-line that runs before + and after this execution. This may help you to find possible downloaded malware + or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' + as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" + OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id + Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product -known_false_positives: Not known at this moment. +known_false_positives: Not known at this moment. references: - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ tags: @@ -43,7 +45,8 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ + message: A parent process $parent_process_name$ has spawned a child $process_name$ + with path traversal commandline $process$ in $dest$ mitre_attack_id: - T1059 nist: @@ -61,11 +64,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_computer_account_created_by_computer_account.yml b/detections/endpoint/windows_computer_account_created_by_computer_account.yml index e06990882c..d8f85bd644 100644 --- a/detections/endpoint/windows_computer_account_created_by_computer_account.yml +++ b/detections/endpoint/windows_computer_account_created_by_computer_account.yml @@ -4,18 +4,20 @@ version: 1 date: '2022-04-27' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic identifes a Computer Account creating a new Computer Account with specific a Service Principle Name - "RestrictedKrbHost". - The RestrictedKrbHost service class allows client applications to use Kerberos authentication when they do not have the identity of the service but have the server name. -search: '`wineventlog_security` EventCode=4741 user_type=computer Subject_Account_Domain!="NT AUTHORITY" Message=*RestrictedKrbHost* -| stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action ,src_user, user, Account_Name, Subject_Account_Name,Subject_Account_Domain - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_computer_account_created_by_computer_account_filter`' +datamodel: [] +description: The following analytic identifes a Computer Account creating a new Computer + Account with specific a Service Principle Name - "RestrictedKrbHost". The RestrictedKrbHost + service class allows client applications to use Kerberos authentication when they + do not have the identity of the service but have the server name. +search: '`wineventlog_security` EventCode=4741 user_type=computer Subject_Account_Domain!="NT + AUTHORITY" Message=*RestrictedKrbHost* | stats count min(_time) as firstTime max(_time) + as lastTime by dest, subject, action ,src_user, user, Account_Name, Subject_Account_Name,Subject_Account_Domain + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_created_by_computer_account_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. -known_false_positives: It is possible third party applications may have a computer account that adds computer accounts, filtering may be required. +known_false_positives: It is possible third party applications may have a computer + account that adds computer accounts, filtering may be required. references: - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/445e4499-7e49-4f2a-8d82-aaf2d1ee3c47 - https://github.com/Dec0ne/KrbRelayUp @@ -36,7 +38,8 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: A Computer Account created a Computer Account on $dest$, possibly indicative of Kerberos relay attack. + message: A Computer Account created a Computer Account on $dest$, possibly indicative + of Kerberos relay attack. mitre_attack_id: - T1558 nist: diff --git a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml index 3eb02b7c46..1dbf5c41a3 100644 --- a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml +++ b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml @@ -4,16 +4,20 @@ version: 1 date: '2022-04-27' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic identifies a ComputerAccount requesting a Kerberos Ticket. typically, a user account requests a Kerberos ticket. This behavior was identified with KrbUpRelay, but additional Kerberos attacks have exhibited similar behavior. -search: '`wineventlog_security` EventCode=4768 Account_Name="*$" src_ip!="::1" - | stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, - action, Supplied_Realm_Name, user, Account_Name, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_requesting_kerberos_ticket_filter`' +datamodel: [] +description: The following analytic identifies a ComputerAccount requesting a Kerberos + Ticket. typically, a user account requests a Kerberos ticket. This behavior was + identified with KrbUpRelay, but additional Kerberos attacks have exhibited similar + behavior. +search: '`wineventlog_security` EventCode=4768 Account_Name="*$" src_ip!="::1" | + stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action, + Supplied_Realm_Name, user, Account_Name, src_ip | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_computer_account_requesting_kerberos_ticket_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4768 EventCode enabled. The Windows TA is also required. -known_false_positives: It is possible false positives will be present based on third party applications. Filtering may be needed. +known_false_positives: It is possible false positives will be present based on third + party applications. Filtering may be needed. references: - https://github.com/Dec0ne/KrbRelayUp tags: @@ -33,7 +37,8 @@ tags: impact: 50 kill_chain_phases: - Actions on Objectives - message: A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack. + message: A Computer Account requested a Kerberos ticket on $dest$, possibly indicative + of Kerberos relay attack. mitre_attack_id: - T1558 nist: diff --git a/detections/endpoint/windows_computer_account_with_spn.yml b/detections/endpoint/windows_computer_account_with_spn.yml index 9fd7b63482..ced3131419 100644 --- a/detections/endpoint/windows_computer_account_with_spn.yml +++ b/detections/endpoint/windows_computer_account_with_spn.yml @@ -4,19 +4,21 @@ version: 1 date: '2022-04-28' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added using the KrbRelayUp behavior. This particular behavior has been found in other Kerberos based attacks. -search: '`wineventlog_security` EventCode=4741 MSADChangedAttributes IN ("*HOST/*","*RestrictedKrbHost/*") AND New_UAC_Value=0x80 -| eval Effecting_Account=mvindex(Security_ID,1) -| eval New_Computer_Account_Name=mvindex(Security_ID,0) -| stats count min(_time) as firstTime max(_time) as lastTime values(EventCode),values(Account_Domain),values(Security_ID), values(Effecting_Account), values(New_Computer_Account_Name),values(SAM_Account_Name),values(DNS_Host_Name),values(MSADChangedAttributes) by dest Logon_ID subject -| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `windows_computer_account_with_spn_filter`' +datamodel: [] +description: The following analytic identifies two SPNs, HOST and RestrictedKrbHost, + added using the KrbRelayUp behavior. This particular behavior has been found in + other Kerberos based attacks. +search: '`wineventlog_security` EventCode=4741 MSADChangedAttributes IN ("*HOST/*","*RestrictedKrbHost/*") + AND New_UAC_Value=0x80 | eval Effecting_Account=mvindex(Security_ID,1) | eval New_Computer_Account_Name=mvindex(Security_ID,0) + | stats count min(_time) as firstTime max(_time) as lastTime values(EventCode),values(Account_Domain),values(Security_ID), + values(Effecting_Account), values(New_Computer_Account_Name),values(SAM_Account_Name),values(DNS_Host_Name),values(MSADChangedAttributes) + by dest Logon_ID subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_computer_account_with_spn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required. -known_false_positives: It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed. +known_false_positives: It is possible third party applications may add these SPNs + to Computer Accounts, filtering may be needed. references: - https://www.trustedsec.com/blog/an-attack-path-mapping-approach-to-cves-2021-42287-and-2021-42278 - https://github.com/Dec0ne/KrbRelayUp @@ -37,7 +39,8 @@ tags: impact: 80 kill_chain_phases: - Installation - message: A Computer Account was created with SPNs related to Kerberos on $dest$, possibly indicative of Kerberos relay attack. + message: A Computer Account was created with SPNs related to Kerberos on $dest$, + possibly indicative of Kerberos relay attack. mitre_attack_id: - T1558 nist: diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index f49e493d6a..10867ea543 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -5,7 +5,7 @@ date: '2021-10-19' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \ diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 9a2d7fbfd7..900e5c09f5 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -5,7 +5,7 @@ date: '2021-11-10' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \ diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index aff252f197..ba5782c719 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -5,7 +5,8 @@ date: '2021-11-25' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic will detect a suspicious process that modify a registry related to windows defender exclusion feature. This registry is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index 74575c024c..fa20d5c4e7 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -4,32 +4,36 @@ version: 1 date: '2022-03-28' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint -description: This analytic is to detect deletion of registry with suspicious process file path. This technique was seen in Double Zero wiper malware - where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections - can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application - updates or installation. In this scenario false positive filter is needed. +datamodel: +- Endpoint.Processes +- Endpoint.Registry +description: This analytic is to detect deletion of registry with suspicious process + file path. This technique was seen in Double Zero wiper malware where it will delete + all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload + to the targeted hosts. This anomaly detections can catch possible malware or advesaries + deleting registry as part of defense evasion or even payload impact but can also + catch for third party application updates or installation. In this scenario false + positive filter is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.action=deleted by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data Registry.action | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table _time parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action dest user - | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' + where Registry.action=deleted by _time span=1h Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data + Registry.action | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid + |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by + _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time + dest user parent_process_name parent_process process_name process_path process proc_guid + registry_path registry_value_name registry_value_data registry_key_name action] + | table _time parent_process_name parent_process process_name process_path process + proc_guid registry_path registry_value_name registry_value_data registry_key_name + action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: This detection can catch for third party application - updates or installation. In this scenario false positive filter is needed. +known_false_positives: This detection can catch for third party application updates + or installation. In this scenario false positive filter is needed. references: - https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html tags: @@ -48,7 +52,8 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log impact: 60 kill_chain_phases: [] - message: registry was deleted by a suspicious $process_name$ with proces path $process_path in $dest$ + message: registry was deleted by a suspicious $process_name$ with proces path $process_path + in $dest$ mitre_attack_id: - T1112 nist: @@ -67,14 +72,14 @@ tags: - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_name - - Registry.dest + - Registry.dest - Registry.user - Registry.action - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - Processes.process_guid - Processes.process_path diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index a371b5cff6..0f13235855 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -5,16 +5,21 @@ date: '2022-03-08' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a suspicious registry modification to disable change password feature of the windows host. - This registry modification may disables the Change Password button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del). - As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password - after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of - a critical host or server, In this type of scenario filter is needed to minimized false positive. +- Endpoint.Processes +- Endpoint.Registry +description: This analytic is to detect a suspicious registry modification to disable + change password feature of the windows host. This registry modification may disables + the Change Password button on the Windows Security dialog box (which appears when + you press Ctrl+Alt+Del). As a result, users cannot change their Windows password + on demand. This technique was seen in some malware family like ransomware to prevent + the user to change the password after ownning the network or a system during attack. + This windows feature may implemented by administrator to prevent normal user to + change the password of a critical host or server, In this type of scenario filter + is needed to minimized false positive. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -23,15 +28,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_change_password_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_change_password_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of - a critical host or server, In this type of scenario filter is needed to minimized false positive. +known_false_positives: This windows feature may implemented by administrator to prevent + normal user to change the password of a critical host or server, In this type of + scenario filter is needed to minimized false positive. references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah tags: analytic_story: - Ransomware @@ -51,19 +56,18 @@ tags: - Registry.registry_key_name - Registry.registry_path - Registry.registry_value_name - - Registry.dest + - Registry.dest - Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -80,4 +84,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index eaf42461b5..c7e9874112 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -5,14 +5,17 @@ date: '2022-03-08' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. - This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. - This technique was used by threat actor to make its payload more impactful to the compromised host. +- Endpoint.Processes +- Endpoint.Registry +description: This analytic is to detect a suspicious registry modification to disable + Lock Computer windows features. This registry modification prevent the user from + locking its screen or computer that are being abused by several malware for example + ransomware. This technique was used by threat actor to make its payload more impactful + to the compromised host. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -21,15 +24,14 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_lock_workstation_feature_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. known_false_positives: unknown references: -- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ -- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ +- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ +- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ tags: analytic_story: - Ransomware @@ -51,17 +53,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -78,4 +79,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 1d42ed5b62..d1ba23f6ae 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -5,34 +5,37 @@ date: '2022-03-08' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. - This registry when enable will prevent users to log off of the system by using any method, - including programs run from the command line, such as scripts. It also disables or removes - all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware - to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. - This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +- Endpoint.Processes +- Endpoint.Registry +description: This analytic is to detect a suspicious registry modification to disable + logoff feature in windows host. This registry when enable will prevent users to + log off of the system by using any method, including programs run from the command + line, such as scripts. It also disables or removes all menu items and buttons that + log the user off of the system. This technique was seen abused by ransomware malware + to make the compromised host un-useful and hard to remove other registry modification + made on the machine that needs restart to take effect. This windows feature may + implement by administrator in some server where shutdown is critical. In that scenario + filter of machine and users that can modify this registry is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_logoff_button_through_registry_filter`' + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data + = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, + _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_guid | + `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time + dest user parent_process_name parent_process process_name process_path process proc_guid + registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name + parent_process process_name process_path process proc_guid registry_path registry_value_name + registry_value_data | `windows_disable_logoff_button_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +known_false_positives: This windows feature may implement by administrator in some + server where shutdown is critical. In that scenario filter of machine and users + that can modify this registry is needed. references: - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 - https://malwiki.org/index.php?title=DigiPop.xp @@ -57,17 +60,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -84,4 +86,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 2762afa09d..9fc62f4f8b 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -5,7 +5,8 @@ date: '2022-02-25' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper. To disable crash dumps, the value must be set to diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b5e0d89819..7af99ab82b 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -5,33 +5,34 @@ date: '2022-02-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following search identifies a modification of registry to disable - the windows notification center feature in a windows host machine. This registry modification removes - notification and action center from the notification area on the task bar. - This modification are seen in RAT malware to cover their tracks upon + the windows notification center feature in a windows host machine. This registry + modification removes notification and action center from the notification area on + the task bar. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_value_name= "DisableNotificationCenter" - Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid - Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid - as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name] | table _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name | `windows_disable_notification_center_filter`' + where Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data + = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data + | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, + _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_guid | + `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time + dest user parent_process_name parent_process process_name process_path process proc_guid + registry_path registry_value_name registry_value_data registry_key_name] | table + _time dest user parent_process_name parent_process process_name process_path process + proc_guid registry_path registry_value_name registry_value_data registry_key_name + | `windows_disable_notification_center_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: admin or user may choose to disable this windows features. references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Windows Defense Evasion Tactics @@ -55,8 +56,7 @@ tags: - Registry.registry_value_nam security_domain: endpoint impact: 60 - confidence: 80 - # (impact * confidence)/100 + confidence: 80 risk_score: 48 context: - Source:Endpoint @@ -76,4 +76,4 @@ tags: - DE.CM cis20: - CIS 8 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 835040e6b0..de4e85516b 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -5,17 +5,20 @@ date: '2022-03-08' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. - This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host - un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. - This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +- Endpoint.Processes +- Endpoint.Registry +description: This analytic is to detect a suspicious registry modification to disable + shutdown button on the logon user. This technique was seen in several malware especially + in ransomware family like killdisk malware variant to make the compromised host + un-useful and hard to remove other registry modification made on the machine that + needs restart to take effect. This windows feature may implement by administrator + in some server where shutdown is critical. In that scenario filter of machine and + users that can modify this registry is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" - Registry.registry_value_data = "0x00000000") - OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" + Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -24,15 +27,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_shutdown_button_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine - and users that can modify this registry is needed. +known_false_positives: This windows feature may implement by administrator in some + server where shutdown is critical. In that scenario filter of machine and users + that can modify this registry is needed. references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ tags: analytic_story: - Ransomware @@ -53,17 +56,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -80,4 +82,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index ac3844dbc3..4f5aeb33ef 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -5,17 +5,22 @@ date: '2022-03-08' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a suspicious registry modification to disable windows features. - These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response - from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but - can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed. +- Endpoint.Processes +- Endpoint.Registry +description: This analytic is to detect a suspicious registry modification to disable + windows features. These techniques are seen in several ransomware malware to impair + the compromised host to make it hard for analyst to mitigate or response from the + attack. Disabling these known features make the analysis and forensic response more + hard. Disabling these feature is not so common but can still be implemented by the + administrator for security purposes. In this scenario filters for users that are + allowed doing this is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" - Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", - "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" + Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", + "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") + Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name @@ -24,8 +29,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_disable_windows_group_policy_features_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. @@ -55,17 +59,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -82,4 +85,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 5fd40bf090..541ca15e5e 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 9c8911d92c..a92a571cde 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -5,7 +5,7 @@ date: '2021-11-15' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index 98f3589020..172d856817 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -5,7 +5,7 @@ date: '2022-02-15' author: Lou Stella, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index acabf8a4a9..59448d462c 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -5,7 +5,7 @@ date: '2021-11-17' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective. diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index dbbebc4a68..0b481c31b4 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -5,7 +5,7 @@ date: '2022-01-19' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a lookup and compares the process diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index 6596f94289..9fcc6fd6a1 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -4,21 +4,26 @@ version: 1 date: '2022-04-04' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic uses Windows EventCode 7045 to identify new Kernel Mode Drivers being loaded in Windows from a non-standard path. - Note that, adversaries may move malicious or vulnerable drivers into these paths and load up. The idea is that this analytic provides visibility into drivers loading in non-standard file paths. -search: '`wineventlog_system` EventCode=7045 Service_Type="kernel mode driver" NOT (Service_File_Name IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Service_File_Name Service_Name Service_Start_Type Service_Type - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_driver_load_non_standard_path_filter`' -how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged. The Windows TA for Splunk is also recommended. -known_false_positives: False positives may be present based on legitimate third party applications needing to install drivers. Filter, or allow list known good drivers consistently being installed in these paths. +datamodel: [] +description: The following analytic uses Windows EventCode 7045 to identify new Kernel + Mode Drivers being loaded in Windows from a non-standard path. Note that, adversaries + may move malicious or vulnerable drivers into these paths and load up. The idea + is that this analytic provides visibility into drivers loading in non-standard file + paths. +search: '`wineventlog_system` EventCode=7045 Service_Type="kernel mode driver" NOT + (Service_File_Name IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", + "system32\*")) | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName + EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_driver_load_non_standard_path_filter`' +how_to_implement: To implement this analytic, the Windows EventCode 7045 will need + to be logged. The Windows TA for Splunk is also recommended. +known_false_positives: False positives may be present based on legitimate third party + applications needing to install drivers. Filter, or allow list known good drivers + consistently being installed in these paths. references: - - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - - https://attack.mitre.org/techniques/T1014/ - - https://www.fuzzysecurity.com/tutorials/28.html +- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ +- https://attack.mitre.org/techniques/T1014/ +- https://www.fuzzysecurity.com/tutorials/28.html tags: analytic_story: - Windows Drivers @@ -52,10 +57,10 @@ tags: - Splunk Cloud required_fields: - ComputerName - - EventCode + - EventCode - Service_File_Name - Service_Name - Service_Start_Type - - Service_Type + - Service_Type risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index cf86f5f721..144188aee1 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -4,24 +4,28 @@ version: 1 date: '2022-03-30' author: Michael Haag, Splunk type: Hunting -datamodel: -- Endpoint -description: The following analytic assists with viewing all drivers being loaded by using Sysmon EventCode 6 (Driver Load). Sysmon provides some simple fields to assist with identifying suspicious drivers. - Use this analytic to look at prevalence of driver (count), path of driver, signature status and hash. Review these fields with scrutiny until the ability to prove the driver is legitimate and has a purpose in the environment. -search: '`sysmon` EventCode=6 -| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) count by Computer Signed Signature service_signature_verified service_signature_exists Hashes -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `windows_drivers_loaded_by_signature_filter`' +datamodel: [] +description: The following analytic assists with viewing all drivers being loaded + by using Sysmon EventCode 6 (Driver Load). Sysmon provides some simple fields to + assist with identifying suspicious drivers. Use this analytic to look at prevalence + of driver (count), path of driver, signature status and hash. Review these fields + with scrutiny until the ability to prove the driver is legitimate and has a purpose + in the environment. +search: '`sysmon` EventCode=6 | stats min(_time) as firstTime max(_time) as lastTime + values(ImageLoaded) count by Computer Signed Signature service_signature_verified + service_signature_exists Hashes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_drivers_loaded_by_signature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. - Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers. -known_false_positives: This analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat. + endpoints. If you are using Sysmon, you must have the latest version of the Sysmon + TA. Most EDR products provide the ability to review driver loads, or module loads, + and using a query as such help with hunting for malicious drivers. +known_false_positives: This analytic is meant to assist with identifying drivers loaded + in the environment and not to be setup for notables off the bat. references: - - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - - https://attack.mitre.org/techniques/T1014/ - - https://www.fuzzysecurity.com/tutorials/28.html +- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ +- https://attack.mitre.org/techniques/T1014/ +- https://www.fuzzysecurity.com/tutorials/28.html tags: analytic_story: - Windows Drivers @@ -38,7 +42,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A driver has loaded on $Computer$. + message: A driver has loaded on $Computer$. mitre_attack_id: - T1014 - T1068 diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index c8a0681241..17cb91b09e 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -4,17 +4,15 @@ version: 2 date: '2022-04-04' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host -search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." - | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_event_for_service_disabled_filter`' +search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from + demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime + by ComputerName EventCode Message User Sid service service_name | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml index 5c04b86528..7e46acca3d 100644 --- a/detections/endpoint/windows_excessive_disabled_services_event.yml +++ b/detections/endpoint/windows_excessive_disabled_services_event.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-02-23' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify suspicious excessive number of system events of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index d0441635f1..7947cc274b 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -5,25 +5,34 @@ date: '2022-06-29' author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. - During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. +- Endpoint.Processes +description: The following analytic identifies a recently disclosed arbitraty command + execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample + identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve + a remote payload. During triage, review file modifications for html. Identify parallel + process execution that may be related, including an Office Product. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe - Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed. + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="msdt.exe" + Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") + AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" + OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present, filter as needed. Added .xml + to potentially capture any answer file usage. Remove as needed. references: - - https://isc.sans.edu/diary/rss/28694 - - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A - - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection - - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +- https://isc.sans.edu/diary/rss/28694 +- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e +- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection +- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html tags: analytic_story: - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 @@ -43,8 +52,8 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: A parent process $parent_process_name$ has spawned a child - process $process_name$ on host $dest$ possibly indicative of indirect command execution. + message: A parent process $parent_process_name$ has spawned a child process $process_name$ + on host $dest$ possibly indicative of indirect command execution. mitre_attack_id: - T1218 nist: @@ -74,11 +83,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index 8883966942..a43d3b6101 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -5,7 +5,8 @@ date: '2022-02-25' author: Teoderick Contreras, Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory diff --git a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml index 5d6b527d06..61ff1ee984 100644 --- a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -4,23 +4,23 @@ version: 1 date: '2022-06-21' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint -description: The following analytic identifies process that - attempts to connect to a known IP web services. This technique is commonly used by trickbot and - other malware to perform reconnaissance against the infected machine and look for its IP address. -search: '`sysmon` EventCode=22 QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", - "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", - "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*") - | stats min(_time) as firstTime max(_time) as lastTime count by Image ProcessId QueryName QueryStatus QueryResults Computer EventCode - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_gather_victim_network_info_through_ip_check_web_services_filter`' +datamodel: [] +description: The following analytic identifies process that attempts to connect to + a known IP web services. This technique is commonly used by trickbot and other malware + to perform reconnaissance against the infected machine and look for its IP address. +search: '`sysmon` EventCode=22 QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", + "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", + "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", + "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*") + | stats min(_time) as firstTime max(_time) as lastTime count by Image ProcessId + QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. -known_false_positives: Filter internet browser application to minimize the false positive of this detection. +known_false_positives: Filter internet browser application to minimize the false positive + of this detection. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -58,12 +58,12 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - ProcessId - - QueryName - - QueryStatus - - QueryResults - - Computer - - EventCode + - Image + - ProcessId + - QueryName + - QueryStatus + - QueryResults + - Computer + - EventCode risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml index 2e55b57627..a690992487 100644 --- a/detections/endpoint/windows_hidden_schedule_task_settings.yml +++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml @@ -4,19 +4,15 @@ version: 1 date: '2022-04-26' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint -description: The following query utilizes Windows Security EventCode 4698, - A scheduled task was created, to identify suspicious tasks registered on - Windows either via schtasks.exe OR TaskService with a hidden settings - that are unique entry of malware like industroyer2 or attack that uses - lolbin to download other file or payload to the infected machine. -search: '`wineventlog_security` EventCode=4698 - | xmlkv Message - | search Hidden = true - | stats count min(_time) as firstTime max(_time) as lastTime by Task_Name, Command, Author, Hidden, dest - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +datamodel: [] +description: The following query utilizes Windows Security EventCode 4698, A scheduled + task was created, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with a hidden settings that are unique entry of malware + like industroyer2 or attack that uses lolbin to download other file or payload to + the infected machine. +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Hidden = true + | stats count min(_time) as firstTime max(_time) as lastTime by Task_Name, Command, + Author, Hidden, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hidden_schedule_task_settings_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 6f5e2c783a..a55e089d66 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -5,31 +5,34 @@ date: '2022-03-08' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. - This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and - ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed. +- Endpoint.Processes +- Endpoint.Registry +description: This analytic is to detect a suspicious registry modification to hide + common windows notification feature from compromised host. This technique was seen + in some ransomware family to add more impact to its payload that are visually seen + by user aside from the encrypted files and ransomware notes. Even this a good anomaly + detection, administrator may implement this changes for auditing or security reason. + In this scenario filter is needed. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" - Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") - Registry.registry_value_data = "0x00000001" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" + Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", + "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by + _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data - | `windows_hide_notification_features_through_registry_filter`' + process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. known_false_positives: unknown references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ tags: analytic_story: - Ransomware @@ -51,17 +54,16 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name - Processes.parent_process - - Processes.process_guid + - Processes.process_guid security_domain: endpoint impact: 70 - confidence: 70 - # (impact * confidence)/100 + confidence: 70 risk_score: 49 context: - Source:Endpoint @@ -78,4 +80,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index 9aaf0c761e..9826337342 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-16' author: Teoderick Contreras type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search looks for high frequency of file deletion relative to process name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index a0042656bc..bf13eedb0a 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -5,26 +5,39 @@ date: '2022-07-11' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint -description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). - To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name Processes.process - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` - | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" - | `windows_identify_protocol_handlers_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line. +- Endpoint.Processes +description: 'The following hunting analytic will identify any protocol handlers utilized + on the command-line. A protocol handler is an application that knows how to handle + particular types of links: for example, a mail client is a protocol handler for + "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application + selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, + depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html + URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* + | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match + "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL + in the property to limit the scope of this query to similar handlers as ms-msdt.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.process) as process values(Processes.parent_process) + as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user + Processes.process_name Processes.process | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup windows_protocol_handlers + handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives will be found. https and http is a URL Protocol + handler that will trigger this analytic. Tune based on process or command-line. references: - - https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html - - https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/ - - https://github.com/Mr-Un1k0d3r/PoisonHandler - - https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file - - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479 - - https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug - - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ +- https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html +- https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/ +- https://github.com/Mr-Un1k0d3r/PoisonHandler +- https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file +- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479 +- https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug +- https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ tags: analytic_story: - Living Off The Land @@ -42,7 +55,8 @@ tags: impact: 30 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ utilizing a protocol handler. mitre_attack_id: - T1059 nist: @@ -72,15 +86,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 6 security_domain: endpoint - diff --git a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml index 6504f5debb..8fec07553f 100644 --- a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml +++ b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml @@ -5,23 +5,26 @@ date: '2022-06-24' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint -description: The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. - This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker - commandlet. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_powershell` AND Processes.process="*Import-Module Applocker*" AND Processes.process="*Set-AppLockerPolicy *" AND Processes.process="* -XMLPolicy *" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +- Endpoint.Processes +description: The following analytic is to identify a process that imports applocker + xml policy using PowerShell commandlet. This technique was seen in Azorult malware + where it drop an xml Applocker policy that will deny several AV products and further + executed the PowerShell Applocker commandlet. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_powershell` AND Processes.process="*Import-Module Applocker*" AND + Processes.process="*Set-AppLockerPolicy *" AND Processes.process="* -XMLPolicy + *" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_add_xml_applocker_rules_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may execute this command that may cause some false positive. +known_false_positives: Administrators may execute this command that may cause some + false positive. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -43,7 +46,7 @@ tags: - Exploitation message: Applocker importing xml policy command was executed in $dest$ mitre_attack_id: - - T1562.001 + - T1562.001 - T1562 nist: - DE.CM diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 79175bf985..b9e2b74af8 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -5,20 +5,19 @@ date: '2022-06-07' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint -description: The search looks for the deletion of Windows Defender context menu within the registry. - This is consistent behavior with RAT malware across a fleet of endpoints. This particular - behavior is executed when an adversary gains access to an endpoint +- Endpoint.Registry +description: The search looks for the deletion of Windows Defender context menu within + the registry. This is consistent behavior with RAT malware across a fleet of endpoints. + This particular behavior is executed when an adversary gains access to an endpoint and begins to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted - by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_impair_defense_delete_win_defender_context_menu_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" + Registry.action = deleted by Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid Registry.action Registry.dest + Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_context_menu_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -72,4 +71,4 @@ tags: risk_score: 25 security_domain: endpoint supported_tas: - - Splunk_TA_microsoft_sysmon \ No newline at end of file + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml index c8f7a347bd..79e899bb2a 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -5,20 +5,19 @@ date: '2022-06-07' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: The search looks for the deletion of Windows Defender main profile within the registry. - This was used by RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an adversary gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple +- Endpoint.Registry +description: The search looks for the deletion of Windows Defender main profile within + the registry. This was used by RAT malware across a fleet of endpoints. This particular + behavior is typically executed when an adversary gains access to an endpoint and + beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted - by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_impair_defense_delete_win_defender_profile_registry_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows + Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid Registry.action Registry.user + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -72,4 +71,4 @@ tags: risk_score: 64 security_domain: endpoint supported_tas: - - Splunk_TA_microsoft_sysmon \ No newline at end of file + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml index c26cd774cb..e3c58ce806 100644 --- a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml +++ b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml @@ -5,26 +5,30 @@ date: '2022-06-24' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic identifies a modification in the Windows registry - by the Applocker utility that contains details or registry data values related to denying the execution of several security products. - This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker - commandlet. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") - OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" - AND Registry.registry_value_data = "*Action\=\"Deny\"*" - AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") - by Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + by the Applocker utility that contains details or registry data values related to + denying the execution of several security products. This technique was seen in Azorult + malware where it drops an xml Applocker policy that will deny several AV products + and then loaded by using PowerShell Applocker commandlet. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group + Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") + OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND + Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data + IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA + SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", + "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", + "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by Registry.user Registry.registry_path + Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_deny_security_software_with_applocker_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: False positives may be present based on organization use of Applocker. Filter as needed. +known_false_positives: False positives may be present based on organization use of + Applocker. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11 @@ -45,9 +49,10 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: Applocker registry modification to deny the action of several AV products on $dest$. + message: Applocker registry modification to deny the action of several AV products + on $dest$. mitre_attack_id: - - T1562.001 + - T1562.001 - T1562 nist: - DE.CM @@ -74,4 +79,4 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 100 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index ec4d4bf177..05b03c735e 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -5,20 +5,19 @@ date: '2022-06-07' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable. - This is consistent with RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an adversary gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data ="0x00000000" - by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' +- Endpoint.Registry +description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger + set to disable. This is consistent with RAT malware across a fleet of endpoints. + This particular behavior is typically executed when an adversary gains access to + an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed + and multiple registry and scheduled task modifications will occur. During triage, + review parallel processes and identify any further file modifications. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" + OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data + ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 557b7b6812..f7705e4773 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -5,27 +5,27 @@ date: '2022-04-05' author: Eric McGinnis, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic detects programs that have been started by forfiles.exe. - According to Microsoft, the 'The forfiles command lets you run a command on or pass + According to Microsoft, the 'The forfiles command lets you run a command on or pass arguments to multiple files'. While this tool can be used to start legitimate programs, - usually within the context of a batch script, it has been observed being used to evade - protections on command line execution. + usually within the context of a batch script, it has been observed being used to + evade protections on command line execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_forfiles_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* + /c *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where forfiles.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. - Similarly, forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. +known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly, + forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. references: - - https://twitter.com/KyleHanslovan/status/912659279806640128 - - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles +- https://twitter.com/KyleHanslovan/status/912659279806640128 +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles tags: analytic_story: - Living Off The Land @@ -43,21 +43,20 @@ tags: - _time - Processes.dest - Processes.user - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.process_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ @@ -70,5 +69,5 @@ tags: - DE.AE cis20: - CIS 8 - - CIS 10 + - CIS 10 asset_type: Endpoint diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 6e29b08e87..e1a693df40 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -5,25 +5,26 @@ date: '2022-04-05' author: Eric McGinnis, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic detects programs that have been started by pcalua.exe. - pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this tool - can be used to start legitimate programs, it has been observed being used to evade - protections on command line execution. +- Endpoint.Processes +description: The following analytic detects programs that have been started by pcalua.exe. + pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this + tool can be used to start legitimate programs, it has been observed being used to + evade protections on command line execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_pcalua_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* + -a*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where pcalua.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. Filter these results as needed. +known_false_positives: Some legacy applications may be run using pcalua.exe. Filter + these results as needed. references: - - https://twitter.com/KyleHanslovan/status/912659279806640128 - - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ +- https://twitter.com/KyleHanslovan/status/912659279806640128 +- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ tags: analytic_story: - Living Off The Land @@ -41,21 +42,20 @@ tags: - _time - Processes.dest - Processes.user - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id - Processes.process_path security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ @@ -68,5 +68,5 @@ tags: - DE.AE cis20: - CIS 8 - - CIS 10 + - CIS 10 asset_type: Endpoint diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 2b67928228..a650e06974 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-06-01' author: Michael Haag, Mauricio Velazo, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: 'The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 096a3b6e3d..19ce0b7e49 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -5,7 +5,7 @@ date: '2022-01-19' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location. The analytic utilizes a macro for InstallUtil and identifies both the process_name and original_file_name. diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index dffd5a950f..86c2f174b7 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -5,7 +5,8 @@ date: '2022-03-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Network_Traffic.All_Traffic description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control. \ @@ -25,10 +26,10 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] - | table _time dest parent_process_name process_name process_path process process_id dest_port C2 - | `windows_installutil_remote_network_connection_filter`' + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != + 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` + | rename dest as C2 ] | table _time dest parent_process_name process_name process_path + process process_id dest_port C2 | `windows_installutil_remote_network_connection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 17ccd4d0fd..21969c15c3 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the Windows InstallUtil.exe binary. This will execute code while bypassing application control using the `/u` (uninstall) switch. \ diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 16a3fe5878..c543a08d8d 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -5,7 +5,8 @@ date: '2022-03-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Network_Traffic.All_Traffic description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control using the `/u` (uninstall) switch. \ @@ -28,11 +29,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] - | table _time dest parent_process_name process_name process_path process process_id dest_port C2 - | `windows_installutil_uninstall_option_with_network_filter`' + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name + process_name process_path process process_id dest_port C2 | `windows_installutil_uninstall_option_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index 97044fe49e..fa5423fbf1 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the Windows InstallUtil.exe binary passing a HTTP request on the command-line. This technique may be used to download and execute code while bypassing application control. \ diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index 73c352f48f..c2481173e5 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -5,17 +5,25 @@ date: '2022-03-29' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint -description: The following analytic identifies the use of a delivered ISO file that has been mounted and the afformention lnk or file opened within it. When the ISO file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. - The analytic identifies .iso.lnk written to the path. The name of the ISO file is prepended. +- Endpoint.Filesystem +description: The following analytic identifies the use of a delivered ISO file that + has been mounted and the afformention lnk or file opened within it. When the ISO + file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the + ISO file is prepended. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_iso_lnk_file_creation_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed. + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") + Filesystem.file_name IN ("*.iso.lnk") by Filesystem.file_create_time Filesystem.process_id + Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iso_lnk_file_creation_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be high depending on the environment and + consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly + used ISO names. Filter as needed. references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1 @@ -33,7 +41,8 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log kill_chain_phases: - Delivery - message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. + message: An ISO file was mounted on $dest$ and should be reviewed and filtered as + needed. mitre_attack_id: - T1566.001 - T1566 @@ -51,10 +60,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Filesystem.file_create_time + - Filesystem.file_create_time - Filesystem.process_id - - Filesystem.file_name - - Filesystem.file_path + - Filesystem.file_name + - Filesystem.file_path - Filesystem.dest security_domain: endpoint impact: 80 diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index 415de5a5c0..f98bd0d67d 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -4,17 +4,22 @@ version: 1 date: '2022-04-27' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. The target user security identified will be set to the built-in local Administrator account, along with the remote address as localhost - 127.0.0.1. This may be indicative of a kerberos relay attack. - Upon triage, review for recently ran binaries on disk. In addition, look for new computer accounts added to Active Directory and other anomolous AD events. -search: '`wineventlog_security` EventCode=4624 Logon_Type=3 Authentication_Package=Kerberos action=success src_ip=127.0.0.1 -| stats count min(_time) as firstTime max(_time) as lastTime by dest, subject, action, Security_ID, user, Account_Name, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `windows_kerberos_local_successful_logon_filter`' +datamodel: [] +description: The following analytic identifies a local successful authentication event + on a Windows endpoint using the Kerberos package. The target user security identified + will be set to the built-in local Administrator account, along with the remote address + as localhost - 127.0.0.1. This may be indicative of a kerberos relay attack. Upon + triage, review for recently ran binaries on disk. In addition, look for new computer + accounts added to Active Directory and other anomolous AD events. +search: '`wineventlog_security` EventCode=4624 Logon_Type=3 Authentication_Package=Kerberos + action=success src_ip="127.0.0.1" | stats count min(_time) as firstTime max(_time) + as lastTime by dest, subject, action, Security_ID, user, Account_Name, src_ip | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_kerberos_local_successful_logon_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. -known_false_positives: False positives are possible, filtering may be required to restrict to workstations vs domain controllers. Filter as needed. +known_false_positives: False positives are possible, filtering may be required to + restrict to workstations vs domain controllers. Filter as needed. references: - https://github.com/Dec0ne/KrbRelayUp tags: @@ -34,7 +39,8 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack. + message: A successful localhost Kerberos authentication event occurred on $dest$, + possibly indicative of Kerberos relay attack. mitre_attack_id: - T1558 nist: diff --git a/detections/endpoint/windows_krbrelayup_service_creation.yml b/detections/endpoint/windows_krbrelayup_service_creation.yml index 84854233a7..0fbdff6666 100644 --- a/detections/endpoint/windows_krbrelayup_service_creation.yml +++ b/detections/endpoint/windows_krbrelayup_service_creation.yml @@ -4,17 +4,18 @@ version: 1 date: '2022-05-02' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic identifies the default service name created by KrbRelayUp. Defenders should be aware that attackers could change the hardcoded service name of the KrbRelayUp tool and bypass this detection. -search: '`wineventlog_system` EventCode=7045 Service_Name IN ("KrbSCM") | stats count min(_time) as firstTime max(_time) as lastTime by - EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +datamodel: [] +description: The following analytic identifies the default service name created by + KrbRelayUp. Defenders should be aware that attackers could change the hardcoded + service name of the KrbRelayUp tool and bypass this detection. +search: '`wineventlog_system` EventCode=7045 Service_Name IN ("KrbSCM") | stats count + min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name + Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_krbrelayup_service_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows System Event Logs with 7045 EventCode enabled. The Windows TA is also - required. -known_false_positives: False positives should be limited as this is specific to KrbRelayUp based attack. Filter as needed. + Windows System Event Logs with 7045 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives should be limited as this is specific to KrbRelayUp + based attack. Filter as needed. references: - https://github.com/Dec0ne/KrbRelayUp tags: @@ -51,8 +52,8 @@ tags: - _time - EventCode - Service_File_Name - - Service_Name - - Service_Start_Type + - Service_Name + - Service_Start_Type - Service_Type risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index e9ae4599fc..49c836c996 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -4,16 +4,15 @@ version: 1 date: '2022-04-25' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain organizational unit for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText + = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" | stats + count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText + Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index 89f4216af9..59da14355a 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -5,24 +5,25 @@ date: '2022-06-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic is to identify a modification in the Windows registry - to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying - user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important - update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion - and execution. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + to disable toast notifications. This Windows Operating System feature is responsible + for alerting or notifying user if application or OS need some updates. Adversaries + and malwares like Azorult abuse this technique to disable important update notification + in compromised host. This anomaly detection is a good pivot to look for further + events related to defense evasion and execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" + Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user + Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ @@ -66,4 +67,4 @@ tags: - Registry.registry_value_name - Registry.action risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index 26c251dd52..eaf8e5127f 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -5,23 +5,24 @@ date: '2022-06-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic identifies a modification in the Windows registry - to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are - sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring - in terms of volume write. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`' + to disable Windows Defender raw write notification feature. This policy controls + whether raw volume write notifications are sent to behavior monitoring or not. This + registry was recently identified in Azorult malware to bypass Windows Defender detections + or behavior monitoring in terms of volume write. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows + Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data + Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive. Filter as needed. references: - https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ @@ -42,7 +43,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: The registry for raw write notification settings was modified to disable in $dest$. + message: The registry for raw write notification settings was modified to disable + in $dest$. mitre_attack_id: - T1112 nist: @@ -65,4 +67,4 @@ tags: - Registry.registry_value_name - Registry.action risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index 40838cefad..cbbe0140ff 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -5,24 +5,25 @@ date: '2022-06-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic is to identify a modification in the Windows registry - to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying - user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important - update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion - and execution. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + to disable windows center notifications. This Windows Operating System feature is + responsible for alerting or notifying user if application or OS need some updates. + Adversaries and malwares like Azorult abuse this technique to disable important + update notification in compromised host. This anomaly detection is a good pivot + to look for further events related to defense evasion and execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" + Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user + Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ @@ -43,7 +44,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: the registry for security center notification settings was modified to disable mode in $dest$ + message: the registry for security center notification settings was modified to + disable mode in $dest$ mitre_attack_id: - T1112 nist: diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index 8f0e4853e4..0689408f9c 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -5,23 +5,24 @@ date: '2022-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic identifies a modification in the Windows registry - to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems - encountered in specific application or processes. Adversaries use this technique to hide any - error or failure that some of its malicious components trigger. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_modify_registry_disabling_wer_settings_filter`' + to disable Windows error reporting settings. This Windows feature allows the user + to report bugs, errors, failure or problems encountered in specific application + or processes. Adversaries use this technique to hide any error or failure that some + of its malicious components trigger. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows + Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_data Registry.action + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_modify_registry_disabling_wer_settings_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive, however is not common. Filter as needed. references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ @@ -65,4 +66,4 @@ tags: - Registry.registry_value_name - Registry.action risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index a9b11801cb..1f3213e2a1 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -5,23 +5,24 @@ date: '2022-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic identifies modification in the Windows registry - to prevent user running specific computer programs that could aid them in manually removing malware or detecting it - using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute - on the compromised host machine. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + to prevent user running specific computer programs that could aid them in manually + removing malware or detecting it using security products. This technique was recently + identified in Azorult malware where it uses this registry value to prevent several + AV products to execute on the compromised host machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" + Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user + Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disallow_windows_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -64,4 +65,4 @@ tags: - Registry.registry_value_name - Registry.action risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index c4d436842c..898d32c43d 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -5,25 +5,28 @@ date: '2022-06-24' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint -description: The following analytic identifies modification of Windows registry - using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. - This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with - dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") - AND Processes.process="* /s *" AND Processes.process="*.reg*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_modify_registry_regedit_silent_reg_import_filter`' +- Endpoint.Processes +description: The following analytic identifies modification of Windows registry using + regedit.exe application with silent mode parameter. regedit.exe windows application + is commonly used as GUI app to check or modify registry. This application is also + has undocumented command-line parameter and one of those are silent mode parameter + that performs action without stopping for confirmation with dialog box. Importing + registry from .reg files need to monitor in a production environment since it can + be used adversaries to import RMS registry in compromised host. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") + AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed. +known_false_positives: Administrators may execute this command that may cause some + false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe @@ -44,7 +47,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: The regedit app was executed with silet mode parameter to import .reg file on $dest$. + message: The regedit app was executed with silet mode parameter to import .reg file + on $dest$. mitre_attack_id: - T1112 nist: @@ -72,4 +76,4 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 9f431cf99b..1c26e0fd59 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -5,23 +5,24 @@ date: '2022-06-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic is to identify a modification in the Windows registry - to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender - on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features - as part of its malicious behavior. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_modify_registry_suppress_win_defender_notif_filter`' + to suppress windows defender notification. This technique was abuse by adversaries + and threat actor to bypassed windows defender on the targeted host. Azorult malware + is one of the malware use this technique that also disable toast notification and + other windows features as part of its malicious behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows + Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data + Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ @@ -42,7 +43,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$ + message: the registry for suppresing windows fdefender notification settings was + modified to disabled in $dest$ mitre_attack_id: - T1112 nist: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index c7538027c5..8de92f2919 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -5,7 +5,8 @@ date: '2022-03-02' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to look for suspicious registry modification related to file compression color and information tips. This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index d8d851af0f..c7247dde10 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -5,28 +5,35 @@ date: '2022-07-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. - Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. - A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. - The default path of mofcomp.exe is C:\Windows\System32\wbem. +- Endpoint.Processes +description: The following anaytic identifies MOFComp.exe loading a MOF file. The + Managed Object Format (MOF) compiler parses a file containing MOF statements and + adds the classes and class instances defined in the file to the WMI repository. + Typically, MOFComp.exe does not reach out to the public internet or load a MOF file + from User Profile paths. A filter and consumer is typically registered in WMI. Review + parallel processes and query WMI subscriptions to gather artifacts. The default + path of mofcomp.exe is C:\Windows\System32\wbem. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where - (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) - OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_mof_event_triggered_execution_via_wmi_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + IN ("cmd.exe", "powershell.exe") Processes.process_name="mofcomp.exe") OR (Processes.process_name="mofcomp.exe" + Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present from automation based applications + (SCCM), filtering may be required. In addition, break the query out based on volume + of usage. Filter process names or f references: - - https://attack.mitre.org/techniques/T1546/003/ - - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp - - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ - - https://www.sakshamdixit.com/wmi-events/ +- https://attack.mitre.org/techniques/T1546/003/ +- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ +- https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp +- https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ +- https://www.sakshamdixit.com/wmi-events/ tags: analytic_story: - Living Off The Land @@ -44,7 +51,8 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ loading a MOF file. mitre_attack_id: - T1546.003 nist: @@ -74,14 +82,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 64 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index a928508c8f..6e84d2cfd2 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -5,22 +5,26 @@ date: '2022-06-14' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. +- Endpoint.Processes +description: The following analytic identifies the usage of msiexec.exe using the + /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msiexec` - Processes.process IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_msiexec_dllregisterserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process + IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: This analytic will need to be tuned for your environment based + on legitimate usage of msiexec.exe. Filter as needed. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -38,7 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to register a file. mitre_attack_id: - T1218.007 nist: @@ -68,14 +73,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 69ba719e45..d7bb4bce65 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -5,22 +5,26 @@ date: '2022-06-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it. - During triage, review parallel processes and capture any artifacts on disk for review. +- Endpoint.Processes +description: The following analytic identifies msiexec.exe with http in the command-line. + This procedure will utilize msiexec.exe to download a remote file and load it. During + triage, review parallel processes and capture any artifacts on disk for review. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*http://*", "*https://*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_msiexec_remote_download_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present, filter by destination or parent process as needed. + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process + IN ("*http://*", "*https://*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present, filter by destination or parent + process as needed. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -38,7 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to download a remote file. mitre_attack_id: - T1218.007 nist: @@ -68,14 +73,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index 2d34188916..fb073a87a8 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -5,21 +5,28 @@ date: '2022-06-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies MSIExec spawning multiple discovery commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes are not common from MSIExec other than MSIExec spawning itself. +- Endpoint.Processes +description: The following analytic identifies MSIExec spawning multiple discovery + commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes + are not common from MSIExec other than MSIExec spawning itself. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="msiexec.exe" + Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_spawn_discovery_command_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives will be present with MSIExec spawning Cmd or + PowerShell. Filtering will be needed. In addition, add other known discovery processes + to enhance query. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -37,7 +44,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ running different discovery commands. mitre_attack_id: - T1218.007 nist: @@ -67,14 +75,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 594212f96d..0aea395cd5 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -5,21 +5,26 @@ date: '2022-06-14' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. +- Endpoint.Processes +description: The following analytic identifies the usage of msiexec.exe using the + /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_msiexec` - Processes.process IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` + as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process + IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: This analytic will need to be tuned for your environment based + on legitimate usage of msiexec.exe. Filter as needed. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -37,7 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to unregister a file. mitre_attack_id: - T1218.007 nist: @@ -67,14 +73,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/endpoint/windows_msiexec_with_network_connections.yml index 9541707b9c..4dd42f85a2 100644 --- a/detections/endpoint/windows_msiexec_with_network_connections.yml +++ b/detections/endpoint/windows_msiexec_with_network_connections.yml @@ -5,22 +5,31 @@ date: '2022-06-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies MSIExec with any network connection over port 443 or 80. Typically, MSIExec does not perform network communication to the internet. +- Endpoint.Processes +- Network_Traffic.All_Traffic +description: The following analytic identifies MSIExec with any network connection + over port 443 or 80. Typically, MSIExec does not perform network communication to + the internet. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_msiexec` by _time Processes.process_id - Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] - | table _time dest parent_process_name process_name process_path process process_id dest_port dest_ip - | `windows_msiexec_with_network_connections_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Add parent process as a filter, filter known good processes. This may be voluminous due to the join on process_id. All_Traffic does not have process_guid, yet. + where `process_msiexec` by _time Processes.process_id Processes.process_name Processes.dest + Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest + All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] + | table _time dest parent_process_name process_name process_path process process_id + dest_port dest_ip | `windows_msiexec_with_network_connections_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. Add parent process as a filter, filter known good processes. This + may be voluminous due to the join on process_id. All_Traffic does not have process_guid, + yet. known_false_positives: False positives will be present and filtering is required. references: - - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: analytic_story: - Windows System Binary Proxy Execution MSIExec @@ -38,7 +47,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination. + message: An instance of $process_name$ was identified on endpoint $dest$ contacting + a remote destination. mitre_attack_id: - T1218.007 nist: @@ -65,16 +75,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - _time - Processes.process_id - - Processes.process_name - - Processes.dest - - Processes.process_path + - Processes.process_name + - Processes.dest + - Processes.process_path - Processes.process - Processes.parent_process_name - All_Traffic.process_id - - All_Traffic.dest - - All_Traffic.dest_port + - All_Traffic.dest + - All_Traffic.dest_port - All_Traffic.dest_ip risk_score: 35 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 2f65850cd5..b0e1eea5a1 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -5,7 +5,7 @@ date: '2022-01-21' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec. AdvancedRun may also ingest a configuration file with all settings defined and perform its activity. diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 70debdbfe3..96a50b7de6 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -5,7 +5,7 @@ date: '2022-01-24' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic assists with identifying the proces execution of commonly used utilities from NirSoft. Potentially not adversary behavior, but worth identifying to know if the software is present and being used. diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index 37601bb4ca..804bf3aa57 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -5,16 +5,21 @@ date: '2022-06-30' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint -description: The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe. +- Endpoint.Processes +description: The following analytic identifies Odbcconf.exe running in the environment + to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_odbcconf_hunting_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives will be present as this is meant to assist with filtering and tuning. + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="odbcconf.exe" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_hunting_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives will be present as this is meant to assist + with filtering and tuning. references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw @@ -39,7 +44,8 @@ tags: - T1218.008 nist: - DE.CM - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to circumvent controls. observable: - name: user type: User @@ -65,11 +71,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index ae7b78d362..d8d6119e84 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -5,20 +5,24 @@ date: '2022-06-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. - An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. - During triage, review parent process, parallel procesess and file modifications. +- Endpoint.Processes +description: The following analytic identifies odbcconf.exe, Windows Open Database + Connectivity utility, utilizing the action function of regsvr to load a DLL. An + example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, + review parent process, parallel procesess and file modifications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe - Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_odbcconf_load_dll_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed. + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="odbcconf.exe" + Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present and filtering may need to occur + based on legitimate application usage. Filter as needed. references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw @@ -43,7 +47,8 @@ tags: - T1218.008 nist: - DE.CM - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to circumvent controls. observable: - name: user type: User @@ -69,11 +74,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 74d58ef9f2..dcbd46b86b 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -5,19 +5,25 @@ date: '2022-06-30' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. - During triage, review file modifications and parallel processes. +- Endpoint.Processes +description: The following analytic identifies the odbcconf.exe, Windows Open Database + Connectivity utility, loading up a resource file. The file extension is arbitrary + and may be named anything. The resource file itself may have different commands + supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. + During triage, review file modifications and parallel processes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe - Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_odbcconf_load_response_file_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed. + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="odbcconf.exe" + Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present and filtering may need to occur + based on legitimate application usage. Filter as needed. references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw @@ -42,7 +48,8 @@ tags: - T1218.008 nist: - DE.CM - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to circumvent controls. observable: - name: user type: User @@ -68,11 +75,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index fe9ec16b7a..927513412a 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -5,25 +5,33 @@ date: '2022-05-30' author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. - During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. +- Endpoint.Processes +description: The following analytic identifies a Microsoft Office product spawning + the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native + to Windows. This behavior is related to a recently identified sample utilizing protocol + handlers to evade preventative controls, including if macros are disabled in the + document. During triage, review file modifications for html. In addition, parallel + processes including PowerShell and CertUtil. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `windows_office_product_spawning_msdt_filter`' -how_to_implement: how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") + Processes.process_name="msdt.exe" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`' +how_to_implement: how To successfully implement this search you need to be ingesting + information on process that include the name of the process responsible for the + changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. known_false_positives: False positives should be limited, however filter as needed. references: - - https://isc.sans.edu/diary/rss/28694 - - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A - - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection - - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +- https://isc.sans.edu/diary/rss/28694 +- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e +- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection +- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html tags: analytic_story: - Spearphishing Attachments @@ -44,8 +52,8 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: Office parent process $parent_process_name$ has spawned a child - process $process_name$ on host $dest$. + message: Office parent process $parent_process_name$ has spawned a child process + $process_name$ on host $dest$. mitre_attack_id: - T1566 - T1566.001 @@ -76,14 +84,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 100 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml index 1b6154261e..50fd09e609 100644 --- a/detections/endpoint/windows_powershell_import_applocker_policy.yml +++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml @@ -4,20 +4,20 @@ version: 1 date: '2022-06-30' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint -description: The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. - This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker - commandlet. -search: '`powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy *" ScriptBlockText="* -XMLPolicy *" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_powershell_import_applocker_policy_filter`' +datamodel: [] +description: The following analytic is to identify the imports of Windows PowerShell + Applocker commandlets. This technique was seen in Azorult malware where it drops + an xml Applocker policy that will deny several AV product and then loaded using + PowerShell Applocker commandlet. +search: '`powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy + *" ScriptBlockText="* -XMLPolicy *" | stats count min(_time) as firstTime max(_time) + as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_powershell_import_applocker_policy_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: administrators may execute this command that may cause some false positive. +known_false_positives: administrators may execute this command that may cause some + false positive. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 8d08e15fbd..e7fc303e0c 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -5,7 +5,7 @@ date: '2022-02-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for process commandline that contains named pipe. This technique was seen in some adversaries, threat actor and malware like olympic destroyer to communicate to its other child processes after process injection diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml index fc55d84a0a..9548b79613 100644 --- a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml +++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml @@ -4,22 +4,22 @@ version: 1 date: '2022-04-22' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint -description: The following analytic is to look for known processes killed by industroyer2 malware. - This technique was seen in the industroyer2 malware attack that tries to kill several processes - of windows host machines related to the energy facility network. This anomaly might be a good - indicator to check which process kill these processes or why the process was killed. -search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") - | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `windows_processes_killed_by_industroyer2_malware_filter`' +datamodel: [] +description: The following analytic is to look for known processes killed by industroyer2 + malware. This technique was seen in the industroyer2 malware attack that tries to + kill several processes of windows host machines related to the energy facility network. + This anomaly might be a good indicator to check which process kill these processes + or why the process was killed. +search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") + | stats min(_time) as firstTime max(_time) as lastTime count by process_name process + process_path process_guid process_id EventCode dest user_id | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `windows_processes_killed_by_industroyer2_malware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are - allowed to terminate this process during testing or updates. Filter as needed based on paths that - are used legitimately. + allowed to terminate this process during testing or updates. Filter as needed based + on paths that are used legitimately. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ tags: diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index 9657c96b7b..3ca926571c 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -5,7 +5,7 @@ date: '2021-12-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 67e4176896..ef0ae582c3 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -5,7 +5,7 @@ date: '2022-02-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 6afbb6c2d8..ed7acfcc2e 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-02-25' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytic is to look for suspicious raw access read to device disk partition of the host machine. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the boot sector of each partition diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 02a0890fa9..6fa1b16f14 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-02-17' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record @@ -28,7 +27,7 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - Data Destruction + - Data Destruction - Caddy Wiper - WhisperGate - Hermetic Wiper diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index 775a61ffcd..be1ddb19ed 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -5,23 +5,34 @@ date: '2022-03-31' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: 'The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. - The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "\Blob" as this indicates the direct installation or modification of a root certificate binary blob. - The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.' +- Endpoint.Processes +- Endpoint.Registry +description: The following analytic identifies installation of a root CA certificate + by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). + In short, there are specific certificate registry paths that will be written to + (SetValue) when a new certificate is added. The high-fidelity events to pay attention + to are SetValue events where the TargetObject property ends with "\Blob" + as this indicates the direct installation or modification of a root certificate + binary blob. The other high fidelity reference will be which process is making the + registry modifications. There are very few processes that modify these day to day, + therefore monitoring for all to start (hunting) provides a great beginning. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob" - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` - | join process_guid _time - [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid - | `drop_dm_object_name(Processes)`] - | table - _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name - | `windows_registry_certificate_added_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint. + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.process_guid Registry.registry_key_name Registry.registry_value_data | + `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] + | table _time dest user process_name process process_guid registry_path registry_value_name + registry_value_data registry_key_name | `windows_registry_certificate_added_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. +known_false_positives: False positives will be limited to a legitimate business applicating + consistently adding new root certificates to the endpoint. Filter by user, process, + or thumbprint. references: - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004 @@ -42,7 +53,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A root certificate was added on $dest$. + message: A root certificate was added on $dest$. mitre_attack_id: - T1553.004 - T1553 @@ -63,11 +74,11 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name + - Processes.process_id + - Processes.process_name - Processes.process - Processes.dest - - Processes.process_guid + - Processes.process_guid risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml index 37e045b7b4..e823c6e2e1 100644 --- a/detections/endpoint/windows_registry_delete_task_sd.yml +++ b/detections/endpoint/windows_registry_delete_task_sd.yml @@ -5,19 +5,28 @@ date: '2022-04-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. - This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. - In addition, in order to perform this action, the user context will need to be SYSTEM. +- Endpoint.Registry +description: The following analytic identifies a process attempting to delete a scheduled + task SD (Security Descriptor) from within the registry path of that task. This may + occur from a non-standard process running and may not come from reg.exe. This particular + behavior will remove the actual Task Name from the Task Scheduler GUI and from the + command-line query - schtasks.exe /query. In addition, in order to perform this + action, the user context will need to be SYSTEM. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified) - by _time Registry.dest Registry.process_guid Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data Registry.status Registry.action - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_registry_delete_task_sd_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel. + where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" + Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified) + by _time Registry.dest Registry.process_guid Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data + Registry.status Registry.action | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_registry_delete_task_sd_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as the activity is not common + to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified + or Deleted values based on product that is in the datamodel. references: - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ - https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728 @@ -45,7 +54,7 @@ tags: - T1562 nist: - DE.CM - message: A scheduled task security descriptor was deleted from the registry on $dest$. + message: A scheduled task security descriptor was deleted from the registry on $dest$. observable: - name: dest type: Endpoint @@ -61,10 +70,10 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name + - Processes.process_id + - Processes.process_name - Processes.process - Processes.dest - - Processes.process_guid + - Processes.process_guid risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index cc5223ce80..c87dd5964a 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -5,20 +5,23 @@ date: '2022-03-31' author: Teoderick Contreras, Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal and Network. - adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. +- Endpoint.Processes +- Endpoint.Registry +description: The following analytic identifies a modification or registry add to the + safeboot registry as an autostart mechanism. This technique is utilized by adversaries + to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal + and Network. adding values to Minimal will load into Safe Mode and by adding into + Network it will provide the service or drive the ability to perform network connections + in Safe Mode. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") - by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` - | join process_guid _time - [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid - | `drop_dm_object_name(Processes)`] - | table - _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name - | `windows_registry_modification_for_safe_mode_persistence_filter`' + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.process_guid Registry.registry_key_name Registry.registry_value_data | + `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] + | table _time dest user process_name process process_guid registry_path registry_value_name + registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -66,11 +69,11 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name + - Processes.process_id + - Processes.process_name - Processes.process - Processes.dest - - Processes.process_guid + - Processes.process_guid risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_remote_access_software_rms_registry.yml b/detections/endpoint/windows_remote_access_software_rms_registry.yml index 57082efcb2..29d44595a6 100644 --- a/detections/endpoint/windows_remote_access_software_rms_registry.yml +++ b/detections/endpoint/windows_remote_access_software_rms_registry.yml @@ -5,22 +5,23 @@ date: '2022-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic is to identify a modification or creation of Windows registry - related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and - has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SYSTEM\\Remote Manipulator System*" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_access_software_rms_registry_filter`' +- Endpoint.Registry +description: The following analytic is to identify a modification or creation of Windows + registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is + a legitimate tool developed by russian organization TektonIT and has been observed + being abused by adversaries to gain remote access to the targeted host. Azorult + malware utilized RMS to gain remote access. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote + Manipulator System*" by Registry.registry_key_name Registry.user Registry.registry_path + Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://malpedia.caad.fkie.fraunhofer.de/details/win.rms diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index 63380cf941..e3d78d0fc3 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -5,7 +5,7 @@ date: '2022-02-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml index 099b29e6a9..08219b40f3 100644 --- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -5,24 +5,26 @@ date: '2022-06-24' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote - desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries - to enable RDP connection to the targeted host for remote access and potentially be for lateral movement. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") - AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_service_rdpwinst_tool_execution_filter`' +- Endpoint.Processes +description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper + library tool designed to enable remote desktop host support and concurrent RDP session + on reduced functionality system. Unfortunately, this open project was abused by + adversaries to enable RDP connection to the targeted host for remote access and + potentially be for lateral movement. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") + AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: This tool was designed for home usage and not commonly seen in production environment. Filter as needed. +known_false_positives: This tool was designed for home usage and not commonly seen + in production environment. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -71,4 +73,4 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 81 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml index d17c147471..dc3477ab57 100644 --- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -5,27 +5,29 @@ date: '2022-06-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic is to identify a modification in the Windows firewall - to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer - to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some - production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits - of attack to start lateral movement. + to enable remote desktop protocol on a targeted machine. This technique was seen + in several adversaries, malware or red teamer to remotely access the compromised + or targeted host by allowing this protocol in firewall. Even this protocol might + be allowed in some production environment, This TTP behavior is a good pivot to + check who and why the user want to enable this feature through firewall which is + also common traits of attack to start lateral movement. search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" - AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name + where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") + AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process + = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process + = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_services_allow_rdp_in_firewall_filter`' + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml index fa07ebad2d..8dd6390c7f 100644 --- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -5,24 +5,27 @@ date: '2022-06-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic is to identify a modification in the Windows registry - to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer - like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some - production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. - And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_services_allow_remote_assistance_filter`' + to enable remote desktop assistance on a targeted machine. This technique was seen + in several adversaries, malware or red teamer like azorult to remotely access the + compromised or targeted host by enabling this protocol in registry. Even this protocol + might be allowed in some production environment, This Anomaly behavior is a good + pivot to check who and why the user want to enable this feature through registry + which is un-common. And as per stated in microsoft documentation the default value + of this registry is false that makes this a good indicator of suspicious behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal + Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_data Registry.action + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_remote_services_allow_remote_assistance_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml index bda36548db..b9c1853338 100644 --- a/detections/endpoint/windows_remote_services_rdp_enable.yml +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -5,23 +5,26 @@ date: '2022-06-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: The following analytic is to identify a modification in the Windows registry - to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer - to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some - production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_services_rdp_enable_filter`' + to enable remote desktop protocol on a targeted machine. This technique was seen + in several adversaries, malware or red teamer to remotely access the compromised + or targeted host by enabling this protocol in registry. Even this protocol might + be allowed in some production environment, This TTP behavior is a good pivot to + check who and why the user want to enable this feature through registry which is + un-common. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal + Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_data Registry.action + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_remote_services_rdp_enable_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. references: - https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100 tags: diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index be57e9229a..d1a19d88a6 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -4,17 +4,15 @@ version: 1 date: '2022-04-25' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate root domain linked policies for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_root_domain_linked_policies_discovery_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText + = "*.SearchRooT*" ScriptBlockText = "*.gplink*" | stats count min(_time) as firstTime + max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_root_domain_linked_policies_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index f8e182e452..8ab2bc3669 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -5,7 +5,7 @@ date: '2022-02-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state. diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index 8a79d7c9e5..2cb2b7b543 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -4,8 +4,8 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: -- Endpoint +datamodel: +- Endpoint.Processes description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/windows_service_create_kernel_mode_driver.yml b/detections/endpoint/windows_service_create_kernel_mode_driver.yml index fabd2ecd2d..3826a1781f 100644 --- a/detections/endpoint/windows_service_create_kernel_mode_driver.yml +++ b/detections/endpoint/windows_service_create_kernel_mode_driver.yml @@ -5,18 +5,23 @@ date: '2022-05-05' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifes a new kernel driver being added to Windows using sc.exe. - Adding a Kernel driver is not common day to day and should be investigated to further understand the source. +- Endpoint.Processes +description: The following analytic identifes a new kernel driver being added to Windows + using sc.exe. Adding a Kernel driver is not common day to day and should be investigated + to further understand the source. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe - Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_create_kernel_mode_driver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present based on common applications adding new drivers, however, filter as needed. + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sc.exe" + Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_service_create_kernel_mode_driver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present based on common applications + adding new drivers, however, filter as needed. references: - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ tags: @@ -36,7 +41,8 @@ tags: impact: 60 kill_chain_phases: - Installation - message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$. + message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ + by $user$. mitre_attack_id: - T1543.003 - T1543 @@ -61,11 +67,11 @@ tags: - Processes.dest - Processes.user - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id risk_score: 48 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index ecbc98cdec..4273587286 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -5,7 +5,7 @@ date: '2021-11-10' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `sc.exe` with command-line arguments utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index c41790becd..9f4f1e2ddb 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -5,7 +5,8 @@ date: '2022-02-23' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to look for suspicious modification or creation of registry to have service entry. This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. This technique diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 6287b03f83..2a9a492788 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -5,7 +5,7 @@ date: '2021-11-10' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `sc.exe` with command-line arguments utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index f63fa31cd7..ef8a4b3e7b 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -5,19 +5,19 @@ date: '2022-06-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_service_stop_by_deletion_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = "sc.exe" OR Processes.original_file_name = "sc.exe") + Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml index b6684439c0..b6a662ecb1 100644 --- a/detections/endpoint/windows_system_file_on_disk.yml +++ b/detections/endpoint/windows_system_file_on_disk.yml @@ -5,16 +5,23 @@ date: '2022-05-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint -description: The following hunting analytic will assist with identifying new .sys files introduced in the environment. This query is meant to identify sys file creates on disk. There will be noise, but reducing common process names or applications should help to limit any volume. - The idea is to identify new sys files written to disk and identify them before they're added as a new kernel mode driver. +- Endpoint.Filesystem +description: The following hunting analytic will assist with identifying new .sys + files introduced in the environment. This query is meant to identify sys file creates + on disk. There will be noise, but reducing common process names or applications + should help to limit any volume. The idea is to identify new sys files written to + disk and identify them before they're added as a new kernel mode driver. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.sys*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.file_hash -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)`| `windows_system_file_on_disk_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. - In addition, filtering may occur by adding NOT (Filesystem.file_path IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). This will level out the noise generated to potentally lead to generating notables. + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.sys*" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.file_hash | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_system_file_on_disk_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path + IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). + This will level out the noise generated to potentally lead to generating notables. known_false_positives: False positives will be present. Filter as needed. references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ @@ -26,7 +33,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 50 + confidence: 50 context: - Source:Endpoint - Stage:Persistence @@ -54,8 +61,8 @@ tags: - Processes.dest - Processes.user - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_valid_account_with_never_expires_password.yml index 3740ca82ba..a110f69f10 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/endpoint/windows_valid_account_with_never_expires_password.yml @@ -5,24 +5,26 @@ date: '2022-06-23' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. - This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and - possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users - executes on the machines. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` - AND Processes.process="* accounts *" AND Processes.process="* /maxpwage:unlimited" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +- Endpoint.Processes +description: The following analytic identifies net.exe updating user account policies + for password requirement with non-expiring password. This technique was seen in + several adversaries and malware like Azorult to maintain the foothold (persistence), + gaining privilege escalation, defense evasion and possible for lateral movement + for specific users or created user account on the targeted host. This TTP detections + is a good pivot to see further what other events that users executes on the machines. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` AND Processes.process="* accounts *" AND Processes.process="* + /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: This behavior is not commonly seen in production environment and not advisable, filter as needed. +known_false_positives: This behavior is not commonly seen in production environment + and not advisable, filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems @@ -73,4 +75,4 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 100 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index a645c9e324..f6d460369b 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -5,7 +5,7 @@ date: '2022-02-22' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for wmi commandlines to execute or create process. This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. This hunting query is a good pivot to start to diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index a021bdb930..2755774e5f 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-10-19' author: Michael Haag, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index b35c3e261c..38b21a0fa4 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-10-05' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 21e94183e9..721d6f9a94 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -5,7 +5,7 @@ date: '2021-04-22' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 26500a08b9..4b52d45028 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 89d781fbc0..6610e411c7 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 1347d23b7a..ab333e0ff3 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml index f9d2521fa7..49c05a54c6 100644 --- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -5,14 +5,13 @@ date: '2022-07-19' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint -description: This analytic indentifies WMIC command-line attempting to uninstall - application non-interactively. This technique was seen in IceID to uninstall AV - products on the compromised host to evade detection. This Hunting - query maybe a good indicator that some process tries to uninstall application using - wmic which is not a common behavior. This approach may seen in some script or third - part appication to uninstall their application but it is a good thing to check what - it uninstall and why. +- Endpoint.Processes +description: This analytic indentifies WMIC command-line attempting to uninstall application + non-interactively. This technique was seen in IceID to uninstall AV products on + the compromised host to evade detection. This Hunting query maybe a good indicator + that some process tries to uninstall application using wmic which is not a common + behavior. This approach may seen in some script or third part appication to uninstall + their application but it is a good thing to check what it uninstall and why. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" Processes.process="* product *" Processes.process="*where name*" Processes.process="*call @@ -42,7 +41,8 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software. + message: Wmic $process_name$ with command-line $process$ on $dest$ attempting to + uninstall software. mitre_attack_id: - T1562.001 - T1562 diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index f763f5093c..d514d7b31e 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index f71013a51e..474c605ecc 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index b4ca683e4b..ded9456217 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -5,7 +5,7 @@ date: '2021-10-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies a suspicious spawned process by WScript or CScript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other scripts like PowerShell or spawn a suspended process diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index aff68b7fbc..440c9e9211 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Windows Remote Management (WinRm) protocol, the executed command is spawned as a diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index fc659965a8..e199c9bad0 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -5,7 +5,8 @@ date: '2020-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 7ecdf7bdfb..f48556271a 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-29' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index b1e1d43adf..5535f1af1a 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 637bc9ad6b..91ca706e39 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -5,7 +5,7 @@ date: '2021-01-14' author: Bhavin Patel, Splunk type: TTP datamodel: -- Network_Resolution +- Network_Resolution.DNS description: Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to @@ -13,8 +13,9 @@ description: Malicious actors often abuse legitimate Dynamic DNS services to hos analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer - min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host | `drop_dm_object_name("DNS")` - | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' + min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host + | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers` + | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index a2cd18d618..29a7530361 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -5,7 +5,7 @@ date: '2021-12-13' author: Bhavin Patel, Johan Bjerke, Splunk type: Hunting datamodel: -- Network_Traffic +- Network_Traffic.All_Traffic description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine @@ -13,10 +13,10 @@ description: Malicious actors often abuse misconfigured LDAP servers or applicat space. search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port - = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = "10.0.0.0/8" OR - All_Traffic.dest_ip="192.168.0.0/16" OR All_Traffic.dest_ip = "172.16.0.0/12") by All_Traffic.src_ip - All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip - | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)` + = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = "10.0.0.0/8" + OR All_Traffic.dest_ip="192.168.0.0/16" OR All_Traffic.dest_ip = "172.16.0.0/12") + by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` + | where src_ip != dest_ip | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)` |`detect_outbound_ldap_traffic_filter`' how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format and should be mapped to the diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 200362565c..6f7513b198 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -5,7 +5,7 @@ date: '2021-10-06' author: Bhavin Patel, Splunk type: Anomaly datamodel: -- Network_Resolution +- Network_Resolution.DNS description: This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. diff --git a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml index f15c01bac0..f76d3f029a 100644 --- a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml +++ b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml @@ -5,26 +5,28 @@ date: '2022-05-10' author: Michael Haag, Splunk type: TTP datamodel: -- Web -description: The following analytic identifies a recent unauthenticated remote code execution vulnerablity against the F5 BIG-IP iControl REST API. The analytic identifies the URI path found in the POCs and the HTTP Method of POST. - In addition, the request header will have the commands that may be executed in fields utilcmdargs and the auth field of X-F5-Auth-Token, which may have a random base64 encoded value. -search: '| tstats count from datamodel=Web where - Web.url="*/mgmt/tm/util/bash*" Web.http_method="POST" by Web.http_user_agent Web.http_method, Web.url,Web.url_length - Web.src, Web.dest | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`' +- Web.Web +description: The following analytic identifies a recent unauthenticated remote code + execution vulnerablity against the F5 BIG-IP iControl REST API. The analytic identifies + the URI path found in the POCs and the HTTP Method of POST. In addition, the request + header will have the commands that may be executed in fields utilcmdargs and the + auth field of X-F5-Auth-Token, which may have a random base64 encoded value. +search: '| tstats count from datamodel=Web.Web where Web.url="*/mgmt/tm/util/bash*" + Web.http_method="POST" by Web.http_user_agent Web.http_method, Web.url,Web.url_length + Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`' how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good. -known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed. +known_false_positives: False positives may be present if the activity is blocked or + was not successful. Filter known vulnerablity scanners. Filter as needed. references: - - https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml - - https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388 - - https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ - - https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py +- https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml +- https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/ +- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388 +- https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ +- https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py tags: analytic_story: - F5 BIG-IP Vulnerability CVE-2022-1388 @@ -41,7 +43,8 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred. + message: An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has + occurred. mitre_attack_id: - T1190 cve: diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 2406e5f37e..7ac197d7cb 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-21' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Network_Traffic +datamodel: [] description: This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index cb131c6700..be90b980d9 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-22' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Network_Traffic +datamodel: [] description: This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index dd0f5134ec..c0bfe905ff 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -5,24 +5,32 @@ date: '2022-06-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint -description: The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). - During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. -search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") - by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype - | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter`' +- Web.Web +description: The following analytic assists with identifying CVE-2022-26134 based + exploitation utilizing the Web datamodel to cover network and CIM compliant web + logs. The parameters were captured from live scanning and the POC provided by Rapid7. + This analytic is written against multiple proof of concept codes released and seen + in the wild (scanning). During triage, review any endpoint based logs for further + activity including writing a jsp file to disk and commands/processes spawning running + as root from the Confluence process. +search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web.Web + where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" + Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") + OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest + sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter`' how_to_implement: This detection requires the Web datamodel to be populated from a - supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. -known_false_positives: Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. + supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, + network based logs or event data like PAN Threat. +known_false_positives: Tune based on assets if possible, or restrict to known Confluence + servers. Remove the ${ for a more broad query. To identify more exec, remove everything + up to the last parameter (Runtime().exec) for a broad query. references: - - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html - - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html - - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ - - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ +- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html +- https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html +- https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ +- https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ tags: analytic_story: - Atlassian Confluence Server and Data Center CVE-2022-26134 @@ -41,7 +49,8 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. + message: A URL was requested related to CVE-2022-26134, a unauthenticated remote + code execution vulnerability, on $dest$ by $src$. mitre_attack_id: - T1505 - T1190 diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index b215579384..0ec1c3f79e 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -5,7 +5,7 @@ date: '2021-12-13' author: Jose Hernandez type: Anomaly datamodel: -- Web +- Web.Web description: CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index 03ebd5363c..8ec36332d5 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -5,8 +5,8 @@ date: '2021-12-13' author: Jose Hernandez type: Anomaly datamodel: -- Network_Traffic -- Web +- Network_Traffic.All_Traffic +- Web.Web description: CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml index 775e50f351..98d91b2383 100644 --- a/detections/web/spring4shell_payload_url_request.yml +++ b/detections/web/spring4shell_payload_url_request.yml @@ -8,7 +8,7 @@ datamodel: - Web description: The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity. -search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") +search: '| tstats count from datamodel=Web.Web where Web.http_method IN ("GET") Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml index 62edaaec13..ae1522656a 100644 --- a/detections/web/vmware_server_side_template_injection_hunt.yml +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -5,27 +5,28 @@ date: '2022-05-19' author: Michael Haag, Splunk type: Hunting datamodel: -- Web -description: The following hunting analytic identifies the server side template injection related to CVE-2022-22954, however is a variation found within the same endpoint of the URL scheme. -search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") - Web.url="*deviceudid=*" AND Web.url IN ("*java.lang.ProcessBuilder*","*freemarker.template.utility.ObjectConstructor*") - by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype - | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `vmware_server_side_template_injection_hunt_filter`' +- Web.Web +description: The following hunting analytic identifies the server side template injection + related to CVE-2022-22954, however is a variation found within the same endpoint + of the URL scheme. +search: '| tstats count from datamodel=Web.Web where Web.http_method IN ("GET") Web.url="*deviceudid=*" + AND Web.url IN ("*java.lang.ProcessBuilder*","*freemarker.template.utility.ObjectConstructor*") + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest + sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `vmware_server_side_template_injection_hunt_filter`' how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good. -known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed. +known_false_positives: False positives may be present if the activity is blocked or + was not successful. Filter known vulnerablity scanners. Filter as needed. references: - - https://www.cisa.gov/uscert/ncas/alerts/aa22-138b - - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb - - https://github.com/sherlocksecurity/VMware-CVE-2022-22954 - - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis - - https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433 +- https://www.cisa.gov/uscert/ncas/alerts/aa22-138b +- https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb +- https://github.com/sherlocksecurity/VMware-CVE-2022-22954 +- https://www.vmware.com/security/advisories/VMSA-2022-0011.html +- https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis +- https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433 tags: analytic_story: - VMware Server Side Injection and Privilege Escalation @@ -34,7 +35,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - cve: + cve: - CVE-2022-22954 confidence: 50 context: @@ -44,7 +45,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. + message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on + $dest$ has occurred. mitre_attack_id: - T1190 nist: diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml index b13bdb98c7..46c3c80b36 100644 --- a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml +++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml @@ -5,27 +5,29 @@ date: '2022-05-19' author: Michael Haag, Splunk type: Anomaly datamodel: -- Web -description: The following analytic identifies the server side template injection related to CVE-2022-22954. Based on the scanning activity across the internet and proof of concept code available the template injection occurs at catalog-portal/ui/oauth/verify?error=&deviceudid=. - Upon triage, review parallel processes and VMware logs. Following the deviceudid= may be a command to be executed. Capture any file creates and review modified files on disk. -search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") - Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*" AND Web.url="*freemarker.template.utility.Execute*" - by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype - | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `vmware_workspace_one_freemarker_server_side_template_injection_filter`' +- Web.Web +description: The following analytic identifies the server side template injection + related to CVE-2022-22954. Based on the scanning activity across the internet and + proof of concept code available the template injection occurs at catalog-portal/ui/oauth/verify?error=&deviceudid=. + Upon triage, review parallel processes and VMware logs. Following the deviceudid= + may be a command to be executed. Capture any file creates and review modified files + on disk. +search: '| tstats count from datamodel=Web.Web where Web.http_method IN ("GET") Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*" + AND Web.url="*freemarker.template.utility.Execute*" by Web.http_user_agent Web.http_method, + Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vmware_workspace_one_freemarker_server_side_template_injection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good. -known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed. +known_false_positives: False positives may be present if the activity is blocked or + was not successful. Filter known vulnerablity scanners. Filter as needed. references: - - https://www.cisa.gov/uscert/ncas/alerts/aa22-138b - - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb - - https://github.com/sherlocksecurity/VMware-CVE-2022-22954 - - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis +- https://www.cisa.gov/uscert/ncas/alerts/aa22-138b +- https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb +- https://github.com/sherlocksecurity/VMware-CVE-2022-22954 +- https://www.vmware.com/security/advisories/VMSA-2022-0011.html +- https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis tags: analytic_story: - VMware Server Side Injection and Privilege Escalation @@ -34,7 +36,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - cve: + cve: - CVE-2022-22954 confidence: 70 context: @@ -44,7 +46,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. + message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on + $dest$ has occurred. mitre_attack_id: - T1190 nist: diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml index a64b5a5800..83e09a44d6 100644 --- a/detections/web/web_jsp_request_via_url.yml +++ b/detections/web/web_jsp_request_via_url.yml @@ -5,19 +5,20 @@ date: '2022-04-05' author: Michael Haag, Splunk type: TTP datamodel: -- Web -description: The following analytic identifies the common URL requests used by a recent CVE - CVE-2022-22965, or Spring4Shell, to access a webshell on the remote webserver. - The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity. -search: '| tstats count from datamodel=Web.Web where Web.http_method IN ("GET") - Web.url IN ("*.jsp?cmd=*","*j&cmd=*") - by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest - sourcetype - | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `web_jsp_request_via_url_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. -known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers. +- Web.Web +description: The following analytic identifies the common URL requests used by a recent + CVE - CVE-2022-22965, or Spring4Shell, to access a webshell on the remote webserver. + The filename and cmd are arbitrary in this exploitation. Java will write a JSP to + disk and a process will spawn from Java based on the cmd passed. This is indicative + of typical web shell activity. +search: '| tstats count from datamodel=Web.Web where Web.http_method IN ("GET") Web.url + IN ("*.jsp?cmd=*","*j&cmd=*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length + Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `web_jsp_request_via_url_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on Web traffic that include fields relavent for traffic into the `Web` datamodel. +known_false_positives: False positives may be present with legitimate applications. + Attempt to filter by dest IP or use Asset groups to restrict to servers. references: - https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/ - https://github.com/TheGejr/SpringShell @@ -40,7 +41,8 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: A suspicious URL has been requested against $dest$ by $src$, related to web shell activity. + message: A suspicious URL has been requested against $dest$ by $src$, related to + web shell activity. mitre_attack_id: - T1505.003 - T1505 diff --git a/detections/web/web_spring4shell_http_request_class_module.yml b/detections/web/web_spring4shell_http_request_class_module.yml index 04365c9289..b7df3096ac 100644 --- a/detections/web/web_spring4shell_http_request_class_module.yml +++ b/detections/web/web_spring4shell_http_request_class_module.yml @@ -4,19 +4,21 @@ version: 1 date: '2022-04-06' author: Michael Haag, Splunk type: TTP -datamodel: -- Web -description: The following analytic identifies the payload related to Spring4Shell, CVE-2022-22965. This analytic uses Splunk Stream HTTP to view the http request body, form data. STRT reviewed all the current proof of concept code and determined the commonality with the payloads being passed used the same fields "class.module.classLoader.resources.context.parent.pipeline.first". -search: '`stream_http` http_method IN ("POST") - | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out - | search http_request_body IN ("*class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=_*", "*class.module.classLoader.resources.context.parent.pipeline.first.pattern*","*suffix=.jsp*") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `web_spring4shell_http_request_class_module_filter`' +datamodel: [] +description: The following analytic identifies the payload related to Spring4Shell, + CVE-2022-22965. This analytic uses Splunk Stream HTTP to view the http request body, + form data. STRT reviewed all the current proof of concept code and determined the + commonality with the payloads being passed used the same fields "class.module.classLoader.resources.context.parent.pipeline.first". +search: '`stream_http` http_method IN ("POST") | stats values(form_data) as http_request_body + min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent + uri_path url bytes_in bytes_out | search http_request_body IN ("*class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=_*", + "*class.module.classLoader.resources.context.parent.pipeline.first.pattern*","*suffix=.jsp*") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_spring4shell_http_request_class_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled. -known_false_positives: False positives may occur and filtering may be required. Restrict analytic to asset type. +known_false_positives: False positives may occur and filtering may be required. Restrict + analytic to asset type. references: - https://github.com/DDuarte/springshell-rce-poc/blob/master/poc.py tags: @@ -37,7 +39,8 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: A http body request related to Spring4Shell has been sent to $dest$ by $src$. + message: A http body request related to Spring4Shell has been sent to $dest$ by + $src$. mitre_attack_id: - T1190 nist: @@ -60,11 +63,9 @@ tags: - http_request_body - http_method - http_user_agent - - uri_path - - url - - bytes_in + - uri_path + - url + - bytes_in - bytes_out risk_score: 72 security_domain: network - - diff --git a/detections/web/web_spring_cloud_function_functionrouter.yml b/detections/web/web_spring_cloud_function_functionrouter.yml index e0f32da0fc..9f72d058cc 100644 --- a/detections/web/web_spring_cloud_function_functionrouter.yml +++ b/detections/web/web_spring_cloud_function_functionrouter.yml @@ -5,19 +5,22 @@ date: '2022-04-05' author: Michael Haag, Splunk type: TTP datamodel: -- Web -description: The following analytic identifies activity related to the web application Spring Cloud Function that was recently idenfied as vulnerable. This is CVE-2022-22963. - Multiple proof of concept code was released. - The URI that is hit includes `functionrouter`. The specifics of the exploit include a status of 500. In this query we did not include it, but for filtering you can add Web.status=500. - The exploit data itself (based on all the POCs) is located in the form_data field. This field will include all class.modules being called. +- Web.Web +description: The following analytic identifies activity related to the web application + Spring Cloud Function that was recently idenfied as vulnerable. This is CVE-2022-22963. + Multiple proof of concept code was released. The URI that is hit includes `functionrouter`. + The specifics of the exploit include a status of 500. In this query we did not include + it, but for filtering you can add Web.status=500. The exploit data itself (based + on all the POCs) is located in the form_data field. This field will include all + class.modules being called. search: '| tstats count from datamodel=Web.Web where Web.http_method IN ("POST") Web.url="*/functionRouter*" - by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest Web.status sourcetype - | `drop_dm_object_name("Web")` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `web_spring_cloud_function_functionrouter_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. -known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers. + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest + Web.status sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `web_spring_cloud_function_functionrouter_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on Web traffic that include fields relavent for traffic into the `Web` datamodel. +known_false_positives: False positives may be present with legitimate applications. + Attempt to filter by dest IP or use Asset groups to restrict to servers. references: - https://github.com/rapid7/metasploit-framework/pull/16395 - https://github.com/hktalent/spring-spel-0day-poc @@ -39,7 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud. + message: A suspicious URL has been requested against $dest$ by $src$, related to + a vulnerability in Spring Cloud. mitre_attack_id: - T1190 nist: