update detections

detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml

@@ -12,7 +12,20 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu
   The LOLBAS project documents Windows native binaries that can be abused by threat actors to
   perform tasks like executing malicious code. Looking for child processes of mmc.exe
   that are part of the LOLBAS project can help defenders identify lateral movement activity.
-search: '| UPDATE_SPL | `mmc_lolbas_execution_process_spawn_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", 
+  "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe",
+  "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe",
+  "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe",
+  "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe",
+  "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe",
+  "Pcalua.exe", "Msconfig.exe"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.

detections/endpoint/services_exe_lolbas_execution_process_spawn.yml

@@ -12,13 +12,26 @@ description: The following analytic identifies `services.exe` spawning a LOLBAS
   The LOLBAS project documents Windows native binaries that can be abused by threat actors to
   perform tasks like executing malicious code. Looking for child processes of services.exe
   that are part of the LOLBAS project can help defenders identify lateral movement activity.
-search: '| UPDATE_SPL | `services_lolbas_execution_process_spawn_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=services.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", 
+  "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe",
+  "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe",
+  "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe",
+  "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe",
+  "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe",
+  "Pcalua.exe", "Msconfig.exe"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
-- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1543.003
+- https://attack.mitre.org/techniques/T1543/003/
 - https://pentestlab.blog/2020/07/21/lateral-movement-services/
 - https://lolbas-project.github.io/
 tags:

detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml

@@ -12,12 +12,27 @@ description: The following analytic identifies `svchost.exe` spawning a LOLBAS e
   The LOLBAS project documents Windows native binaries that can be abused by threat actors to
   perform tasks like executing malicious code. Looking for child processes of svchost.exe
   that are part of the LOLBAS project can help defenders identify lateral movement activity.
-search: '| UPDATE_SPL | `svchost_lolbas_execution_process_spawn_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", 
+  "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe",
+  "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe",
+  "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe",
+  "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe",
+  "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe",
+  "Pcalua.exe", "Msconfig.exe"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://www.ired.team/offensive-security/persistence/t1053-schtask 
 - https://lolbas-project.github.io/
 tags:
   analytic_story:

detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml

@@ -12,12 +12,27 @@ description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS
   The LOLBAS project documents Windows native binaries that can be abused by threat actors to
   perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe
   that are part of the LOLBAS project can help defenders identify lateral movement activity.
-search: '| UPDATE_SPL | `wmiprsve_lolbas_execution_process_spawn_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", 
+  "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe",
+  "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe",
+  "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe",
+  "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe",
+  "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe",
+  "Pcalua.exe", "Msconfig.exe"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
+- https://attack.mitre.org/techniques/T1047/
+- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement
 - https://lolbas-project.github.io/
 tags:
   analytic_story:

detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml

@@ -12,13 +12,28 @@ description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLB
   The LOLBAS project documents Windows native binaries that can be abused by threat actors to
   perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe
   that are part of the LOLBAS project can help defenders identify lateral movement activity.
-search: '| UPDATE_SPL | `wsmprovhost_lolbas_execution_process_spawn_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wsmprovhost.exe)
+  (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", 
+  "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe",
+  "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
+  "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe",
+  "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe",
+  "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
+  "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe",
+  "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe",
+  "Pcalua.exe", "Msconfig.exe"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
+- https://attack.mitre.org/techniques/T1021/006/
 - https://lolbas-project.github.io/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
   - Lateral Movement

stories/lateral_movement.yml

@@ -1,8 +1,8 @@
 name: Lateral Movement
 id: 399d65dc-1f08-499b-a259-aad9051f38ad
 version: 2
-date: '2020-02-04'
-author: David Dorsey, Splunk
+date: '2021-11-23'
+author: David Dorsey, Mauricio Velazco Splunk
 description: Detect and investigate tactics, techniques, and procedures around how
   attackers move laterally within the enterprise. Because lateral movement can expose
   the adversary to detection, it should be an important focus for security analysts.
@@ -32,6 +32,7 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek
   \ for all processes to ensure that the attackers did not install unauthorized software."
 references:
 - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
+- https://www.youtube.com/watch?v=hVTkkkM9XDg
 tags:
   analytic_story: Lateral Movement
   category: