From 5211a97f11f8b2d8468bcc2344810b0cbdd28fa7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 16:00:04 -0500 Subject: [PATCH] update detections --- .../mmc_exe_lolbas_execution_process_spawn.yml | 15 ++++++++++++++- ...vices_exe_lolbas_execution_process_spawn.yml | 17 +++++++++++++++-- ...chost_exe_lolbas_execution_process_spawn.yml | 17 ++++++++++++++++- ...prsve_exe_lolbas_execution_process_spawn.yml | 17 ++++++++++++++++- ...vhost_exe_lolbas_execution_process_spawn.yml | 17 ++++++++++++++++- stories/lateral_movement.yml | 5 +++-- 6 files changed, 80 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index 80be6033a1..102ba04994 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -12,7 +12,20 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `mmc_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index 9c50e99be9..f3779cc136 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -12,13 +12,26 @@ description: The following analytic identifies `services.exe` spawning a LOLBAS The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `services_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=services.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: -- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1543.003 +- https://attack.mitre.org/techniques/T1543/003/ - https://pentestlab.blog/2020/07/21/lateral-movement-services/ - https://lolbas-project.github.io/ tags: diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index c77688aa58..e849074b07 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -12,12 +12,27 @@ description: The following analytic identifies `svchost.exe` spawning a LOLBAS e The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `svchost_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ired.team/offensive-security/persistence/t1053-schtask - https://lolbas-project.github.io/ tags: analytic_story: diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index d42c078ce6..190313322e 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -12,12 +12,27 @@ description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `wmiprsve_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: +- https://attack.mitre.org/techniques/T1047/ +- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement - https://lolbas-project.github.io/ tags: analytic_story: diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index c461f666d6..afb7353178 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -12,13 +12,28 @@ description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLB The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `wsmprovhost_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wsmprovhost.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: +- https://attack.mitre.org/techniques/T1021/006/ - https://lolbas-project.github.io/ +- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - Lateral Movement diff --git a/stories/lateral_movement.yml b/stories/lateral_movement.yml index f5ac2aa14b..b245f947c7 100644 --- a/stories/lateral_movement.yml +++ b/stories/lateral_movement.yml @@ -1,8 +1,8 @@ name: Lateral Movement id: 399d65dc-1f08-499b-a259-aad9051f38ad version: 2 -date: '2020-02-04' -author: David Dorsey, Splunk +date: '2021-11-23' +author: David Dorsey, Mauricio Velazco Splunk description: Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. @@ -32,6 +32,7 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek \ for all processes to ensure that the attackers did not install unauthorized software." references: - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html +- https://www.youtube.com/watch?v=hVTkkkM9XDg tags: analytic_story: Lateral Movement category: