From 69c1de8e5e6d9e978f58cbff4643e987a8a6ac13 Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Tue, 8 Jun 2021 10:01:32 -0400 Subject: [PATCH 1/5] Initial import of the detection and story for support --- ...excessive_number_of_taskhost_processes.yml | 51 +++++++++++++++++++ stories/meterpreter.yml | 33 ++++++++++++ 2 files changed, 84 insertions(+) create mode 100644 detections/endpoint/excessive_number_of_taskhost_processes.yml create mode 100644 stories/meterpreter.yml diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml new file mode 100644 index 0000000000..3d54440927 --- /dev/null +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -0,0 +1,51 @@ +name: Excessive number of taskhost processes +id: f443dac2-c7cf-11eb-ab51-acde48001122 +version: 1 +date: '2021-06-07' +author: Michael Hart +type: batch +datamodel: +- Endpoint +description: This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run + in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes + to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations + to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. +search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime + FROM datamodel=Endpoint.Processes + WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" + BY Processes.dest Processes.user Processes.process_name _time span=1h + | `drop_dm_object_name(Processes)` + | eval pid_count=mvcount(process_ids) + | eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0) + | eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0) + | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count by _time, dest, user + | where taskhost_count > 10 and taskhostex_count > 10 + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `excessive_number_of_taskhost_processes_filter`' +how_to_implement: To successfully implement this search you need to be ingesting events related to + processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the + `Processes` node. +known_false_positives: Administrators, administrative actions or certain applications may run many instances of taskhost and + taskhostex concurrently. Filter as needed. +references: + - https://attack.mitre.org/software/S0250/ +tags: + analytic_story: + - Meterpreter + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_tools/meterpreter/taskhost_processes/excessive.taskhost.taskhostex.processes.json + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1033 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_id + - Processes.process_name + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/stories/meterpreter.yml b/stories/meterpreter.yml new file mode 100644 index 0000000000..a1e59398fc --- /dev/null +++ b/stories/meterpreter.yml @@ -0,0 +1,33 @@ +name: Meterpreter +id: d5f8e298-c85a-11eb-9fea-acde48001122 +version: 1 +date: '2021-06-08' +author: Michael Hart +type: batch +description: Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. +narrative: 'This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. +Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software +runs in memory, no new processes are created upon injection. It also leverages encrypted communication channels. + +Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, +and much more. It is difficult to determine from the forensic evidence what actions the operator performed. Splunk Research, however, has observed +anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands. With that, we have written new +detections targeted to these detections. + +While investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior. It will be +imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised +and a remote actor used it to progress on their objectives.' +references: +- https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/ +- https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/ +- https://www.rapid7.com/products/metasploit/ +tags: + analytic_story: + - Meterpreter + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 144bcaff801aaab2a5dd3a705350f811e4fa4f60 Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Wed, 9 Jun 2021 14:20:03 -0400 Subject: [PATCH 2/5] Adding in test file --- ...excessive_number_of_taskhost_processes.yml | 22 +++++++++---------- ...sive_number_of_taskhost_processes.test.yml | 13 +++++++++++ 2 files changed, 24 insertions(+), 11 deletions(-) create mode 100644 tests/endpoint/excessive_number_of_taskhost_processes.test.yml diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 3d54440927..0f2f5459f2 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -11,17 +11,17 @@ description: This detection targets behaviors observed in post exploit kits like to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Processes - WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" - BY Processes.dest Processes.user Processes.process_name _time span=1h - | `drop_dm_object_name(Processes)` - | eval pid_count=mvcount(process_ids) - | eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0) - | eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0) - | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count by _time, dest, user - | where taskhost_count > 10 and taskhostex_count > 10 - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `excessive_number_of_taskhost_processes_filter`' + FROM datamodel=Endpoint.Processes + WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" + BY Processes.dest Processes.process_name _time span=1h +| `drop_dm_object_name(Processes)` +| eval pid_count=mvcount(process_ids) +| eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0) +| eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0) +| stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count by _time, dest, firstTime, lastTime +| where taskhost_count > 10 and taskhostex_count > 10 +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +| `excessive_number_of_taskhost_processes_filter`' how_to_implement: To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node. diff --git a/tests/endpoint/excessive_number_of_taskhost_processes.test.yml b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml new file mode 100644 index 0000000000..c4fa903896 --- /dev/null +++ b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml @@ -0,0 +1,13 @@ +name: Excessive number of taskhost processes Unit Test +tests: +- name: Excessive number of taskhost processes + file: detections/endpoint/excessive_number_of_taskhost_processes.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file From af4eff8cb59ea58a05c6598bb07b581cfad9db5f Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Wed, 9 Jun 2021 14:57:17 -0400 Subject: [PATCH 3/5] Fixing file reference name --- tests/endpoint/excessive_number_of_taskhost_processes.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/excessive_number_of_taskhost_processes.test.yml b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml index c4fa903896..8fc97f291b 100644 --- a/tests/endpoint/excessive_number_of_taskhost_processes.test.yml +++ b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml @@ -1,7 +1,7 @@ name: Excessive number of taskhost processes Unit Test tests: - name: Excessive number of taskhost processes - file: detections/endpoint/excessive_number_of_taskhost_processes.yml + file: endpoint/excessive_number_of_taskhost_processes.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 990b3cd13ac043d3d7245666827e70fff1276b80 Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Wed, 9 Jun 2021 16:10:03 -0400 Subject: [PATCH 4/5] Fixing analytic story yaml --- stories/meterpreter.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/stories/meterpreter.yml b/stories/meterpreter.yml index a1e59398fc..8e51ee26cf 100644 --- a/stories/meterpreter.yml +++ b/stories/meterpreter.yml @@ -6,17 +6,17 @@ author: Michael Hart type: batch description: Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. narrative: 'This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. -Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software -runs in memory, no new processes are created upon injection. It also leverages encrypted communication channels. + Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software + runs in memory, no new processes are created upon injection. It also leverages encrypted communication channels.\ -Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, -and much more. It is difficult to determine from the forensic evidence what actions the operator performed. Splunk Research, however, has observed -anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands. With that, we have written new -detections targeted to these detections. + Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, + and much more. It is difficult to determine from the forensic evidence what actions the operator performed. Splunk Research, however, has observed + anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands. With that, we have written new + detections targeted to these detections.\ -While investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior. It will be -imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised -and a remote actor used it to progress on their objectives.' + While investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior. It will be + imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised + and a remote actor used it to progress on their objectives.' references: - https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/ - https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/ From 56a065240b535cda7e9307762633b0622155193e Mon Sep 17 00:00:00 2001 From: root Date: Wed, 9 Jun 2021 20:58:34 +0000 Subject: [PATCH 5/5] Added detection testing service results inExcessive number of taskhost processes --- ...excessive_number_of_taskhost_processes.yml | 47 ++++++++++--------- 1 file changed, 24 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 0f2f5459f2..73de664b0d 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -6,34 +6,34 @@ author: Michael Hart type: batch datamodel: - Endpoint -description: This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run - in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes - to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations - to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. -search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Processes +description: This detection targets behaviors observed in post exploit kits like Meterpreter + and Koadic that are run in memory. We have observed that these tools must invoke + an excessive number of taskhost.exe and taskhostex.exe processes to complete various + actions (discovery, lateral movement, etc.). It is extremely uncommon in the course + of normal operations to see so many distinct taskhost and taskhostex processes running + concurrently in a short time frame. +search: '| tstats `security_content_summariesonly` values(Processes.process_id) as + process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" - BY Processes.dest Processes.process_name _time span=1h -| `drop_dm_object_name(Processes)` -| eval pid_count=mvcount(process_ids) -| eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0) -| eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0) -| stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count by _time, dest, firstTime, lastTime -| where taskhost_count > 10 and taskhostex_count > 10 -| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `excessive_number_of_taskhost_processes_filter`' -how_to_implement: To successfully implement this search you need to be ingesting events related to - processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the - `Processes` node. -known_false_positives: Administrators, administrative actions or certain applications may run many instances of taskhost and - taskhostex concurrently. Filter as needed. + BY Processes.dest Processes.process_name _time span=1h | `drop_dm_object_name(Processes)` + | eval pid_count=mvcount(process_ids) | eval taskhost_count_=if(process_name == + "taskhost.exe", pid_count, 0) | eval taskhostex_count_=if(process_name == "taskhostex.exe", + pid_count, 0) | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) + as taskhostex_count by _time, dest, firstTime, lastTime | where taskhost_count > + 10 and taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `excessive_number_of_taskhost_processes_filter`' +how_to_implement: To successfully implement this search you need to be ingesting events + related to processes on the endpoints that include the name of the process and process + id into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators, administrative actions or certain applications + may run many instances of taskhost and taskhostex concurrently. Filter as needed. references: - - https://attack.mitre.org/software/S0250/ +- https://attack.mitre.org/software/S0250/ tags: analytic_story: - Meterpreter dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_tools/meterpreter/taskhost_processes/excessive.taskhost.taskhostex.processes.json + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -48,4 +48,5 @@ tags: - Processes.process_name - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed