From 518d03b1a1041c27b776919e369e817f2b3d35ad Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Fri, 25 Jun 2021 14:48:48 -0400 Subject: [PATCH 1/8] Detection looks for excessive number of sc.exe start as disabled calls --- ...r_of_service_control_start_as_disabled.yml | 48 +++++++++++++++++++ ...service_control_start_as_disabled.test.yml | 13 +++++ 2 files changed, 61 insertions(+) create mode 100644 detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml create mode 100644 tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml new file mode 100644 index 0000000000..adf705fe61 --- /dev/null +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -0,0 +1,48 @@ +name: Excessive number of service control start as disabled +id: 77592bec-d5cc-11eb-9e60-acde48001122 +version: 1 +date: '2021-06-25' +author: Michael Hart, Splunk +type: batch +datamodel: +- Endpoint +description: This detection targets behaviors observed when threat actors have used sc.exe to modify services. + We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to + impair defenses, possibly to block others from compromising the same machine. This detection will alert when we + see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start + of certain services. +search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines + min(_time) as firstTime max(_time) as lastTime + FROM datamodel=Endpoint.Processes + WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" + BY Processes.dest, Processes.user, _time span=30m + | where distinct_cmdlines >= 8 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_number_of_service_control_start_as_disabled_filter`' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must be ingesting + logs with both the process name and command line from your endpoints. The complete + process name with command-line arguments are mapped to the "process" field in the + Endpoint data model. +known_false_positives: Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is + possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than + seven times in a short period of time. +references: +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml new file mode 100644 index 0000000000..a3fbdf8086 --- /dev/null +++ b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml @@ -0,0 +1,13 @@ +name: Excessive number of service control start as disabled Unit Test +tests: +- name: Excessive number of service control start as disabled + file: detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: True From 98a7b4e3ff2b87e2fdaf23df71a92c599290ec13 Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Fri, 25 Jun 2021 14:56:08 -0400 Subject: [PATCH 2/8] Adding references --- .../excessive_number_of_service_control_start_as_disabled.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index adf705fe61..05d0cc7fcc 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -30,6 +30,8 @@ known_false_positives: Legitimate programs and administrators will execute sc.ex possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. references: + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create + - https://attack.mitre.org/techniques/T1562/001/ tags: analytic_story: - Windows Defense Evasion Tactics From 1a26fc38e38506f9c00f87d1be33efdcb3d1b72f Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Fri, 25 Jun 2021 15:00:46 -0400 Subject: [PATCH 3/8] contentctl puts relative link to detection file in wrong place --- ...cessive_number_of_service_control_start_as_disabled.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml index a3fbdf8086..1010dbbc73 100644 --- a/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml +++ b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml @@ -1,7 +1,7 @@ name: Excessive number of service control start as disabled Unit Test tests: - name: Excessive number of service control start as disabled - file: detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml + file: endpoint/excessive_number_of_service_control_start_as_disabled.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From d184ff8b1e3614599c74905077fc6856fb34b1eb Mon Sep 17 00:00:00 2001 From: root Date: Fri, 25 Jun 2021 19:29:17 +0000 Subject: [PATCH 4/8] Added detection testing service results inExcessive number of service control start as disabled --- ...r_of_service_control_start_as_disabled.yml | 41 +++++++++---------- 1 file changed, 20 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 05d0cc7fcc..6d57c14b66 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -6,32 +6,30 @@ author: Michael Hart, Splunk type: batch datamodel: - Endpoint -description: This detection targets behaviors observed when threat actors have used sc.exe to modify services. - We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to - impair defenses, possibly to block others from compromising the same machine. This detection will alert when we - see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start - of certain services. -search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines - min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Processes - WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" - BY Processes.dest, Processes.user, _time span=30m - | where distinct_cmdlines >= 8 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_number_of_service_control_start_as_disabled_filter`' +description: This detection targets behaviors observed when threat actors have used + sc.exe to modify services. We observed malware in a honey pot spawning numerous + sc.exe processes in a short period of time, presumably to impair defenses, possibly + to block others from compromising the same machine. This detection will alert when + we see both an excessive number of sc.exe processes launched with specific commandline + arguments to disable the start of certain services. +search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) + as distinct_cmdlines min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" + BY Processes.dest, Processes.user, _time span=30m | where distinct_cmdlines >= 8 + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `excessive_number_of_service_control_start_as_disabled_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -known_false_positives: Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is - possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than - seven times in a short period of time. +known_false_positives: Legitimate programs and administrators will execute sc.exe + with the start disabled flag. It is possible, but unlikely from the telemetry of + normal Windows operation we observed, that sc.exe will be called more than seven + times in a short period of time. references: - - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create - - https://attack.mitre.org/techniques/T1562/001/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create +- https://attack.mitre.org/techniques/T1562/001/ tags: analytic_story: - Windows Defense Evasion Tactics @@ -47,4 +45,5 @@ tags: - Splunk Cloud required_fields: - _time - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed From ae269feb4b4551b5db21de6a9fab5895d21e34a7 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Jun 2021 10:35:01 -0600 Subject: [PATCH 5/8] Update excessive_number_of_service_control_start_as_disabled.yml --- .../excessive_number_of_service_control_start_as_disabled.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 6d57c14b66..ed9e4c7566 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -45,5 +45,7 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.process_name + - Processes.user security_domain: endpoint automated_detection_testing: passed From bfa5d036aec7741444f5607bd31f2a12077c01d6 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Jun 2021 10:35:29 -0600 Subject: [PATCH 6/8] Update excessive_number_of_service_control_start_as_disabled.yml --- .../excessive_number_of_service_control_start_as_disabled.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index ed9e4c7566..67d217b4c8 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -47,5 +47,6 @@ tags: - _time - Processes.process_name - Processes.user + - Processes.process security_domain: endpoint automated_detection_testing: passed From f10bdb4742e9d06a280d16aebd01d5ff44c4b8da Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Jun 2021 11:34:18 -0600 Subject: [PATCH 7/8] Update excessive_number_of_service_control_start_as_disabled.yml --- ...ve_number_of_service_control_start_as_disabled.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 67d217b4c8..d17ebf885d 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -15,7 +15,8 @@ description: This detection targets behaviors observed when threat actors have u search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" - BY Processes.dest, Processes.user, _time span=30m | where distinct_cmdlines >= 8 + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id, _time span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`' how_to_implement: You must be ingesting data that records process activity from your @@ -45,8 +46,12 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.user + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint automated_detection_testing: passed From d9c8e1092036c8a374d5115c3ad65368fb7eaf3d Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Mon, 28 Jun 2021 14:14:42 -0400 Subject: [PATCH 8/8] Slight correction. Process contains cmd line arguments for finding distinct number of sc invocations. Removing this and process id from BY clause --- ...xcessive_number_of_service_control_start_as_disabled.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index d17ebf885d..41a2b336b0 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -13,10 +13,10 @@ description: This detection targets behaviors observed when threat actors have u we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) - as distinct_cmdlines min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id, _time span=30m | where distinct_cmdlines >= 8 + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, + _time span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`' how_to_implement: You must be ingesting data that records process activity from your