Branch was auto-updated.

detections/endpoint/windows_proxy_via_netsh.yml

@@ -0,0 +1,73 @@
+name: Windows Proxy Via Netsh
+id: c137bfe8-6036-4cff-b77b-4e327dd0a1cf
+version: 1
+date: '2023-05-25'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon Event ID 1
+description: This search looks for processes launching netsh.exe for connection proxy. Netsh is a command-line
+  scripting utility that allows you to, either locally or remotely, display or modify
+  the network configuration of a computer that is currently running. Netsh can be
+  used as a persistence proxy technique to execute a helper DLL when netsh.exe is
+  executed. In this search, we are looking for processes spawned by netsh.exe and
+  executing commands via the command line.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where `process_netsh` Processes.process = "* portproxy *" Processes.process = "* v4tov4 *" by Processes.parent_process_name Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.user Processes.dest
+  |`drop_dm_object_name("Processes")` 
+  |`security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)` 
+  | `windows_proxy_via_netsh_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
+  of these instances, it is unusual for an executable to launch netsh.exe and run
+  commands.
+references:
+- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
+tags:
+  analytic_story:
+  - Volt Typhoon
+  asset_type: Endpoint
+  atomic_guid:
+  - b8223ea9-4be2-44a6-b50a-9657a3d4e72a
+  confidence: 70
+  impact: 70
+  message: A process $process_name$ has launched netsh with command-line $process$
+    on $dest$.
+  mitre_attack_id:
+  - T1090.001
+  - T1090
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_proxy_via_registry.yml

@@ -0,0 +1,69 @@
+name: Windows Proxy Via Registry
+id: 0270455b-1385-4579-9ac5-e77046c508ae
+version: 1
+date: '2023-05-25'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
+description: This search looks for processes launching netsh.exe for connection proxy. Netsh is a command-line
+  scripting utility that allows you to, either locally or remotely, display or modify
+  the network configuration of a computer that is currently running. Netsh can be
+  used as a persistence proxy technique to execute a helper DLL when netsh.exe is
+  executed. In this search, we are looking for processes spawned by netsh.exe and
+  executing commands via the command line.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path ="*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*" 
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.action Registry.dest  Registry.user
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)` 
+  | `drop_dm_object_name(Registry)` 
+  | `windows_proxy_via_registry_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
+  Sysmon TA. https://splunkbase.splunk.com/app/5709
+known_false_positives: unknown
+references:
+- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
+tags:
+  analytic_story:
+  - Volt Typhoon
+  asset_type: Endpoint
+  atomic_guid:
+  - b8223ea9-4be2-44a6-b50a-9657a3d4e72a
+  confidence: 70
+  impact: 70
+  message: A registry modification for port proxy in$dest$
+  mitre_attack_id:
+  - T1090.001
+  - T1090
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog