From cbc3611298c3ccfa981062c363c291d6e1dd0eba Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 25 Feb 2022 14:28:31 -0700 Subject: [PATCH 1/4] The Blizzard of Haag --- .../windows_disable_memory_crash_drump.yml | 85 +++++++++++++++++++ ...indows_disable_memory_crash_drump.test.yml | 12 +++ 2 files changed, 97 insertions(+) create mode 100644 detections/endpoint/windows_disable_memory_crash_drump.yml create mode 100644 tests/endpoint/windows_disable_memory_crash_drump.test.yml diff --git a/detections/endpoint/windows_disable_memory_crash_drump.yml b/detections/endpoint/windows_disable_memory_crash_drump.yml new file mode 100644 index 0000000000..3d71bc22ad --- /dev/null +++ b/detections/endpoint/windows_disable_memory_crash_drump.yml @@ -0,0 +1,85 @@ +name: Windows Disable Memory Crash Drump +id: 59e54602-9680-11ec-a8a6-acde48001122 +version: 1 +date: '2022-02-25' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a process that is attempting to disable the ability on Windows to prevent a memory crash dump. This was recently identified being utilized by HermeticWiper. + To disable crash dumps, the value must be set to 0. + This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check). +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` + |join process_guid [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.parent_process_name Processes.parent_process + Processes.process_guid | `drop_dm_object_name(Processes)` | fields _time dest user parent_process_name parent_process process_name + process_path process process_guid registry_path registry_value_name registry_value_data + registry_key_name] | table _time dest user parent_process_name parent_process process_name + process_path process process_guid registry_path registry_value_name registry_value_data + registry_key_name | `windows_disable_memory_crash_drump_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: + - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options +tags: + analytic_story: + - Data Destruction + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + - Filesystem.dest + security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - source:endpoint + - stage:Persistence + - Privilege Escalation + message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 diff --git a/tests/endpoint/windows_disable_memory_crash_drump.test.yml b/tests/endpoint/windows_disable_memory_crash_drump.test.yml new file mode 100644 index 0000000000..e2e66c7725 --- /dev/null +++ b/tests/endpoint/windows_disable_memory_crash_drump.test.yml @@ -0,0 +1,12 @@ +name: Windows Disable Memory Crash Drump Unit Test +tests: +- name: Windows Disable Memory Crash Drump + file: endpoint/windows_disable_memory_crash_drump.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 54054b2d09e1e932c07fc2316cb5091a437b63d3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 25 Feb 2022 14:31:01 -0700 Subject: [PATCH 2/4] Drump to Dump --- ..._crash_drump.yml => windows_disable_memory_crash_dump.yml} | 4 ++-- ...mp.test.yml => windows_disable_memory_crash_dump.test.yml} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{windows_disable_memory_crash_drump.yml => windows_disable_memory_crash_dump.yml} (96%) rename tests/endpoint/{windows_disable_memory_crash_drump.test.yml => windows_disable_memory_crash_dump.test.yml} (79%) diff --git a/detections/endpoint/windows_disable_memory_crash_drump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml similarity index 96% rename from detections/endpoint/windows_disable_memory_crash_drump.yml rename to detections/endpoint/windows_disable_memory_crash_dump.yml index 3d71bc22ad..6bf0eead37 100644 --- a/detections/endpoint/windows_disable_memory_crash_drump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -1,4 +1,4 @@ -name: Windows Disable Memory Crash Drump +name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 version: 1 date: '2022-02-25' @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data - registry_key_name | `windows_disable_memory_crash_drump_filter`' + registry_key_name | `windows_disable_memory_crash_dump_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. diff --git a/tests/endpoint/windows_disable_memory_crash_drump.test.yml b/tests/endpoint/windows_disable_memory_crash_dump.test.yml similarity index 79% rename from tests/endpoint/windows_disable_memory_crash_drump.test.yml rename to tests/endpoint/windows_disable_memory_crash_dump.test.yml index e2e66c7725..9d4b7636bd 100644 --- a/tests/endpoint/windows_disable_memory_crash_drump.test.yml +++ b/tests/endpoint/windows_disable_memory_crash_dump.test.yml @@ -1,7 +1,7 @@ -name: Windows Disable Memory Crash Drump Unit Test +name: Windows Disable Memory Crash Dump Unit Test tests: - name: Windows Disable Memory Crash Drump - file: endpoint/windows_disable_memory_crash_drump.yml + file: endpoint/windows_disable_memory_crash_dump.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 550e5496149f71fc74b3baff73d6232fb82479d1 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Feb 2022 07:29:37 -0700 Subject: [PATCH 3/4] Update windows_disable_memory_crash_dump.yml --- detections/endpoint/windows_disable_memory_crash_dump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 6bf0eead37..ebe26edba3 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a process that is attempting to disable the ability on Windows to prevent a memory crash dump. This was recently identified being utilized by HermeticWiper. +description: The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper. To disable crash dumps, the value must be set to 0. This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check). search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry From c4305d913257b12f5ac068ab922a9d4d82286501 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 2 Mar 2022 10:11:42 -0800 Subject: [PATCH 4/4] Update windows_disable_memory_crash_dump.yml minnor yml updates --- .../endpoint/windows_disable_memory_crash_dump.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index ebe26edba3..5216175c4c 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint registry_key_name | `windows_disable_memory_crash_dump_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node. known_false_positives: unknown references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html @@ -50,14 +50,21 @@ tags: - Filesystem.user - Filesystem.file_path - Filesystem.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid security_domain: endpoint impact: 90 confidence: 100 # (impact * confidence)/100 risk_score: 90 context: - - source:endpoint - - stage:Persistence + - Source:Endpoint + - Stage:Persistence - Privilege Escalation message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$. observable: