diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 3d970d16e8..25b2f1dfa7 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -15,13 +15,16 @@ description: This search is to detect a suspicious MS office application that dr search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time - file_name file_path process_name process_path process] | dedup file_create_time - | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`' + Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + | rename process_guid as proc_guid | fields _time dest file_create_time file_name + file_path process_name process_path process proc_guid] | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid + | `office_application_drop_executable_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 28228cc7b7..68ca92df2d 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -10,12 +10,12 @@ description: this detection was designed to identifies suspicious spawned proces of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. -search: '| tstats `security_content_summariesonly` count values(Processes.process) - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") `process_rundll32` by - Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") AND `process_rundll32` + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml similarity index 51% rename from detections/endpoint/regsvr32_silent_param_dll_loading.yml rename to detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 0a2c1bb9ea..56621954a8 100644 --- a/detections/endpoint/regsvr32_silent_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -1,4 +1,4 @@ -name: Regsvr32 Silent Param Dll Loading +name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 version: 1 date: '2021-10-04' @@ -8,20 +8,21 @@ datamodel: - Endpoint description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several - RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised - machine. This TTP may executed by normal 3rd party application so it is better to - pivot the parent process, parent commandline and commandline of the file that execute - this regsvr32. + RAT malware similar to remcos, njrat and adversaries to load their malicious DLL + on the compromised machine. This TTP may executed by normal 3rd party application + so it is better to pivot by the parent process, parent command-line and command-line + of the file that execute this regsvr32. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe - Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process - Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` AND Processes.process="*/i*" + by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where + match(process,"(?i)[\-|\/]s(il*e*n*t*)*") | `regsvr32_silent_and_install_param_dll_loading_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Other third part application may used this parameter but not so common in base windows environment. references: @@ -40,7 +41,9 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: regsvr32 process with $process$ commandline in $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and + dllinstall parameter. mitre_attack_id: - T1218 - T1218.010 @@ -53,6 +56,14 @@ tags: type: Hostname role: - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml similarity index 54% rename from detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml rename to detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 2e9fe3108a..b61635b3ea 100644 --- a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -1,4 +1,4 @@ -name: Suspicious IcedID Regsvr32 Cmdline +name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 version: 2 date: '2021-07-27' @@ -6,16 +6,20 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this search is to detect a suspicious regsvr32 commandline "-s" to execute - a dll files. This technique was seen in IcedID malware to execute its initial downloader - dll that will download the 2nd stage loader that will download and decrypt the config - payload. +description: The following analytic identifies Regsvr32.exe utilizing the silent switch + to load DLLs. This technique has most recently been seen in IcedID campaigns to + load its initial dll that will download the 2nd stage loader that will download + and decrypt the config payload. The switch type may be either a hyphen `-` or forward + slash `/`. This behavior is typically found with `-s`, and it is possible there + are more switch types that may be used. \ During triage, review parallel processes + and capture any artifacts that may have landed on disk. Isolate and contain the + endpoint as necessary. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*-s* - by Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name - Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.user + Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name + Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/]s(il*e*n*t*)*") + | `regsvr32_with_known_silent_switch_cmdline_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -25,9 +29,11 @@ known_false_positives: minimal. but network operator can use this application to dll. references: - https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/ +- https://regexr.com/699e2 tags: analytic_story: - IcedID + - Suspicious Regsvr32 Activity automated_detection_testing: passed confidence: 80 context: @@ -38,19 +44,28 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: regsvr32 process $process_name$ with commandline $process$ in host $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter. mitre_attack_id: - T1218 - T1218.010 observable: + - name: user + type: User + role: + - Victim - name: dest type: Hostname role: - Victim - - name: process_name - type: process name + - name: parent_process_name + type: Parent Process role: - - Attacker + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 07ee37a990..7145f4a93d 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -1,15 +1,12 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 version: 2 -date: 2020-11-10 +date: '2020-11-10' author: Ignacio Bermudez Corrales, Splunk -type: TTP datamodel: - Endpoint_Processes -description: This search looks for executions of cmd.exe spawned by a process that - is often abused by attackers and that does not typically launch cmd.exe. This is - a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` - by @bpatel. +type: Anomaly +description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), @@ -27,32 +24,25 @@ search: '| from read_ssa_enriched_events() | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting sysmon logs. This search has been modified +how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. Investigate and modify - the lookup file, as appropriate. -references: [] + execute and interact with the Windows command-line interface. +references: + - https://attack.mitre.org/techniques/T1059/ tags: analytic_story: - Suspicious Command-Line Executions - - Suspicious MSHTA Activity - - Suspicious Zoom Child Processes - - Sunburst Malware cis20: - CIS 8 confidence: 50 context: - - Source:AD - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control + - Stage:Defense Evasion impact: 70 kill_chain_phases: - Exploitation - message: Potential malicious landing to the console via unexpected programs that - called cmd.exe. Operation is performed at the device $dest_device_id$, by the - account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating. mitre_attack_id: - T1059 nist: @@ -67,10 +57,14 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname + - name: parent_process_name + type: Parent Process role: - - Others + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Behavioral Analytics required_fields: @@ -79,6 +73,6 @@ tags: - _time - dest_device_id - dest_user_id - risk_score: 56 + risk_score: 35 risk_severity: low security_domain: endpoint diff --git a/docs/_pages/adversary_tactics.md b/docs/_pages/adversary_tactics.md index a55ce9c4a1..06dd96f8f4 100644 --- a/docs/_pages/adversary_tactics.md +++ b/docs/_pages/adversary_tactics.md @@ -57,5 +57,5 @@ sidebar: | [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) | | [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | +| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | | [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | \ No newline at end of file diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 9735933438..5d02dbc018 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -134,7 +134,7 @@ sidebar: | [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP | | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Deny Permission using Cacls Utility](/endpoint/deny_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | -| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect AWS Console Login by New User]() | None | Hunting | | [Detect AWS Console Login by User from New City](/cloud/detect_aws_console_login_by_user_from_new_city/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | | [Detect AWS Console Login by User from New Country](/cloud/detect_aws_console_login_by_user_from_new_country/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | @@ -159,7 +159,7 @@ sidebar: | [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | | [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | | [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | -| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP | | [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | @@ -174,9 +174,9 @@ sidebar: | [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | | [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | | [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | -| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | +| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP | | [Detect Rare Executables]() | None | Anomaly | @@ -191,7 +191,7 @@ sidebar: | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting | | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting | | [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | -| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | TTP | +| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP | | [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | @@ -662,8 +662,11 @@ sidebar: | [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting | | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP | diff --git a/docs/_pages/malware.md b/docs/_pages/malware.md index 2737b240fa..f57ea82e07 100644 --- a/docs/_pages/malware.md +++ b/docs/_pages/malware.md @@ -19,7 +19,7 @@ sidebar: | [Emotet Malware DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) | | [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) | | [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) | -| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | +| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | | [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | | [Ransomware](/stories/ransomware/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | diff --git a/docs/_pages/playbooks.md b/docs/_pages/playbooks.md index 37e7e87ba5..5577983c2e 100644 --- a/docs/_pages/playbooks.md +++ b/docs/_pages/playbooks.md @@ -11,3 +11,13 @@ sidebar: | Name | Detections | Type | | --------| ---------- | ----------- | | [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response | +| [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response | +| [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation | +| [Risk Notable Import Data](/playbooks/risk_notable_import_data/)| None | Investigation | +| [Risk Notable Investigate](/playbooks/risk_notable_investigate/)| None | Investigation | +| [Risk Notable Merge Events](/playbooks/risk_notable_merge_events/)| None | Investigation | +| [Risk Notable Mitigate](/playbooks/risk_notable_mitigate/)| None | Response | +| [Risk Notable Preprocess](/playbooks/risk_notable_preprocess/)| None | Investigation | +| [Risk Notable Protect Assets and Users](/playbooks/risk_notable_protect_assets_and_users/)| None | Response | +| [Risk Notable Review Indicators](/playbooks/risk_notable_review_indicators/)| None | Response | +| [Risk Notable Verdict](/playbooks/risk_notable_verdict/)| None | Response | diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 1263173f32..f65dcf294a 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -50,7 +50,7 @@ sidebar: | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | | [HAFNIUM Group](hafnium_group) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | | [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) | -| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | +| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | | [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | @@ -110,7 +110,7 @@ sidebar: | [Windows Discovery Techniques](windows_discovery_techniques) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) | | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Windows Log Manipulation](windows_log_manipulation) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | +| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | | [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | \ No newline at end of file diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md index 3bf5d22f75..ac62ecb0ae 100644 --- a/docs/_playbooks/ransomware_investigate_and_contain.md +++ b/docs/_playbooks/ransomware_investigate_and_contain.md @@ -699,6 +699,9 @@ This playbook investigates and contains ransomware detected on endpoints. + + + diff --git a/docs/_playbooks/risk_notable_block_indicators.md b/docs/_playbooks/risk_notable_block_indicators.md new file mode 100644 index 0000000000..c7f9d98dad --- /dev/null +++ b/docs/_playbooks/risk_notable_block_indicators.md @@ -0,0 +1,45 @@ +--- +title: "Risk Notable Block Indicators" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - None +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook handles locating indicators marked for blocking and determining if any blocking playbooks exist. If there is a match to the appropriate tags in the playbook, a filter block routes the name of the playbook to launch to a code block. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-83da3783fd63 + +#### Associated Detections + + +#### How To Implement +None + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_block_indicators.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system) +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_block_indicators.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_enrich.md b/docs/_playbooks/risk_notable_enrich.md new file mode 100644 index 0000000000..2fba096826 --- /dev/null +++ b/docs/_playbooks/risk_notable_enrich.md @@ -0,0 +1,44 @@ +--- +title: "Risk Notable Enrich" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Investigation + - Splunk SOAR + - None +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook collects the available Indicator data types within the event as well as available investigative playbooks. It will launch any playbooks that meet the filtered criteria. + +- **Type**: Investigation +- **Product**: Splunk SOAR +- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-43da3783fd63 + +#### Associated Detections + + +#### How To Implement +None + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_enrich.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_enrich.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_import_data.md b/docs/_playbooks/risk_notable_import_data.md new file mode 100644 index 0000000000..002e579d2f --- /dev/null +++ b/docs/_playbooks/risk_notable_import_data.md @@ -0,0 +1,53 @@ +--- +title: "Risk Notable Import Data" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Investigation + - Splunk SOAR + - Splunk +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook gathers all of the events associated with the risk notable and imports them as artifacts. It also generates a custom markdown formatted note. + +- **Type**: Investigation +- **Product**: Splunk SOAR +- **Apps**: [Splunk](https://splunkbase.splunk.com/apps/#/search/Splunk/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-23da3783fd63 + +#### Associated Detections + + +#### How To Implement +'The Splunk search used to locate contributing events requires three fields in the notable artifact\: risk_object, info_min_time, and info_max_time. The query also performs some deduplication on contributing events and may need to be adjusted based on individual Enterprise Security environments. Mitre Tactics and Techniques appear if using the annotation framework in Splunk ES." +index=risk risk_object=\"{0}\" earliest=\"{1}\" latest="{2}\" | rex field=source \".*-\s(?<source>.*)\s+-\s+\w+\s+-\s+Rule\" | fillnull value=\"unknown\" threat_object | eval risk_message=coalesce(risk_message,source) | stats values(*) as * by _time source threat_object risk_message | rename annotations.mitre_attack.mitre_technique_id as mitre_technique_id annotations.mitre_attack.mitre_tactic as mitre_tactic annotations.mitre_attack.mitre_technique as mitre_technique | fields - annotations* risk_object_* date_* orig_* user_* src_user_* src_* dest_* dest_user_* info_* search_* splunk_* tag* risk_modifier* risk_rule* sourcetype timestamp index next_cron_time timeendpos timestartpos testmode linecount | sort + _time | \`uitime(_time)\` | dedup source threat_object +A custom code block sorts the returned event data and produces a markdown formatted note into the note_content output field. This field is then available for use in downstream playbooks."' + + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_import_data.png) + +#### Required field +* event_id +* info_min_time +* info_max_time +* risk_object +* risk_object_type + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack) +* [http://docs.splunk.com/Documentation/ES/6.6.2/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches](http://docs.splunk.com/Documentation/ES/6.6.2/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_import_data.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_investigate.md b/docs/_playbooks/risk_notable_investigate.md new file mode 100644 index 0000000000..2214f57c80 --- /dev/null +++ b/docs/_playbooks/risk_notable_investigate.md @@ -0,0 +1,44 @@ +--- +title: "Risk Notable Investigate" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Investigation + - Splunk SOAR + - None +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook checks for the presence of the Risk Investigation workbook and updates tasks or leaves generic notes. + +- **Type**: Investigation +- **Product**: Splunk SOAR +- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-03da3783fd63 + +#### Associated Detections + + +#### How To Implement +Set this playbook to run in Active mode on the Risk Notable label in Splunk SOAR. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_investigate.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_investigate.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_merge_events.md b/docs/_playbooks/risk_notable_merge_events.md new file mode 100644 index 0000000000..bd9e41ec0d --- /dev/null +++ b/docs/_playbooks/risk_notable_merge_events.md @@ -0,0 +1,44 @@ +--- +title: "Risk Notable Merge Events" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Investigation + - Splunk SOAR + - None +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook finds related events based on key fields in a risk notable and allows the user to process the results and decide which events to merge into the current investigation. + +- **Type**: Investigation +- **Product**: Splunk SOAR +- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-53da3783fd63 + +#### Associated Detections + + +#### How To Implement +Combining the list_merge utility within the playbook with the find_related_containers utility allows for fine-tuning of related event criteria. For example, the default filtering criteria uses description, risk_object, and threat_object as the important fields and requires at least three matches before an event is considered related. There are several options to customize the associated criteria, including adding more fields in list_merge, reducing or increasing the minimum match count, or utilizing the wildcard feature of find_related_containers. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_merge_events.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_merge_events.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_mitigate.md b/docs/_playbooks/risk_notable_mitigate.md new file mode 100644 index 0000000000..454009f5de --- /dev/null +++ b/docs/_playbooks/risk_notable_mitigate.md @@ -0,0 +1,47 @@ +--- +title: "Risk Notable Mitigate" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - N + - o + - n + - e +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook checks for the presence of the Risk Response workbook and updates tasks or leaves generic notes. The risk_notable_verdict playbooks recommends this playbook as a second phase of the investigation. Additionally, this playbook can be used in ad-hoc investigations or incorporated into custom workbooks. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [N](https://splunkbase.splunk.com/apps/#/search/N/product/soar), [o](https://splunkbase.splunk.com/apps/#/search/o/product/soar), [n](https://splunkbase.splunk.com/apps/#/search/n/product/soar), [e](https://splunkbase.splunk.com/apps/#/search/e/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-63da3783fd63 + +#### Associated Detections + + +#### How To Implement + + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_mitigate.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_mitigate.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_preprocess.md b/docs/_playbooks/risk_notable_preprocess.md new file mode 100644 index 0000000000..c03661f7f2 --- /dev/null +++ b/docs/_playbooks/risk_notable_preprocess.md @@ -0,0 +1,48 @@ +--- +title: "Risk Notable Preprocess" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Investigation + - Splunk SOAR + - Splunk +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +"This playbook prepares a risk notable for investigation by performing the following tasks: 1. Ensures that a risk notable links back to the original notable event with a card pinned to the HUD. 2. Posts a link to this container in the comment field of Splunk ES. 3. Updates the container name, description, and severity to reflect the data in the notable artifact." + + +- **Type**: Investigation +- **Product**: Splunk SOAR +- **Apps**: [Splunk](https://splunkbase.splunk.com/apps/#/search/Splunk/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-13da3783fd63 + +#### Associated Detections + + +#### How To Implement +None + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_preprocess.png) + +#### Required field +* event_id +* info_min_time +* info_max_time + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_preprocess.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_protect_assets_and_users.md b/docs/_playbooks/risk_notable_protect_assets_and_users.md new file mode 100644 index 0000000000..ebb421de69 --- /dev/null +++ b/docs/_playbooks/risk_notable_protect_assets_and_users.md @@ -0,0 +1,44 @@ +--- +title: "Risk Notable Protect Assets and Users" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - None +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook attempts to find assets and users from the notable event and match those with assets and identities from Splunk ES. If a match was found and the user has playbooks available to contain entities, the analyst decides which entities to disable or quarantine. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-93da3783fd63 + +#### Associated Detections + + +#### How To Implement + + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_protect_assets_and_users.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_protect_assets_and_users.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_review_indicators.md b/docs/_playbooks/risk_notable_review_indicators.md new file mode 100644 index 0000000000..05d1ca7376 --- /dev/null +++ b/docs/_playbooks/risk_notable_review_indicators.md @@ -0,0 +1,44 @@ +--- +title: "Risk Notable Review Indicators" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - None +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook was designed to be called by a user to process indicators that are marked as suspicious within the SOAR platform. Analysts will review indicators in a prompt and mark them as blocked or safe. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-73da3783fd63 + +#### Associated Detections + + +#### How To Implement + + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_review_indicators.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_review_indicators.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_playbooks/risk_notable_verdict.md b/docs/_playbooks/risk_notable_verdict.md new file mode 100644 index 0000000000..b2a5261272 --- /dev/null +++ b/docs/_playbooks/risk_notable_verdict.md @@ -0,0 +1,44 @@ +--- +title: "Risk Notable Verdict" +last_modified_at: 2021-10-22 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - None +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook locates available playbooks with the response tag and presents them to the analyst. Based on the analyst selection, it will launch its chosen playbook. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [None](https://splunkbase.splunk.com/apps/#/search/None/product/soar) +- **Last Updated**: 2021-10-22 +- **Author**: Kelby Shelton, Splunk +- **ID**: rn0edc96-ff2b-48b0-9f6f-33da3783fd63 + +#### Associated Detections + + +#### How To Implement + + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/risk_notable_verdict.png) + +#### Required field + + +#### Reference + +* [https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system](https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system) + + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/risk_notable_verdict.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 6ca47d8477..9c25f7cf2a 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -1,6 +1,6 @@ --- title: "Detect ARP Poisoning" -excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning" +excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning" categories: - Network last_modified_at: 2020-08-11 @@ -11,7 +11,7 @@ tags: - Initial Access - Network Denial of Service - Impact - - Adversary-in-the-Middle + - Man-in-the-Middle - Credential Access - Collection - ARP Cache Poisoning @@ -48,7 +48,7 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | -| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection | +| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 898b1cb5bc..930d271f21 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -1,6 +1,6 @@ --- title: "Detect Rogue DHCP Server" -excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle" +excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle" categories: - Network last_modified_at: 2020-08-11 @@ -11,7 +11,7 @@ tags: - Initial Access - Network Denial of Service - Impact - - Adversary-in-the-Middle + - Man-in-the-Middle - Credential Access - Collection - Splunk Enterprise @@ -45,7 +45,7 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization' | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | -| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection | +| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | #### Search diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 0cf36a0a0d..9c8b266da9 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -1,6 +1,6 @@ --- title: "Detect IPv6 Network Infrastructure Threats" -excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning" +excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning" categories: - Network last_modified_at: 2020-10-28 @@ -11,7 +11,7 @@ tags: - Initial Access - Network Denial of Service - Impact - - Adversary-in-the-Middle + - Man-in-the-Middle - Credential Access - Collection - ARP Cache Poisoning @@ -48,7 +48,7 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | -| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection | +| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 6486c00bc7..a6a6d39ba7 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -1,6 +1,6 @@ --- title: "Detect Port Security Violation" -excerpt: "Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning" +excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning" categories: - Network last_modified_at: 2020-10-28 @@ -11,7 +11,7 @@ tags: - Initial Access - Network Denial of Service - Impact - - Adversary-in-the-Middle + - Man-in-the-Middle - Credential Access - Collection - ARP Cache Poisoning @@ -48,7 +48,7 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | -| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Credential Access, Collection | +| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md new file mode 100644 index 0000000000..1ad946f145 --- /dev/null +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -0,0 +1,109 @@ +--- +title: "Windows Curl Download to Suspicious Path" +excerpt: "Ingress Tool Transfer" +categories: + - Endpoint +last_modified_at: 2021-10-19 +toc: true +toc_label: "" +tags: + - Ingress Tool Transfer + - Command And Control + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \ +-O or --output is used when a file is to be downloaded and placed in a specified location. \ +During triage, review parallel processes for further behavior. In addition, identify if the download was successful. If a file was downloaded, capture and analyze. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-19 +- **Author**: Michael Haag, Splunk +- **ID**: c32f091e-30db-11ec-8738-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_curl_download_to_suspicious_path_filter` +``` + +#### Associated Analytic Story +* [IceID](/stories/iceid) +* [Ingress Tool Transfer](/stories/ingress_tool_transfer) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory. | + + + + +#### Reference + +* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) +* [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md new file mode 100644 index 0000000000..af6280714d --- /dev/null +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -0,0 +1,102 @@ +--- +title: "WinEvent Windows Task Scheduler Event Action Started" +excerpt: "Scheduled Task" +categories: + - Endpoint +last_modified_at: 2021-10-19 +toc: true +toc_label: "" +tags: + - Scheduled Task + - Execution + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying specific paths not used in your environment. After some basic tuning, this may be effective in capturing evasive ways to register tasks on Windows. Review parallel events related to tasks being scheduled. EventID 106 will generate when a new task is generated, however, that does not mean it ran. Capture any files on disk and analyze. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-19 +- **Author**: Michael Haag, Splunk +- **ID**: b3632472-310b-11ec-9aab-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +#### Search + +``` +`wineventlog_task_scheduler` EventCode IN ("200","201") +| rename ComputerName as dest +| stats count min(_time) as firstTime max(_time) as lastTime by Message dest EventCode category +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `winevent_windows_task_scheduler_event_action_started_filter` +``` + +#### Associated Analytic Story +* [IcedID](/stories/icedid) +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) + + +#### How To Implement +Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message. + +#### Required field +* _time +* TaskName +* ActionName +* EventID +* dest +* ProcessID + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +False positives will be present. Filter based on ActionName paths or specify keywords of interest. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | A Scheduled Task was scheduled and ran on $dest$. | + + + + +#### Reference + +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md) +* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2021-11-10-detect_prohibited_applications_spawning_cmd_exe.md similarity index 72% rename from docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md rename to docs/_posts/2021-11-10-detect_prohibited_applications_spawning_cmd_exe.md index df026d373d..075a02ebcf 100644 --- a/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2021-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -3,7 +3,7 @@ title: "Detect Prohibited Applications Spawning cmd exe" excerpt: "Command and Scripting Interpreter" categories: - Endpoint -last_modified_at: 2020-7-13 +last_modified_at: 2021-11-10 toc: true toc_label: "" tags: @@ -18,12 +18,12 @@ tags: #### Description -This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` by @bpatel. +The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further. -- **Type**: TTP +- **Type**: Anomaly - **Product**: Splunk Behavioral Analytics - **Datamodel**: -- **Last Updated**: 2020-7-13 +- **Last Updated**: 2021-11-10 - **Author**: Ignacio Bermudez Corrales, Splunk - **ID**: c10a18cb-fd80-4ffa-a844-25026e0a0c94 @@ -53,13 +53,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Associated Analytic Story * [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions) -* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity) -* [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes) -* [Sunburst Malware](/stories/sunburst_malware) #### How To Implement -You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. +In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. #### Required field * process_name @@ -74,20 +71,23 @@ You must be ingesting sysmon logs. This search has been modified to process raw #### Known False Positives -There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate. +There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. #### RBA | Risk Score | Impact | Confidence | Message | | ----------- | ----------- |--------------|--------------| -| 56.0 | 70 | 80 | Potential malicious landing to the console via unexpected programs that called cmd.exe. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. | +| 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating. | #### Reference +* [https://attack.mitre.org/techniques/T1059/](https://attack.mitre.org/techniques/T1059/) + + #### Test Dataset Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). @@ -96,4 +96,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md new file mode 100644 index 0000000000..00dac41601 --- /dev/null +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -0,0 +1,110 @@ +--- +title: "Windows Curl Upload to Remote Destination" +excerpt: "Ingress Tool Transfer" +categories: + - Endpoint +last_modified_at: 2021-11-10 +toc: true +toc_label: "" +tags: + - Ingress Tool Transfer + - Command And Control + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \ +`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \ +`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \ +HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \ +Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-11-10 +- **Author**: Michael Haag, Splunk +- **ID**: 42f8f1a2-4228-11ec-aade-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_curl_upload_to_remote_destination_filter` +``` + +#### Associated Analytic Story +* [Ingress Tool Transfer](/stories/ingress_tool_transfer) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exfiltration + + +#### Known False Positives +False positives may be limited to source control applications and may be required to be filtered out. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination. | + + + + +#### Reference + +* [https://everything.curl.dev/usingcurl/uploads](https://everything.curl.dev/usingcurl/uploads) +* [https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409](https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409) +* [https://twitter.com/d1r4c/status/1279042657508081664?s=20](https://twitter.com/d1r4c/status/1279042657508081664?s=20) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/icedid.md b/docs/_stories/icedid.md index 08f134b9e1..e609cd221b 100644 --- a/docs/_stories/icedid.md +++ b/docs/_stories/icedid.md @@ -56,6 +56,7 @@ IcedId banking trojan campaigns targeting banks and other vertical sectors.This | [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting | #### Reference diff --git a/docs/_stories/ingress_tool_transfer.md b/docs/_stories/ingress_tool_transfer.md index 5db1b3f1de..39e7418f00 100644 --- a/docs/_stories/ingress_tool_transfer.md +++ b/docs/_stories/ingress_tool_transfer.md @@ -36,6 +36,8 @@ Ingress tool transfer is a Technique under tactic Command and Control. Behaviors | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | #### Reference diff --git a/docs/_stories/router_and_infrastructure_security.md b/docs/_stories/router_and_infrastructure_security.md index c6da350fb6..712d88188f 100644 --- a/docs/_stories/router_and_infrastructure_security.md +++ b/docs/_stories/router_and_infrastructure_security.md @@ -32,11 +32,11 @@ This Analytic Story helps you gain a better understanding of how your network de | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | -| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect New Login Attempts to Routers](/application/detect_new_login_attempts_to_routers/) | | TTP | -| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | -| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | TTP | +| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP | | [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot) | TTP | | [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Automated Exfiltration](/tags/#automated-exfiltration), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | TTP | diff --git a/docs/_stories/suspicious_command-line_executions.md b/docs/_stories/suspicious_command-line_executions.md index a4307f426a..f53278a233 100644 --- a/docs/_stories/suspicious_command-line_executions.md +++ b/docs/_stories/suspicious_command-line_executions.md @@ -30,8 +30,8 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | | [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP | | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | diff --git a/docs/_stories/suspicious_mshta_activity.md b/docs/_stories/suspicious_mshta_activity.md index de6bf26907..2ed37fce46 100644 --- a/docs/_stories/suspicious_mshta_activity.md +++ b/docs/_stories/suspicious_mshta_activity.md @@ -43,7 +43,6 @@ The objective of this step is to confirm the executed script code is benign or m | Name | Technique | Type | | ----------- | ----------- |--------------| | [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | | [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | diff --git a/docs/_stories/suspicious_zoom_child_processes.md b/docs/_stories/suspicious_zoom_child_processes.md index 5bdb710b1e..e9319ba3eb 100644 --- a/docs/_stories/suspicious_zoom_child_processes.md +++ b/docs/_stories/suspicious_zoom_child_processes.md @@ -31,7 +31,6 @@ Current detections focus on finding new child processes of this application on a | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly | diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md index b74de5fd92..c144be526b 100644 --- a/docs/_stories/windows_persistence_techniques.md +++ b/docs/_stories/windows_persistence_techniques.md @@ -61,6 +61,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i | [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting | #### Reference diff --git a/docs/index.markdown b/docs/index.markdown index 95c48ffc16..322b56fdf8 100644 --- a/docs/index.markdown +++ b/docs/index.markdown @@ -9,12 +9,12 @@ header: actions: - label: "Download" url: "https://splunkbase.splunk.com/app/3449/" -excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **672** detections for Splunk." +excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **675** detections for Splunk." feature_row: - image_path: /static/feature_detection.png alt: "customizable" title: "Detections" - excerpt: "See all **672** Splunk Analytics built to find evil 😈." + excerpt: "See all **675** Splunk Analytics built to find evil 😈." url: "/detections" btn_class: "btn--primary" btn_label: "Explore" @@ -28,7 +28,7 @@ feature_row: - image_path: /static/feature_playbooks.png alt: "100% free" title: "Playbooks" - excerpt: "See all **1** sets of steps 🐾 to automatically response to a threat." + excerpt: "See all **11** sets of steps 🐾 to automatically response to a threat." url: "/playbooks" btn_class: "btn--primary" btn_label: "Explore" diff --git a/tests/endpoint/office_application_drop_executable.test.yml b/tests/endpoint/office_application_drop_executable.test.yml index 397acb8085..cd4fc7a718 100644 --- a/tests/endpoint/office_application_drop_executable.test.yml +++ b/tests/endpoint/office_application_drop_executable.test.yml @@ -3,7 +3,7 @@ tests: - name: Office Application Drop Executable file: endpoint/office_application_drop_executable.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-120d' latest_time: 'now' attack_data: - file_name: sysmon.log diff --git a/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml b/tests/endpoint/regsvr32_silent_and_install_param_dll_loading.test.yml similarity index 67% rename from tests/endpoint/regsvr32_silent_param_dll_loading.test.yml rename to tests/endpoint/regsvr32_silent_and_install_param_dll_loading.test.yml index a28aa579c6..11f1f4e2ab 100644 --- a/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml +++ b/tests/endpoint/regsvr32_silent_and_install_param_dll_loading.test.yml @@ -1,7 +1,7 @@ -name: Regsvr32 Silent Param Dll Loading Unit Test +name: Regsvr32 Silent and Install Param Dll Loading Unit Test tests: -- name: Regsvr32 Silent Param Dll Loading - file: endpoint/regsvr32_silent_param_dll_loading.yml +- name: Regsvr32 Silent and Install Param Dll Loading + file: endpoint/regsvr32_silent_and_install_param_dll_loading.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml b/tests/endpoint/regsvr32_with_known_silent_switch_cmdline.test.yml similarity index 64% rename from tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml rename to tests/endpoint/regsvr32_with_known_silent_switch_cmdline.test.yml index 6d0535e5e8..3386ddfb46 100644 --- a/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml +++ b/tests/endpoint/regsvr32_with_known_silent_switch_cmdline.test.yml @@ -1,9 +1,9 @@ -name: Suspicious IcedID Regsvr32 Cmdline Unit Test +name: Regsvr32 with Known Silent Switch Cmdline Unit Test tests: -- name: Suspicious IcedID Regsvr32 Cmdline - file: endpoint/suspicious_icedid_regsvr32_cmdline.yml +- name: Regsvr32 with Known Silent Switch Cmdline + file: endpoint/regsvr32_with_known_silent_switch_cmdline.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-150d' latest_time: 'now' attack_data: - file_name: windows-sysmon.log diff --git a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml b/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml index b6455e0259..8b78331f05 100644 --- a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml +++ b/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml @@ -1,10 +1,10 @@ name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: - - name: Access LSASS Memory for Dump Creation + - name: Detect Prohibited Applications Spawning cmd exe file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml pass_condition: '@count_gt(0)' - description: Test credential dumping detections + description: Detect Prohibited Applications Spawning cmd exe attack_data: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log - source: WinEventLog:Security + source: WinEventLog:Security \ No newline at end of file