From 6f648f9a77ec0f79d9a893ef69008b8f4316694c Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 12 Apr 2022 11:20:43 +0200 Subject: [PATCH 01/12] acidrain --- .../endpoint/linux_deletion_of_cron_jobs.yml | 87 +++++++++++++++++++ .../linux_deletion_of_cron_jobs.test.yml | 12 +++ 2 files changed, 99 insertions(+) create mode 100644 detections/endpoint/linux_deletion_of_cron_jobs.yml create mode 100644 tests/endpoint/linux_deletion_of_cron_jobs.test.yml diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml new file mode 100644 index 0000000000..ffdc39c9c3 --- /dev/null +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -0,0 +1,87 @@ +name: Linux Deletion Of Cron Jobs +id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a deletion of cron job in a linux machine. + This technique can be related to a attacker, threat actor or malware to disable schedule cron job that might be related to security or + to evade some detections. We also saw that this technique can be a good indicator for malware that tries to wipe or delete several files on the compromised host + like the acidrain malware. This anomaly detection can be a good pivot detection to look for process and user doing it why they doing. Take note that this event can be done + by administrator so filtering on those possible false positive event is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path ="/etc/cron.*" + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user + | `linux_deletion_of_cron_jobs_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + - Stage:Impact + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting cron jobs in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint diff --git a/tests/endpoint/linux_deletion_of_cron_jobs.test.yml b/tests/endpoint/linux_deletion_of_cron_jobs.test.yml new file mode 100644 index 0000000000..7a4ea5299b --- /dev/null +++ b/tests/endpoint/linux_deletion_of_cron_jobs.test.yml @@ -0,0 +1,12 @@ +name: Linux Deletion Of Cron Jobs Unit Test +tests: +- name: Linux Deletion Of Cron Jobs + file: endpoint/linux_deletion_of_cron_jobs.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux From 91ac58c032ab82b1030151107c019ea1d451e750 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 12 Apr 2022 11:26:33 +0200 Subject: [PATCH 02/12] acidrain --- stories/acidrain.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 stories/acidrain.yml diff --git a/stories/acidrain.yml b/stories/acidrain.yml new file mode 100644 index 0000000000..4aa198dcfb --- /dev/null +++ b/stories/acidrain.yml @@ -0,0 +1,23 @@ +name: Acidrain +id: c68717c6-4938-434b-987c-e1ce9d516124 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the acidrain malware including deleting of files and etc. + AcidRain is an ELF MIPS malware specifically designed to wipe modems and routers. + The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target. + This malware is capable of wiping and deleting non-standard linux files and overwriting storage device files that might related to router, ssd card and many more. +narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption + is the goal. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: Acidrain + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From ede69dcf57613d89516bf1983e6f5520024b0d5b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Apr 2022 11:34:55 +0200 Subject: [PATCH 03/12] Update linux_deletion_of_cron_jobs.yml --- detections/endpoint/linux_deletion_of_cron_jobs.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index ffdc39c9c3..a0fa7c2cb0 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -44,7 +44,6 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - - Stage:Impact dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log impact: 70 From 03ea408fc1ddc33ec60b5c56e967b50c823b3ac8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 12 Apr 2022 12:01:17 +0200 Subject: [PATCH 04/12] acidrain --- .../linux_deletion_of_init_daemon_script.yml | 87 +++++++++++++++++++ .../endpoint/linux_deletion_of_services.yml | 86 ++++++++++++++++++ ...ux_deletion_of_init_daemon_script.test.yml | 12 +++ .../linux_deletion_of_services.test.yml | 12 +++ 4 files changed, 197 insertions(+) create mode 100644 detections/endpoint/linux_deletion_of_init_daemon_script.yml create mode 100644 detections/endpoint/linux_deletion_of_services.yml create mode 100644 tests/endpoint/linux_deletion_of_init_daemon_script.test.yml create mode 100644 tests/endpoint/linux_deletion_of_services.test.yml diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml new file mode 100644 index 0000000000..71509e3ebd --- /dev/null +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -0,0 +1,87 @@ +name: Linux Deletion Of Init Daemon Script +id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a deletion of init daemon script in a linux machine. + daemon script that place in /etc/init.d/ is a directory that can start and stop some daemon services in linux machine. + attacker may delete or modify daemon script to impair some security features or act as defense evasion in compromised linux machine. + This TTP can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what + acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + tries to delete this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/init.d/*") + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user + | `linux_deletion_of_init_daemon_script_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting a daemon script in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml new file mode 100644 index 0000000000..cc7fb423db --- /dev/null +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -0,0 +1,86 @@ +name: Linux Deletion Of Services +id: b509bbd3-0331-4aaa-8e4a-d2affe100af6 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a deletion of services in a linux machine. + attacker may delete or modify services to impair some security features or act as defense evasion in compromised linux machine. + This TTP can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what + acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + tries to delete this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "/usr/lib/systemd/*") Filesystem.file_path = "*.service" + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user + | `linux_deletion_of_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting a services in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/linux_deletion_of_init_daemon_script.test.yml b/tests/endpoint/linux_deletion_of_init_daemon_script.test.yml new file mode 100644 index 0000000000..94bd4bd509 --- /dev/null +++ b/tests/endpoint/linux_deletion_of_init_daemon_script.test.yml @@ -0,0 +1,12 @@ +name: Linux Deletion Of Init Daemon Script Unit Test +tests: +- name: Linux Deletion Of Init Daemon Script + file: endpoint/linux_deletion_of_init_daemon_script.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux diff --git a/tests/endpoint/linux_deletion_of_services.test.yml b/tests/endpoint/linux_deletion_of_services.test.yml new file mode 100644 index 0000000000..eb565c37c2 --- /dev/null +++ b/tests/endpoint/linux_deletion_of_services.test.yml @@ -0,0 +1,12 @@ +name: Linux Deletion Of Services Unit Test +tests: +- name: Linux Deletion Of Services + file: endpoint/linux_deletion_of_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux From fbbe658060c4b82f0023703a0147365a098dfcf4 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Apr 2022 12:22:19 +0200 Subject: [PATCH 05/12] Update linux_deletion_of_cron_jobs.yml --- detections/endpoint/linux_deletion_of_cron_jobs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index a0fa7c2cb0..40ddc1cda6 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -34,7 +34,7 @@ references: - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - - Acidrain + - AcidRain asset_type: endpoint cis20: - CIS 3 From 2f3cc3d6f598192babd7153399da59372be57e03 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Apr 2022 12:22:29 +0200 Subject: [PATCH 06/12] Update linux_deletion_of_init_daemon_script.yml --- detections/endpoint/linux_deletion_of_init_daemon_script.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 71509e3ebd..c90947964a 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -35,7 +35,7 @@ references: - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - - Acidrain + - AcidRain asset_type: endpoint cis20: - CIS 3 @@ -84,4 +84,4 @@ tags: - Processes.process_id - Processes.parent_process_id risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From 558953524ebb097bc41793bdc84a841dbb9e1e8f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Apr 2022 12:22:42 +0200 Subject: [PATCH 07/12] Update linux_deletion_of_services.yml --- detections/endpoint/linux_deletion_of_services.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index cc7fb423db..2f9f2e1c6e 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -34,7 +34,7 @@ references: - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - - Acidrain + - AcidRain asset_type: endpoint cis20: - CIS 3 @@ -83,4 +83,4 @@ tags: - Processes.process_id - Processes.parent_process_id risk_score: 64 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From f8eb31e7961c96979be36b2bc22c1c118092430e Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Apr 2022 12:22:58 +0200 Subject: [PATCH 08/12] Update acidrain.yml --- stories/acidrain.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/acidrain.yml b/stories/acidrain.yml index 4aa198dcfb..d8cfdfce4f 100644 --- a/stories/acidrain.yml +++ b/stories/acidrain.yml @@ -1,4 +1,4 @@ -name: Acidrain +name: AcidRain id: c68717c6-4938-434b-987c-e1ce9d516124 version: 1 date: '2022-04-12' @@ -13,11 +13,11 @@ narrative: Adversaries may use this technique to maximize the impact on the targ references: - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: - analytic_story: Acidrain + analytic_story: AcidRain category: - Malware product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection From 28d98d1af43850bc1bf0d7aeecfa0513ecc1e0ad Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 12 Apr 2022 14:34:36 +0200 Subject: [PATCH 09/12] acidrain --- ...equency_of_file_deletion_in_etc_folder.yml | 87 +++++++++++++++++++ ...cy_of_file_deletion_in_etc_folder.test.yml | 12 +++ 2 files changed, 99 insertions(+) create mode 100644 detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml create mode 100644 tests/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.test.yml diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml new file mode 100644 index 0000000000..80bf8ce6b6 --- /dev/null +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -0,0 +1,87 @@ +name: Linux High Frequency Of File Deletion In Etc Folder +id: 9d867448-2aff-4d07-876c-89409a752ff8 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a high frequency of file deletion relative to process name and process id /etc/ folder. + These events was seen in acidrain wiper malware where it tries to delete all files in non-standard directory in linux directory. + This detection already contains some filter that might cause false positive during our testing. But we recommend to add more filter if needed. +search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime + FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/etc/*" + by _time span=1h Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", "/bin/rm", "*splunkd", "/usr/bin/mandb")) + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid action _time deletedFileNames deletedFilePath numOfDelFilePath parent_process_name parent_process process_path dest user + | where numOfDelFilePath >= 200 + | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: linux package installer/uninstaller may cause this event. + Please update you filter macro to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting multiple files in /etc/ folder in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.test.yml b/tests/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.test.yml new file mode 100644 index 0000000000..9fd487fb8d --- /dev/null +++ b/tests/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.test.yml @@ -0,0 +1,12 @@ +name: Linux High Frequency Of File Deletion In Etc Folder Unit Test +tests: +- name: Linux High Frequency Of File Deletion In Etc Folder + file: endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux From 7c95560d2d6adf09e4d594cbf2e3cd9fabebbac0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Apr 2022 14:36:01 +0200 Subject: [PATCH 10/12] Update linux_high_frequency_of_file_deletion_in_etc_folder.yml --- .../linux_high_frequency_of_file_deletion_in_etc_folder.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 80bf8ce6b6..a1c6e1d8e8 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -35,7 +35,7 @@ references: - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ tags: analytic_story: - - Acidrain + - AcidRain asset_type: endpoint cis20: - CIS 3 @@ -84,4 +84,4 @@ tags: - Processes.process_id - Processes.parent_process_id risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From a7bf512c15e62fbb99255d19701fde7d199fa2c9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 13 Apr 2022 09:34:11 +0200 Subject: [PATCH 11/12] acidrain --- .../endpoint/linux_deletion_of_ssh_key.yml | 86 +++++++++++++++++++ .../linux_deletion_of_ssl_certificate.yml | 86 +++++++++++++++++++ .../linux_deletion_of_ssh_key.test.yml | 12 +++ ...linux_deletion_of_ssl_certificate.test.yml | 12 +++ 4 files changed, 196 insertions(+) create mode 100644 detections/endpoint/linux_deletion_of_ssh_key.yml create mode 100644 detections/endpoint/linux_deletion_of_ssl_certificate.yml create mode 100644 tests/endpoint/linux_deletion_of_ssh_key.test.yml create mode 100644 tests/endpoint/linux_deletion_of_ssl_certificate.test.yml diff --git a/detections/endpoint/linux_deletion_of_ssh_key.yml b/detections/endpoint/linux_deletion_of_ssh_key.yml new file mode 100644 index 0000000000..341594bb17 --- /dev/null +++ b/detections/endpoint/linux_deletion_of_ssh_key.yml @@ -0,0 +1,86 @@ +name: Linux deletion Of SSH Key +id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a deletion of ssh key in a linux machine. + attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine. + This Anomaly can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what + acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + tries to delete this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user + | `linux_deletion_of_ssh_key_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting a SSH key in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml new file mode 100644 index 0000000000..fc3e016a42 --- /dev/null +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -0,0 +1,86 @@ +name: Linux Deletion of SSL Certificate +id: 839ab790-a60a-4f81-bfb3-02567063f615 +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a deletion of ssl certificate in a linux machine. + attacker may delete or modify ssl certificate to impair some security features or act as defense evasion in compromised linux machine. + This Anomaly can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what + acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + tries to delete this type of files which is not so common and need further investigation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") + by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + |join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] + | table process_name process proc_guid file_name file_path action _time parent_process_name parent_process process_path dest user + | `linux_deletion_of_ssl_certificate_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. +references: +- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ +tags: + analytic_story: + - Acidrain + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a $process_name$ deleting a SSL certificate in $dest$ + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.process_guid + - Filesystem.file_path + - Filesystem.action + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_path + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/linux_deletion_of_ssh_key.test.yml b/tests/endpoint/linux_deletion_of_ssh_key.test.yml new file mode 100644 index 0000000000..87f7977249 --- /dev/null +++ b/tests/endpoint/linux_deletion_of_ssh_key.test.yml @@ -0,0 +1,12 @@ +name: Linux deletion Of SSH Key Unit Test +tests: +- name: Linux deletion Of SSH Key + file: endpoint/linux_deletion_of_ssh_key.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux diff --git a/tests/endpoint/linux_deletion_of_ssl_certificate.test.yml b/tests/endpoint/linux_deletion_of_ssl_certificate.test.yml new file mode 100644 index 0000000000..f590b6ea02 --- /dev/null +++ b/tests/endpoint/linux_deletion_of_ssl_certificate.test.yml @@ -0,0 +1,12 @@ +name: Linux Deletion of SSL Certificate Unit Test +tests: +- name: Linux Deletion of SSL Certificate + file: endpoint/linux_deletion_of_ssl_certificate.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux From ce0f0852ddf7271fc5d2544acc63148f5faa8ddc Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 13 Apr 2022 10:07:22 +0200 Subject: [PATCH 12/12] acidrain --- detections/endpoint/linux_deletion_of_cron_jobs.yml | 4 ++-- .../endpoint/linux_deletion_of_init_daemon_script.yml | 8 ++++---- detections/endpoint/linux_deletion_of_services.yml | 6 +++--- detections/endpoint/linux_deletion_of_ssh_key.yml | 4 ++-- detections/endpoint/linux_deletion_of_ssl_certificate.yml | 4 ++-- ...inux_high_frequency_of_file_deletion_in_etc_folder.yml | 2 +- 6 files changed, 14 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index 40ddc1cda6..feb23356c2 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -7,8 +7,8 @@ type: Anomaly datamodel: - Endpoint description: This analytic is to detect a deletion of cron job in a linux machine. - This technique can be related to a attacker, threat actor or malware to disable schedule cron job that might be related to security or - to evade some detections. We also saw that this technique can be a good indicator for malware that tries to wipe or delete several files on the compromised host + This technique can be related to an attacker, threat actor or malware to disable scheduled cron jobs that might be related to security or + to evade some detections. We also saw that this technique can be a good indicator for malware that is trying to wipe or delete several files on the compromised host like the acidrain malware. This anomaly detection can be a good pivot detection to look for process and user doing it why they doing. Take note that this event can be done by administrator so filtering on those possible false positive event is needed. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index c90947964a..cee914c96d 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -7,10 +7,10 @@ type: TTP datamodel: - Endpoint description: This analytic is to detect a deletion of init daemon script in a linux machine. - daemon script that place in /etc/init.d/ is a directory that can start and stop some daemon services in linux machine. - attacker may delete or modify daemon script to impair some security features or act as defense evasion in compromised linux machine. - This TTP can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what - acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + daemon script that place in /etc/init.d/ is a directory that can start and stop some daemon services in linux machines. + attacker may delete or modify daemon script to impair some security features or act as defense evasion in a compromised linux machine. + This TTP can be also a good indicator of a malware trying to wipe or delete several files in compromised host as part of its destructive payload like what + acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/init.d/*") diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 2f9f2e1c6e..5b99f4d004 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -7,9 +7,9 @@ type: TTP datamodel: - Endpoint description: This analytic is to detect a deletion of services in a linux machine. - attacker may delete or modify services to impair some security features or act as defense evasion in compromised linux machine. - This TTP can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what - acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + attacker may delete or modify services to impair some security features or act as defense evasion in a compromised linux machine. + This TTP can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what + acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "/usr/lib/systemd/*") Filesystem.file_path = "*.service" diff --git a/detections/endpoint/linux_deletion_of_ssh_key.yml b/detections/endpoint/linux_deletion_of_ssh_key.yml index 341594bb17..c8e3cebb8f 100644 --- a/detections/endpoint/linux_deletion_of_ssh_key.yml +++ b/detections/endpoint/linux_deletion_of_ssh_key.yml @@ -8,8 +8,8 @@ datamodel: - Endpoint description: This analytic is to detect a deletion of ssh key in a linux machine. attacker may delete or modify ssh key to impair some security features or act as defense evasion in compromised linux machine. - This Anomaly can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what - acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what + acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index fc3e016a42..f90ac8ec8b 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -8,8 +8,8 @@ datamodel: - Endpoint description: This analytic is to detect a deletion of ssl certificate in a linux machine. attacker may delete or modify ssl certificate to impair some security features or act as defense evasion in compromised linux machine. - This Anomaly can be also a good indicator of a malware try to wipe or delete several files in compromised host as part of its destructive payload like what - acidrain malware does in linux or router machine. This detection can be a good pivot to check what process and user + This Anomaly can be also a good indicator of a malware trying to wipe or delete several files in a compromised host as part of its destructive payload like what + acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user tries to delete this type of files which is not so common and need further investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index a1c6e1d8e8..0a1cf8a04a 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: This analytic is to detect a high frequency of file deletion relative to process name and process id /etc/ folder. - These events was seen in acidrain wiper malware where it tries to delete all files in non-standard directory in linux directory. + These events was seen in acidrain wiper malware where it tries to delete all files in a non-standard directory in linux directory. This detection already contains some filter that might cause false positive during our testing. But we recommend to add more filter if needed. search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem