From 84e54e26d6bb58bb86dbe5ffc291973135d19b14 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 29 Nov 2021 16:44:40 -0800 Subject: [PATCH 01/26] Changing to the correct baseline paths after restructuring repo --- .../cloud/abnormally_high_cloud_instances_destroyed.test.yml | 2 +- tests/cloud/abnormally_high_cloud_instances_launched.test.yml | 2 +- ...lly_high_number_of_cloud_infrastructure_api_calls.test.yml | 2 +- ...lly_high_number_of_cloud_security_group_api_calls.test.yml | 2 +- ...s_account_activity_from_previously_unseen_account.test.yml | 4 ++-- ...cloud_api_calls_from_previously_unseen_user_roles.test.yml | 4 ++-- ...ompute_instance_created_by_previously_unseen_user.test.yml | 4 ++-- ...pute_instance_created_in_previously_unused_region.test.yml | 4 ++-- ...ute_instance_created_with_previously_unseen_image.test.yml | 4 ++-- ...ance_created_with_previously_unseen_instance_type.test.yml | 4 ++-- ...oud_instance_modified_with_previously_unseen_user.test.yml | 4 ++-- .../cloud_provisioning_from_previously_unseen_city.test.yml | 4 ++-- ...cloud_provisioning_from_previously_unseen_country.test.yml | 4 ++-- ...ud_provisioning_from_previously_unseen_ip_address.test.yml | 4 ++-- .../cloud_provisioning_from_previously_unseen_region.test.yml | 4 ++-- tests/cloud/detect_aws_console_login_by_new_user.test.yml | 4 ++-- .../detect_aws_console_login_by_user_from_new_city.test.yml | 4 ++-- ...detect_aws_console_login_by_user_from_new_country.test.yml | 4 ++-- .../detect_aws_console_login_by_user_from_new_region.test.yml | 4 ++-- 19 files changed, 34 insertions(+), 34 deletions(-) diff --git a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml b/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml index ea5f32d97b..dd48257250 100644 --- a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml +++ b/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: baselines/baseline_of_cloud_instances_destroyed.yml + file: detections/cloud/baseline_of_cloud_instances_destroyed.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml b/tests/cloud/abnormally_high_cloud_instances_launched.test.yml index 704a2bc39a..a082a3c435 100644 --- a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml +++ b/tests/cloud/abnormally_high_cloud_instances_launched.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: baselines/baseline_of_cloud_instances_launched.yml + file: detections/cloud/baseline_of_cloud_instances_launched.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml index c9943d8552..000c10ed68 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Infrastructure API Calls Per User - file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml + file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml index 050d9eaf1f..f2074430c2 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Security Group API Calls Per User - file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml + file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml index 7135ebd7ae..cc782a4a7e 100644 --- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml +++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen AWS Cross Account Activity - Initial - file: baselines/previously_seen_aws_cross_account_activity_initial.yml + file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen AWS Cross Account Activity - Update - file: baselines/previously_seen_aws_cross_account_activity_update.yml + file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml index 47371cb887..d55a8bb52f 100644 --- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml +++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud API Calls Per User Role - Initial - file: baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml + file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud API Calls Per User Role - Update - file: baselines/previously_seen_cloud_api_calls_per_user_role_update.yml + file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml index 34ff1d2ad6..19fec95d05 100644 --- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Compute Creations By User - Initial - file: baselines/previously_seen_cloud_compute_creations_by_user_initial.yml + file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Compute Creations By User - Update - file: baselines/previously_seen_cloud_compute_creations_by_user_update.yml + file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml index 4aaf714aa3..adce8dbd51 100644 --- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml +++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Regions - Initial - file: baselines/previously_seen_cloud_regions_initial.yml + file: detections/cloud/previously_seen_cloud_regions_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Regions - Update - file: baselines/previously_seen_cloud_regions_update.yml + file: detections/cloud/previously_seen_cloud_regions_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml index 22263f5b15..5f5ca038f3 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Compute Images - Initial - file: baselines/previously_seen_cloud_compute_images_initial.yml + file: detections/cloud/previously_seen_cloud_compute_images_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Compute Images - Update - file: baselines/previously_seen_cloud_compute_images_update.yml + file: detections/cloud/previously_seen_cloud_compute_images_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml index ace490888d..f3873c8264 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Compute Instance Types - Initial - file: baselines/previously_seen_cloud_compute_instance_types_initial.yml + file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Compute Instance Types - Update - file: baselines/previously_seen_cloud_compute_instance_types_update.yml + file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml index bdf58b91f8..f7db1c4a6a 100644 --- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Instance Modifications By User - Initial - file: baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml + file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Instance Modifications By User - Update - file: baselines/previously_seen_cloud_instance_modifications_by_user_update.yml + file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml index 207ea9898d..741d779eb2 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml index d095d33251..232de687dc 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml index ee410cda1d..720252edac 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml index d4d7c727ec..e821a9025b 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml index 6e0fdf4290..b84e13d7a6 100644 --- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml +++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml index e032cbbd35..674b1c5f55 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml index 691c5fa5af..7195ba7f46 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml index 9ea20d1e25..c09f7ce926 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' From 97c83a1864c92f1199e8c9669b26eb382f21de8a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 30 Nov 2021 09:47:01 -0800 Subject: [PATCH 02/26] Created Experimental folder in tests, as well as cloud, endpoint, and network subfolders, and moved some tests into it. This corresponds with the experimental folder in detections. --- .../cloud/abnormally_high_cloud_instances_destroyed.test.yml | 2 +- .../cloud/abnormally_high_cloud_instances_launched.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename tests/{ => experimental}/cloud/abnormally_high_cloud_instances_destroyed.test.yml (92%) rename tests/{ => experimental}/cloud/abnormally_high_cloud_instances_launched.test.yml (92%) diff --git a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml b/tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml similarity index 92% rename from tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml rename to tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml index dd48257250..ea5f32d97b 100644 --- a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml +++ b/tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: detections/cloud/baseline_of_cloud_instances_destroyed.yml + file: baselines/baseline_of_cloud_instances_destroyed.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml b/tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml similarity index 92% rename from tests/cloud/abnormally_high_cloud_instances_launched.test.yml rename to tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml index a082a3c435..704a2bc39a 100644 --- a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml +++ b/tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: detections/cloud/baseline_of_cloud_instances_launched.yml + file: baselines/baseline_of_cloud_instances_launched.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' From c21877ceb808bcaba520d31d9c0d8c47fb221dd4 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Dec 2021 05:57:54 -0700 Subject: [PATCH 03/26] A Nightmare on Haag Street ## Updated Analytics Attempt To Delete Services Attempt To Disable Services Attempted Credential Dump From Registry via Reg exe Delete a net user Deny Permission using Cacls Utility Detect Dump LSASS Memory using comsvcs Disable Net User Account First time seen command line argument Grant Permission Using Cacls Utility Prohibited apps spawning cmdprompt Potential Pass the Token or Hash Observed at the Destination Device Rare Parent-Child Process Relationship ptt pth kerb ntlm origin device Resize Shadowstorage Volume sdelete application execution ## Deprecated BA Analytics ssa___applying_stolen_credentials_via_mimikatz_modules.yml ssa___applying_stolen_credentials_via_powersploit_modules.yml ssa___assess_credential_strength_via_dsinternals_modules.yml ssa___credential_extraction_dsinternals_conversion_modules.yml Ssa___credential_extraction_dsinternals_modules.yml Ssa___credential_extraction_getaddbaccount_from_dump.yml Ssa___credential_extraction_powersploit_modules.yml ssa___illegal_access_user_content_via_powersploit_modules.yml ssa___illegal_account_creation_via_powersploit_modules.yml ssa___illegal_account_enable_disable_via_dsinternals_modules.yml ssa___illegal_log_deletion_via_mimikatz_modules.yml ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml Ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml ssa___illegal_privilege_elevation_via_mimikatz_modules.yml ssa___illegal_service_and_process_control_via_mimikatz_modules.yml ssa___illegal_service_and_process_control_via_powersploit_modules.yml Ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml ssa___recon_and_use_computers_domains_via_powersploit_modules.yml ssa___recon_and_use_computers_via_mimikatz_modules.yml ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml ssa___recon_and_use_shares_via_mimikatz_modules.yml ssa___recon_and_use_shares_via_powersploit_modules.yml Ssa___recon_connectivity_via_powersploit_modules.yml ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml ssa___recon_defensive_tools_via_powersploit_modules.yml ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml ssa___recon_process_service_hijacking_via_mimikatz_modules.yml ssa___recon_processes_and_services_via_mimikatz_modules.yml ssa___setting_credentials_via_dsinternals_modules.yml ssa___setting_credentials_via_mimikatz_modules.yml ssa___setting_credentials_via_powersploit_modules.yml ssa___credential_extraction_fgdump_cachedump_s_option.yml Ssa___credential_extraction_fgdump_cachedump_v_option.yml ssa___credential_extraction_ms_debuggers_kernel_peek.yml ssa___credential_extraction_ms_debuggers_z_option.yml Ssa___credential_extraction_lazagne_command_options.yml --- ...tolen_credentials_via_mimikatz_modules.yml | 34 ++++++--- ...en_credentials_via_powersploit_modules.yml | 24 +++--- ...ntial_strength_via_dsinternals_modules.yml | 22 +++--- ...raction_dsinternals_conversion_modules.yml | 39 +++++----- ...dential_extraction_dsinternals_modules.yml | 36 +++++---- ...l_extraction_fgdump_cachedump_s_option.yml | 38 +++++----- ...l_extraction_fgdump_cachedump_v_option.yml | 37 ++++++---- ...al_extraction_getaddbaccount_from_dump.yml | 0 ...ial_extraction_lazagne_command_options.yml | 0 ...credential_extraction_mimikatz_modules.yml | 0 ...al_extraction_ms_debuggers_kernel_peek.yml | 0 ...ntial_extraction_ms_debuggers_z_option.yml | 0 ...dential_extraction_powersploit_modules.yml | 0 ...s_user_content_via_powersploit_modules.yml | 0 ...count_creation_via_powersploit_modules.yml | 0 ...enable_disable_via_dsinternals_modules.yml | 0 ...egal_log_deletion_via_mimikatz_modules.yml | 0 ...s_and_policies_via_dsinternals_modules.yml | 0 ...nd_AD_elements_via_powersploit_modules.yml | 0 ...nd_persistence_via_powersploit_modules.yml | 0 ...ivilege_elevation_via_mimikatz_modules.yml | 0 ...d_process_control_via_mimikatz_modules.yml | 0 ...rocess_control_via_powersploit_modules.yml | 0 ...en_credentials_via_powersploit_modules.yml | 0 ..._opportunities_via_powersploit_modules.yml | 0 ...roups_policies_via_powersploit_modules.yml | 0 ...e_accounts_groups_via_mimikatz_modules.yml | 0 ...infrastructure_via_powersploit_modules.yml | 0 ...puters_domains_via_powersploit_modules.yml | 0 ...and_use_computers_via_mimikatz_modules.yml | 0 ...ystem_elements_via_powersploit_modules.yml | 0 ...on_and_use_shares_via_mimikatz_modules.yml | 0 ...and_use_shares_via_powersploit_modules.yml | 0 ...n_connectivity_via_powersploit_modules.yml | 0 ...ores_and_services_via_mimikatz_modules.yml | 0 ...efensive_tools_via_powersploit_modules.yml | 0 ..._opportunities_via_powersploit_modules.yml | 0 ...service_hijacking_via_mimikatz_modules.yml | 0 ...sses_and_services_via_mimikatz_modules.yml | 0 ...ng_credentials_via_dsinternals_modules.yml | 0 ...tting_credentials_via_mimikatz_modules.yml | 0 ...ng_credentials_via_powersploit_modules.yml | 0 .../ssa___attempt_to_delete_services.yml | 47 +++++++++--- .../ssa___attempt_to_disable_services.yml | 48 ++++++++---- ...dential_dump_from_registry_via_reg_exe.yml | 32 ++++---- .../endpoint/ssa___delete_a_net_user.yml | 17 ++--- ...___deny_permission_using_cacls_utility.yml | 16 ++-- ...detect_dump_lsass_memory_using_comsvcs.yml | 42 +++++------ .../ssa___disable_net_user_account.yml | 40 ++++++++-- .../ssa___first_time_seen_cmd_line.yml | 25 ++++--- ...__grant_permission_using_cacls_utility.yml | 16 ++-- ...fy_acls_permission_of_files_or_folders.yml | 9 ++- ...a___prohibited_apps_spawning_cmdprompt.yml | 15 ++-- .../ssa___ptt_pth_kerb_ntlm_dest_device.yml | 9 ++- .../ssa___ptt_pth_kerb_ntlm_origin_device.yml | 5 +- ...are_parent_process_relationship_lolbas.yml | 16 ++-- .../ssa___resize_shadowstorage_volume.yml | 17 ++--- .../ssa___sdelete_application_execution.yml | 74 ++++++++++++------- 58 files changed, 383 insertions(+), 275 deletions(-) rename detections/{endpoint => deprecated}/ssa___applying_stolen_credentials_via_mimikatz_modules.yml (55%) rename detections/{endpoint => deprecated}/ssa___applying_stolen_credentials_via_powersploit_modules.yml (64%) rename detections/{endpoint => deprecated}/ssa___assess_credential_strength_via_dsinternals_modules.yml (68%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_dsinternals_conversion_modules.yml (66%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_dsinternals_modules.yml (76%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_fgdump_cachedump_s_option.yml (70%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_fgdump_cachedump_v_option.yml (67%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_getaddbaccount_from_dump.yml (100%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_lazagne_command_options.yml (100%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_ms_debuggers_kernel_peek.yml (100%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_ms_debuggers_z_option.yml (100%) rename detections/{endpoint => deprecated}/ssa___credential_extraction_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_access_user_content_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_account_creation_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_log_deletion_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___illegal_service_and_process_control_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_computers_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_shares_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_and_use_shares_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_connectivity_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_defensive_tools_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___recon_processes_and_services_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___setting_credentials_via_dsinternals_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___setting_credentials_via_mimikatz_modules.yml (100%) rename detections/{endpoint => deprecated}/ssa___setting_credentials_via_powersploit_modules.yml (100%) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml similarity index 55% rename from detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml rename to detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index ce57b526e6..69518c020c 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -1,30 +1,35 @@ name: Applying Stolen Credentials via Mimikatz modules id: 759a653f-cb92-40f9-94c9-ec4e47b0f709 -version: 1 -date: '2020-11-03' +version: 2 +date: '2021-11-24' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Endpoint_Processes -description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token - attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. + - Endpoint_Processes +description: 'The following analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket, Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior is typically performed within interactive Mimikatz memory space, however it may be identified on the command-line. + A Pass-the-Ticket (ptt) attack is performed once an adversary has established access to a single endpoint and retrieved the kerberos ticket to now begin moving laterally using this method. Typically, it blends in with logon activity as the ticket can be copied to another system and passed into the current session effectively simulating a logon without any communication with the Domain Controller. + A Golden or Silver ticket attack requires some setup by the adversary, but once performed it will simulate lateral based authentication to additional endpoints.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) - | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest, - including the event ID 4688 with enabled command line logging. -known_false_positives: None identified. +how_to_implement: To successfully implement this search, you need to be ingesting logs + with the process name, parent process, and command-line executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: None identified as this is strictly identifying known command-line attributes related to Mimikatz. references: -- https://github.com/gentilkiwi/mimikatz -- https://adsecurity.org/?p=1275 + - https://github.com/gentilkiwi/mimikatz + - https://adsecurity.org/?p=1275 + - https://adsecurity.org/?p=1515 + - https://adsecurity.org/?page_id=1821#KERBEROSPTT + - https://attack.mitre.org/software/S0002/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash tags: analytic_story: - Credential Dumping @@ -58,6 +63,10 @@ tags: - T1554 - T1556 - T1558 + - T1558.002 + - T1558.001 + - T1003 + - T1003.001 nist: - PR.AC - PR.IP @@ -81,6 +90,7 @@ tags: - dest_user_id - process - _time + - cmd_line risk_score: 90 risk_severity: high - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml similarity index 64% rename from detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml rename to detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml index c52f46a113..1023e7c74c 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -1,15 +1,13 @@ name: Applying Stolen Credentials via PowerSploit modules id: 270b482d-2af2-448f-9923-9cf005f61be4 -version: 1 -date: '2020-11-03' +version: 2 +date: '2021-11-24' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Endpoint_Processes -description: Stolen credentials are applied by methods such as user impersonation, - credential injection, spoofing of authentication processes or getting hold of critical - accounts. This detection indicates such activities carried out by PowerSploit exploit - kit APIs. + - Endpoint_Processes +description: 'The following analytic identifies commonly used PowerSploit modules that perform credential access, spoofing of authentication processes, user impersonation and attempting to manipulate tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`, `Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied as modules used to access credentials. + PowerSploit is an archived project on GitHub, but much of its modules and scripts are still utilized today by adversaries. This behavior is typically performed within interactive PowerShell sessions or injected into processes, however it may be identified on the command-line.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), @@ -24,11 +22,13 @@ search: '| from read_ssa_enriched_events() "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest, - including the event ID 4688 with enabled command line logging. -known_false_positives: None identified. +how_to_implement: To successfully implement this search, you need to be ingesting logs + with the process name, parent process, and command-line executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: None identified as this is strictly identifying known command-line attributes related to PowerSploit. references: -- https://github.com/PowerShellMafia/PowerSploit + - https://github.com/PowerShellMafia/PowerSploit + - https://attack.mitre.org/software/S0194/ tags: analytic_story: - Credential Dumping @@ -62,6 +62,7 @@ tags: - T1554 - T1555 - T1558 + - T1059.001 nist: - PR.AC - PR.IP @@ -85,6 +86,7 @@ tags: - dest_user_id - process - _time + - cmd_line risk_score: 90 risk_severity: high security_domain: endpoint diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml similarity index 68% rename from detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml rename to detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml index 77ce2b1fb7..7db363f5db 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -1,13 +1,12 @@ name: Assessment of Credential Strength via DSInternals modules id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f -version: 1 -date: '2020-11-03' +version: 2 +date: '2021-11-24' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Endpoint_Processes -description: This detection identifies use of DSInternals modules that verify password - strength, i.e., identify weak accounts that would be easily compromised. + - Endpoint_Processes +description: 'The following analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that verifies password strength. Adversaries have utilized this module to determine password complexity or to identify accounts with weak passwords.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), @@ -19,11 +18,13 @@ search: '| from read_ssa_enriched_events() "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest, - including the event ID 4688 with enabled command line logging. -known_false_positives: None identified. +how_to_implement: To successfully implement this search, you need to be ingesting logs + with the process name, parent process, and command-line executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals. references: -- https://github.com/MichaelGrafnetter/DSInternals + - https://github.com/MichaelGrafnetter/DSInternals + - https://attack.mitre.org/techniques/T1059/001/ tags: analytic_story: - Credential Dumping @@ -49,6 +50,8 @@ tags: - T1201 - T1552 - T1555 + - T1059.001 + - T1059 nist: - PR.AC - PR.IP @@ -72,6 +75,7 @@ tags: - process - dest_device_id - dest_user_id + - cmd_line risk_score: 25 risk_severity: high security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml similarity index 66% rename from detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml rename to detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml index f3c7b0941e..346e9ec039 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -1,16 +1,14 @@ name: Credential Extraction indicative of use of DSInternals credential conversion modules id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2 -version: 1 -date: '2020-10-21' +version: 2 +date: '2021-11-29' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Endpoint_Processes -description: Credential extraction is often an illegal recovery of credential material - from secured authentication resources and repositories. This process may also involve - decryption or other transformations of the stored credential material. DSInternals - is a collection of PowerShell modules commonly employed in exploits. + - Endpoint_Processes +description: 'The following analytic identifies modules within DSInternals that are used for extracting credentials from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`, `ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`, `ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`. + Adversaries may use these modules for decrypting or transforming the stored credentials.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), @@ -30,11 +28,14 @@ search: '| from read_ssa_enriched_events() "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest, - including the event ID 4688 with enabled command line logging. -known_false_positives: None identified. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals. references: -- https://github.com/MichaelGrafnetter/DSInternals + - https://github.com/MichaelGrafnetter/DSInternals + - https://attack.mitre.org/techniques/T1059/001/ tags: analytic_story: - Credential Dumping @@ -53,10 +54,12 @@ tags: kill_chain_phases: - Actions on Objectives message: DSInternals tool kit is converting stolen credential material to a form - applicable to authentications. Operation is performed at the device $dest_device_id$, - by the account $dest_user_id$ via command $cmd_line$ + applicable to authentications. Operation is performed on the device $dest_device_id$, + by the account $dest_user_id$ via process $process_name$. mitre_attack_id: - T1003 + - T1003.002 + - T1059.001 nist: - PR.AC - PR.IP @@ -69,10 +72,10 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname + - name: process_name + type: process role: - - Others + - Child Process product: - Splunk Behavioral Analytics required_fields: @@ -82,7 +85,7 @@ tags: - _time - process_path - dest_user_id - - process + - cmd_line risk_score: 70 risk_severity: high - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml similarity index 76% rename from detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml rename to detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml index ad2a5a161b..0b9a3c4b74 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml @@ -1,15 +1,13 @@ name: Credential Extraction indicative of use of DSInternals modules id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d -version: 1 -date: '2020-10-21' +version: 2 +date: '2021-11-29' author: Stanislav Miskovic, Splunk type: TTP -datamodel: -- Endpoint_Processes -description: Credential extraction is often an illegal recovery of credential material - from secured authentication resources and repositories. This process may also involve - decryption or other transformations of the stored credential material. DSInternals - is a collection of PowerShell modules commonly employed in exploits. +datamodel: + - Endpoint_Processes +description: 'The following analytic identifies modules of DSInternals being used on the associated endpoint. + Adversaries may use these modules for manipulating data related to Active Directory and credentials.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), @@ -31,11 +29,14 @@ search: '| from read_ssa_enriched_events() "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest, - including the event ID 4688 with enabled command line logging. -known_false_positives: None identified. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals. references: -- https://github.com/MichaelGrafnetter/DSInternals + - https://github.com/MichaelGrafnetter/DSInternals + - https://attack.mitre.org/techniques/T1059/001/ tags: analytic_story: - Credential Dumping @@ -56,9 +57,11 @@ tags: message: DSInternals tool kit is accessing sensitive credential material such as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ - via command $cmd_line$ + via process $process_name$ mitre_attack_id: - T1003 + - T1003.002 + - T1059.001 nist: - PR.AC - PR.IP @@ -71,10 +74,10 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname + - name: process_name + type: Process role: - - Others + - Child Process product: - Splunk Behavioral Analytics required_fields: @@ -85,6 +88,7 @@ tags: - process_path - dest_user_id - process + - cmd_line risk_score: 70 risk_severity: high security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml similarity index 70% rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 100e2c60f0..70ca0fb8aa 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -1,17 +1,13 @@ name: Credential Extraction indicative of FGDump and CacheDump with s option id: 312582f2-5e91-42c1-a275-cd67f31373c8 -version: 1 -date: '2020-10-18' +version: 2 +date: '2021-11-29' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Endpoint_Processes -description: Credential extraction is often an illegal recovery of credential material - from secured authentication resources and repositories. This process may also involve - decryption or other transformations of the stored credential material. FGdump is - a newer version of pwdump tool that extracts NTLM and LanMan password hashes from - Windows. Cachedump is a publicly-available tool that extracts cached password hashes - from a system's registry. + - Endpoint_Processes +description: 'The following analytic identifies the use of CacheDump with the `-s` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes + from a system's registry.' search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), @@ -28,10 +24,16 @@ search: ' | from read_ssa_enriched_events() "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest, - including the event ID 4688 with enabled command line logging. -known_false_positives: None identified. -references: [] +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed. +references: + - https://attack.mitre.org/software/S0119/ + - https://en.kali.tools/all/?tool=182 + - http://foofus.net/goons/fizzgig/fgdump/ + - https://attack.mitre.org/software/S0120/ tags: analytic_story: - Unusual Processes @@ -51,9 +53,10 @@ tags: - Actions on Objectives message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ - via command $cmd_line$ + via process $process_name$. mitre_attack_id: - T1003 + - T1003.002 nist: - PR.AC - PR.IP @@ -66,10 +69,10 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname + - name: process_name + type: Process role: - - Others + - Child Process product: - Splunk Behavioral Analytics required_fields: @@ -80,6 +83,7 @@ tags: - process_path - dest_user_id - process + - cmd_line risk_score: 70 risk_severity: high security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml similarity index 67% rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml index c636e1241d..10a83d9d9a 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -1,17 +1,13 @@ name: Credential Extraction indicative of FGDump and CacheDump with v option id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38 -version: 1 -date: '2020-10-18' +version: 2 +date: '2021-11-29' author: Stanislav Miskovic, Splunk type: TTP datamodel: -- Endpoint_Processes -description: Credential extraction is often an illegal recovery of credential material - from secured authentication resources and repositories. This process may also involve - decryption or other transformations of the stored credential material. FGdump is - a newer version of pwdump tool that extracts NTLM and LanMan password hashes from - Windows. Cachedump is a publicly-available tool that extracts cached password hashes - from a system's registry. + - Endpoint_Processes +description: 'The following analytic identifies the use of CacheDump with the `-v` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes + from a system's registry.' search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), @@ -26,9 +22,16 @@ search: ' | from read_ssa_enriched_events() "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' -how_to_implement: You must be ingesting Windows Security logs from devices of interest, - including the event ID 4688 with enabled command line logging. -known_false_positives: None identified. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed. +references: + - https://attack.mitre.org/software/S0119/ + - https://en.kali.tools/all/?tool=182 + - http://foofus.net/goons/fizzgig/fgdump/ + - https://attack.mitre.org/software/S0120/ references: [] tags: analytic_story: @@ -49,9 +52,10 @@ tags: - Actions on Objectives message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ - via command $cmd_line$ + via process $process_name$ mitre_attack_id: - T1003 + - T1003.002 nist: - PR.AC - PR.IP @@ -64,10 +68,10 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname + - name: process_name + type: Process role: - - Others + - Child Process product: - Splunk Behavioral Analytics required_fields: @@ -77,6 +81,7 @@ tags: - process_path - dest_user_id - process + - cmd_line risk_score: 63 risk_severity: high security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml similarity index 100% rename from detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml rename to detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml similarity index 100% rename from detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml rename to detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml rename to detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml similarity index 100% rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml similarity index 100% rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/deprecated/ssa___credential_extraction_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___credential_extraction_powersploit_modules.yml rename to detections/deprecated/ssa___credential_extraction_powersploit_modules.yml diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml rename to detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml rename to detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml rename to detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml rename to detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml rename to detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml rename to detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml rename to detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml rename to detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml rename to detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml rename to detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml rename to detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml rename to detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml rename to detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml rename to detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml rename to detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml rename to detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml rename to detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml rename to detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml similarity index 100% rename from detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml rename to detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml similarity index 100% rename from detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml rename to detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml similarity index 100% rename from detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml rename to detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index 02b3713ccb..dce5968c05 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -1,16 +1,13 @@ name: Attempt To Delete Services id: a0c8c292-d01a-11eb-aa18-acde48001122 version: 3 -date: '2021-11-30' +date: '2021-11-24' author: Teoderick Contreras, splunk type: TTP datamodel: -- Endpoint_Processes -description: The following analytic identifies Windows Service Control, `sc.exe`, - attempting to delete a service. This is typically identified in parallel with other - instances of service enumeration of attempts to stop a service and then delete it. - Adversaries utilize this technique to terminate security services or other related - services to continue there objective and evade detections. + - Endpoint_Processes +description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue + there objective and evade detections.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), @@ -26,11 +23,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. -known_false_positives: It is possible administrative scripts may start/stop/delete - services. Filter as needed. + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed. references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md tags: analytic_story: - XMRig @@ -52,6 +49,8 @@ tags: on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. mitre_attack_id: - T1489 + - T1543 + - T1543.003 nist: - PR.DS - PR.IP @@ -86,3 +85,29 @@ tags: risk_score: 36 risk_severity: high security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index ece73aba06..1e7689adcf 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -1,16 +1,13 @@ name: Attempt To Disable Services id: afb31de4-d023-11eb-98d5-acde48001122 version: 3 -date: '2021-11-30' +date: '2021-11-24' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint_Processes -description: The following analytic identifies Windows Service Control, `sc.exe`, - attempting to disable a service. This is typically identified in parallel with other - instances of service enumeration of attempts to stop a service and then disable - it. Adversaries utilize this technique to terminate security services or other related - services to continue there objective and evade detections. + - Endpoint_Processes +description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue + there objective and evade detections.' search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), @@ -27,13 +24,12 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. -known_false_positives: It is possible administrative scripts may start/stop/delete - services. Filter as needed. + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed. references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service tags: analytic_story: - XMRig @@ -88,3 +84,29 @@ tags: risk_score: 36 risk_severity: medium security_domain: endpoint +impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index fb81931e78..ed66d0cca6 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,13 +1,12 @@ name: Attempted Credential Dump From Registry via Reg exe id: 14038953-e5f2-4daf-acff-5452062baf03 -version: 1 -date: 2020-6-04 +version: 2 +date: '2021-11-29' author: Jose Hernandez, Splunk type: TTP datamodel: -- Endpoint_Processes -description: Monitor for execution of reg.exe with parameters specifying an export - of keys that contain hashed credentials that attackers may try to crack offline. + - Endpoint_Processes +description: 'The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking.' search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), @@ -22,11 +21,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events(); ' -how_to_implement: You must be ingesting windows endpoint data that tracks process - activity, including parent-child relationships from your endpoints. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. known_false_positives: None identified. references: -- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml + - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets tags: analytic_story: - Credential Dumping @@ -43,11 +45,10 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: Malicious actor is dumping stored credentials from the registry sections - SAM, Security, or System. Operation is performed at the device $dest_device_id$, - by the account $dest_user_id$ via command $cmd_line$ + message: An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$. mitre_attack_id: - T1003 + - T1003.002 nist: - DE.CM observable: @@ -59,10 +60,10 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname + - name: process_name + type: process role: - - Others + - Child Process product: - Splunk Behavioral Analytics required_fields: @@ -71,6 +72,7 @@ tags: - dest_device_id - dest_user_id - process + - cmd_line risk_score: 63 risk_severity: low - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 0d8c7562fe..04281188df 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -5,7 +5,7 @@ date: '2021-11-30' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint_Processes + - Endpoint_Processes description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some @@ -18,14 +18,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%") - AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), - "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, - "parent_process_name", parent_process_name, "process_path", process_path]) | into - write_ssa_detected_events();' -how_to_implement: o successfully implement this search, you need to be ingesting logs + cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used. diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 99f240479b..2ffee7990f 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -1,15 +1,12 @@ name: Deny Permission using Cacls Utility id: b76eae28-cd25-11eb-9c92-acde48001122 -version: 2 -date: '2021-06-14' +version: 3 +date: '2021-11-29' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint_Processes -description: This analytic identifies a potential adversary that changes the security - permission of a specific file or directory. This technique is commonly seen in APT - tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection - and prevent access to their component files. + - Endpoint_Processes +description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), @@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: network administrator may use this windows utility but this - is not a common practice. +known_false_positives: System administrators may use cacls utilities but this + is not a common practice. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: @@ -71,6 +68,7 @@ tags: - process_path - dest_user_id - process + - cmd_line risk_score: 35 risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 51de8d3da3..e2bf1d6826 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -1,29 +1,29 @@ name: Detect Dump LSASS Memory using comsvcs id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e version: 2 -date: '2020-09-15' +date: '2021-11-29' author: Jose Hernandez, Splunk type: TTP -datamodel: -- Endpoint_Processes -description: This search detects the memory of lsass.exe being dumped for offline - credential theft attack. -search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) - | eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), - timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, - "process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", - null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true - | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id) - | eval body=create_map(["event_id", event_id, "process_name", process_name, "process", - process]) | into write_ssa_detected_events();' +datamodel: + - Endpoint_Processes +description: 'The following analytic identifies credential dumping using comsvcs.dll with `regsvr32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe and perform offline password cracking.' +search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, + "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), + "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, + /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = + timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, + "process_name", process_name, "process", process]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). -known_false_positives: None identified. +known_false_positives: False positives should be limited, filter as needed. references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll tags: analytic_story: - Credential Dumping @@ -41,9 +41,7 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc - DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ - via command $cmd_line$ + message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$. mitre_attack_id: - T1003.003 - T1003 @@ -58,10 +56,6 @@ tags: type: Hostname role: - Victim - - name: cmd_line - type: processname - role: - - Others product: - Splunk Behavioral Analytics required_fields: @@ -72,4 +66,4 @@ tags: - process risk_score: 70 risk_severity: low - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index 0948312f9f..2f03297a38 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -1,15 +1,14 @@ name: Disable Net User Account id: ba858b08-d26c-11eb-af9b-acde48001122 version: 3 -date: '2021-12-01' +date: '2021-11-30' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint_Processes + - Endpoint_Processes description: This analytic will identify a suspicious command-line that disables a - user account using the native `net.exe` or `net1.exe` utility to Windows. This technique - may used by the adversaries to interrupt availability of accounts and continue the - impact against the organization. + user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used + by the adversaries to interrupt availability of accounts and continue the impact against the organization. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), @@ -28,8 +27,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used. -known_false_positives: System administrators or automated scripts may disable an account - but not a common practice. Filter as needed. +known_false_positives: System administrators or automated scripts may disable an + account but not a common practice. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: @@ -52,6 +51,7 @@ tags: on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. mitre_attack_id: - T1489 + - T1078 nist: - PR.AC - PR.IP @@ -83,6 +83,30 @@ tags: - dest_user_id - process - cmd_line - risk_score: 49 risk_severity: medium security_domain: endpoint + impact: 80 + confidence: 50 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. + observable: + - name: user + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 05bdaabafe..554d4d973e 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -1,14 +1,15 @@ name: First time seen command line argument id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23 -version: 3 -date: 2021-2-1 +version: 4 +date: '2021-11-30' author: Ignacio Bermudez Corrales, Splunk type: Anomaly datamodel: -- Endpoint_Processes + - Endpoint_Processes description: This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel. + 'The following analytic identifies first time seen command-line arguments on a single endpoint. The analytic looks for arguments instantiated by `cmd.exe /c` and the associated command-line. Adversaries automate or spawn multiple processes using this method, this analytic may assist with identifying the first time it's been found on this endpoint.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", @@ -26,12 +27,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' -how_to_implement: You must be populating the endpoint data model for SSA and specifically - the process_name and the process fields -known_false_positives: Legitimate programs can also use command-line arguments to - execute. Please verify the command-line arguments to check what command/program - is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` - macro to exclude legitimate parent_process_name +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Legitimate programs use command-line arguments to + execute. Verify the command-line arguments to check what command/program + is being executed. Filtering will be needed. references: [] tags: analytic_story: @@ -47,11 +49,9 @@ tags: kill_chain_phases: - Command and Control - Actions on Objectives - message: A cmd process $process_name$ with commandline $cmd_line$ try to execute - command has not previously seen in host $dest_device_id$ + message: A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$ mitre_attack_id: - T1059 - - T1117 - T1202 nist: - PR.PT @@ -74,6 +74,7 @@ tags: - dest_device_id - dest_user_id - process + - cmd_line risk_score: 30 risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 8356803542..93a6d31601 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -1,15 +1,12 @@ name: Grant Permission Using Cacls Utility id: c6da561a-cd29-11eb-ae65-acde48001122 -version: 2 -date: '2021-06-14' +version: 3 +date: '2021-11-30' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint_Processes -description: This analytic identifies potential adversaries that modify the security - permission of a specific file or directory. This technique is commonly seen in APT - tradecraft, ransomware and coinminer scripts to evade detections and restrict access - to their component files. + - Endpoint_Processes +description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk.' search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), @@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: network administrator may use this windows utility but this - is not a common practice. +known_false_positives: System administrators may use cacls utilities but this + is not a common practice. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: @@ -71,6 +68,7 @@ tags: - process_path - dest_user_id - process + - cmd_line risk_score: 35 risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 872c2a90b7..944c08e1bf 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -1,7 +1,7 @@ name: Modify ACLs Permission Of Files Or Folders id: 9ae9a48a-cdbe-11eb-875a-acde48001122 -version: 1 -date: '2021-06-15' +version: 2 +date: '2021-11-30' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -10,7 +10,7 @@ description: This analytic identifies suspicious modification of ACL permission a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. - This behavior is a good indicator if this command seen on a machine utilized by + This behavior raises suspicion if this command is seen on an endpoint utilized by an account with no permission to do so. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", @@ -29,7 +29,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. -known_false_positives: network administrator may use this windows utility. filter +known_false_positives: System administrators may use this windows utility. filter is needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -74,6 +74,7 @@ tags: - process_path - dest_user_id - process + - cmd_line risk_score: 35 risk_severity: medium security_domain: endpoint diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 26609a21e8..c557ace1ce 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -4,15 +4,11 @@ version: 2 date: '2020-11-10' author: Ignacio Bermudez Corrales, Splunk type: Anomaly -datamodel: -- Endpoint_Processes -description: The following analytic identifies parent processes, browsers, Windows - terminal applications, Office Products and Java spawning cmd.exe. By its very nature, - many applications spawn cmd.exe natively or built into macros. Much of this will - need to be tuned to further enhance the risk. During triage, review parallel process - execution and identify any file modifications that may have occurred. Capture any - artifacts and review further. -search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) +datamodel: + - Endpoint_Processes +description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.' +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", @@ -82,6 +78,7 @@ tags: - _time - dest_device_id - dest_user_id + - cmd_line risk_score: 35 risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index 2a847efb46..f4689ce0bf 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -1,13 +1,13 @@ name: Potential Pass the Token or Hash Observed at the Destination Device id: 82e76b80-5cdb-4899-9b43-85dbe777b36d -version: 2 -date: '2021-11-05' +version: 3 +date: '2021-11-30' author: Stanislav Miskovic, Splunk type: TTP datamodel: - Authentication description: This detection identifies potential Pass the Token or Pass the Hash credential - exploits. We detect the main side effect of these attacks, which is a transition + stealing. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by a detination device. search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels) @@ -44,7 +44,8 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). references: -- https://attack.mitre.org/techniques/T1550/002/ + - https://attack.mitre.org/techniques/T1550/002/ + - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ tags: analytic_story: - Lateral Movement diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 3cb105366d..784ea8bce1 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Authentication description: This detection identifies potential Pass the Token or Pass the Hash credential - exploits. We detect the main side effect of these attacks, which is a transition + stealing. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). @@ -47,7 +47,8 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). references: -- https://attack.mitre.org/techniques/T1550/002/ + - https://attack.mitre.org/techniques/T1550/002/ + - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ tags: analytic_story: - Lateral Movement diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index 17cfa4730e..a8cdd518a8 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -1,13 +1,13 @@ name: Rare Parent-Child Process Relationship id: cf090c78-bcc6-11eb-8529-0242ac130003 -version: 1 -date: '2021-05-20' +version: 2 +date: '2021-11-30' author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk type: Anomaly datamodel: - Endpoint_Processes description: An attacker may use LOLBAS tools spawned from vulnerable applications - not typically used by system administrators. This search leverages the Splunk Streaming + not typically used by system administrators. This analytic leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, @@ -52,12 +52,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. -known_false_positives: 'Some custom tools used by admins could be used rarely to launch +known_false_positives: 'Some custom tools used by administrators could be used rarely to launch remotely applications. This might trigger false positives at the beginning when - it hasn''t collected yet enough data to construct the baseline. - - ' -references: [] + it hasn''t collected yet enough data to construct the baseline.' +references: + - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries tags: analytic_story: - Unusual Processes @@ -82,5 +81,6 @@ tags: - _time - dest_device_id - dest_user_id + - cmd_line risk_severity: low security_domain: endpoint diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index 57327daab1..f9da11fb80 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -1,17 +1,13 @@ name: Resize Shadowstorage Volume id: dbc30554-d27e-11eb-9e5e-acde48001122 -version: 2 -date: '2021-06-21' +version: 3 +date: '2021-11-30' author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint_Processes -description: The following analytics identifies the resizing of shadowstorage by ransomware - malware to avoid the shadow volumes being made again. this technique is an alternative - by ransomware attacker than deleting the shadowstorage which is known alert in defensive - team. one example of ransomware that use this technique is CLOP ransomware where - it drops a .bat file that will resize the shadowstorage to minimum size as much - as possible +description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event + and a precursor to deleting the shadowstorage. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), @@ -29,8 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: System administrators may resize the shadowstorage for valid - purposes. Filter as needed. +known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed. references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html @@ -88,4 +83,4 @@ tags: - cmd_line risk_score: 64 risk_severity: high - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index 2ccd153f23..d6de77e508 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -5,34 +5,30 @@ date: '2021-11-15' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint_Processes -description: This analytic will detect the execution of sdelete.exe attempting to - delete potentially important files that may related to adversary or insider threats - to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant - to securely delete files on disk. This tool is commonly used to clear tracks and - artifact on the targeted host. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), - "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", - null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", - null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), - parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), - event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line - IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND - (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") - OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s - %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line, - "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line, - "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line, - "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line, - "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line, - "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line, - "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, - "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "process_path", process_path, "parent_process_name", parent_process_name, - "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();' + - Endpoint_Processes +description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files + that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility + meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host. +search: '| from read_ssa_enriched_events() + | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), + cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), + process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), + process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), + parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") + AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") + OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") + OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") + OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") + OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") + OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") + OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") + OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) + | into write_ssa_detected_events();' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -60,6 +56,28 @@ tags: - T1485 - T1070.004 - T1070 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest + - user + - parent_process_name + - parent_process + - process_name + - process + - process_id + - process_path + - cmd_line + security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Execution + message: sdelete process $process_name$ executed on $dest$ attempting to permanently delete files. observable: - name: dest type: Endpoint From 370ef774ed4537c0d6887324ca95b94daea9fc0b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Dec 2021 06:01:32 -0700 Subject: [PATCH 04/26] minor fixes - passed validate --- .../ssa___credential_extraction_fgdump_cachedump_s_option.yml | 2 +- .../ssa___credential_extraction_fgdump_cachedump_v_option.yml | 2 +- detections/endpoint/ssa___attempt_to_disable_services.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 70ca0fb8aa..d31701b203 100644 --- a/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint_Processes description: 'The following analytic identifies the use of CacheDump with the `-s` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes - from a system's registry.' + from a system''s registry.' search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), diff --git a/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 10a83d9d9a..ec6113cf84 100644 --- a/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint_Processes description: 'The following analytic identifies the use of CacheDump with the `-v` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes - from a system's registry.' + from a system''s registry.' search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 1e7689adcf..3e2413c30a 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -84,7 +84,7 @@ tags: risk_score: 36 risk_severity: medium security_domain: endpoint -impact: 60 + impact: 60 confidence: 60 # (impact * confidence)/100 risk_score: 36 From a862fd7d4ae38bb782cfeb122a739c4e52f5f12c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Dec 2021 10:19:40 -0700 Subject: [PATCH 05/26] Update net_localgroup_discovery.yml --- detections/endpoint/net_localgroup_discovery.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index be87f8b84f..ea47f2e0e7 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Windows Discovery Techniques automated_detection_testing: passed confidence: 50 context: From 0e53970750efe82bb397308c6bc3ca2a35318bba Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Dec 2021 11:26:27 -0700 Subject: [PATCH 06/26] First SSA --- ...ssa___detect_rclone_command_line_usage.yml | 94 ++++++++++++++++++ ...dows_curl_upload_to_remote_destination.yml | 98 +++++++++++++++++++ ..._detect_rclone_command_line_usage.test.yml | 9 ++ ...curl_upload_to_remote_destination.test.yml | 9 ++ 4 files changed, 210 insertions(+) create mode 100644 detections/endpoint/ssa___detect_rclone_command_line_usage.yml create mode 100644 detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml create mode 100644 tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml create mode 100644 tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml new file mode 100644 index 0000000000..d5f05e42a1 --- /dev/null +++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -0,0 +1,94 @@ +name: Detect RClone Command-Line Usage +id: e8b74268-5454-11ec-a799-acde48001122 +version: 1 +date: '2021-12-03' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic identifies commonly used command-line arguments used by + `rclone.exe` to initiate a file transfer. Some arguments were negated as they are + specific to the configuration used by adversaries. In particular, an adversary may + list the files or directories of the remote file share using `ls` or `lsd`, which + is not indicative of malicious behavior. During triage, at this stage of a ransomware + event, exfiltration is about to occur or has already. Isolate the endpoint and continue + investigating by review file modifications and parallel processes. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND + (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%") + OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%") + OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") + OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: False positives should be limited as this is restricted to + the Rclone process name. Filter or tune the analytic as needed. +references: + - https://redcanary.com/blog/rclone-mega-extortion/ + - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ +tags: + analytic_story: + - DarkSide Ransomware + - Ransomware + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + impact: 50 + kill_chain_phases: + - Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service + to move files or folders. + mitre_attack_id: + - T1020 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml new file mode 100644 index 0000000000..523e92a434 --- /dev/null +++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -0,0 +1,98 @@ +name: 2 Windows Curl Upload to Remote Destination +id: cc8d046a-543b-11ec-b864-acde48001122 +version: 1 +date: '2021-12-03' +author: Michael Haag, Splunk +type: TTP +datamodel: + - Endpoint_Processes +description: 'The following analytic identifies the use of Windows Curl.exe uploading + a file to a remote destination. \ + + `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. + \ + + `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving + web application, and it is, for example, how most common HTML forms on the web work. + \ + + HTTP multipart formposts are done with `-F`, but this appears to not be compatible + with the Windows version of Curl. Will update if identified adversary tradecraft. + \ + + Adversaries may use one of the three methods based on the remote destination and + what they are attempting to upload (zip vs txt). During triage, review parallel + processes for further behavior. In addition, identify if the upload was successful + in network logs. If a file was uploaded, isolate the endpoint and review.' +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" AND + (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, "%-d %") + OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %")) + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: False positives may be limited to source control applications + and may be required to be filtered out. +references: + - https://everything.curl.dev/usingcurl/uploads + - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 + - https://twitter.com/d1r4c/status/1279042657508081664?s=20 +tags: + analytic_story: + - Ingress Tool Transfer + automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log + impact: 80 + kill_chain_phases: + - Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination. + mitre_attack_id: + - T1105 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + security_domain: endpoint diff --git a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml new file mode 100644 index 0000000000..26bdade65a --- /dev/null +++ b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml @@ -0,0 +1,9 @@ +name: Detect RClone Command-Line Usage Unit Test +tests: +- name: Detect RClone Command-Line Usage + file: endpoint/ssa___detect_rclone_command_line_usage.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml new file mode 100644 index 0000000000..57cd2b8000 --- /dev/null +++ b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml @@ -0,0 +1,9 @@ +name: Windows Curl Upload to Remote Destination Unit Test +tests: +- name: Windows Curl Upload to Remote Destination + file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon_curl_upload.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 575cb1dcf4be0d6723e0286189f39dcdd432a625 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Dec 2021 11:29:34 -0700 Subject: [PATCH 07/26] Update ssa___detect_rclone_command_line_usage.yml --- detections/endpoint/ssa___detect_rclone_command_line_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml index d5f05e42a1..b81ccbf90d 100644 --- a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -5,7 +5,7 @@ date: '2021-12-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may From b7cd6b07001d38080a9acfbebe39a97d7b53af5e Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Mon, 6 Dec 2021 14:13:03 -0500 Subject: [PATCH 08/26] Update ssa___rare_parent_process_relationship_lolbas.yml --- .../endpoint/ssa___rare_parent_process_relationship_lolbas.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index a8cdd518a8..a6faed82d7 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -54,7 +54,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: 'Some custom tools used by administrators could be used rarely to launch remotely applications. This might trigger false positives at the beginning when - it hasn''t collected yet enough data to construct the baseline.' + it has not collected yet enough data to construct the baseline.' references: - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries tags: From a6895729d309e1499a7c1676a71461a0d6478346 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Dec 2021 12:34:59 -0700 Subject: [PATCH 09/26] fixes --- .../ssa___attempt_to_delete_services.yml | 28 +-------- .../ssa___disable_net_user_account.yml | 27 +-------- .../ssa___sdelete_application_execution.yml | 58 +++++++------------ 3 files changed, 22 insertions(+), 91 deletions(-) diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index dce5968c05..b796491f7b 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -84,30 +84,4 @@ tags: - cmd_line risk_score: 36 risk_severity: high - security_domain: endpoint - impact: 60 - confidence: 60 - # (impact * confidence)/100 - risk_score: 36 - context: - - Source:Endpoint - - Stage:Privilege Escalation - - Stage:Persistence - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index 2f03297a38..05b13c5460 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -84,29 +84,4 @@ tags: - process - cmd_line risk_severity: medium - security_domain: endpoint - impact: 80 - confidence: 50 - # (impact * confidence)/100 - risk_score: 40 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. - observable: - - name: user - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index d6de77e508..504c9c1ab0 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -50,8 +50,25 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: sdelete process $process_name$ executed on $dest$ attempting to permanently - delete files. + message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently + delete files by $dest_user_id$. + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process mitre_attack_id: - T1485 - T1070.004 @@ -69,39 +86,4 @@ tags: - process_id - process_path - cmd_line - security_domain: endpoint - impact: 60 - confidence: 70 - # (impact * confidence)/100 - risk_score: 42 - context: - - Source:Endpoint - - Stage:Execution - message: sdelete process $process_name$ executed on $dest$ attempting to permanently delete files. - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest - - user - - parent_process_name - - parent_process - - process_name - - process - - process_id - - process_path - risk_score: 42 - security_domain: endpoint + security_domain: endpoint \ No newline at end of file From 228330b1824c067e2c14b12d1e47d3b5db1e8bf5 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Dec 2021 13:27:36 -0700 Subject: [PATCH 10/26] Update ssa___attempt_to_disable_services.yml --- .../ssa___attempt_to_disable_services.yml | 28 +------------------ 1 file changed, 1 insertion(+), 27 deletions(-) diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 3e2413c30a..313f4d4564 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -83,30 +83,4 @@ tags: - process risk_score: 36 risk_severity: medium - security_domain: endpoint - impact: 60 - confidence: 60 - # (impact * confidence)/100 - risk_score: 36 - context: - - Source:Endpoint - - Stage:Privilege Escalation - - Stage:Persistence - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint \ No newline at end of file From 6ee79abe31f6a672da4708de92cff70d1113e0de Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Dec 2021 14:52:01 -0700 Subject: [PATCH 11/26] Update ssa___windows_curl_upload_to_remote_destination.yml --- .../ssa___windows_curl_upload_to_remote_destination.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index 523e92a434..c77d32a57e 100644 --- a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -1,4 +1,4 @@ -name: 2 Windows Curl Upload to Remote Destination +name: Windows Curl Upload to Remote Destination id: cc8d046a-543b-11ec-b864-acde48001122 version: 1 date: '2021-12-03' From c477482c73df7fbfc4512b1f1bea755a5c104d48 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 6 Dec 2021 14:10:11 -0800 Subject: [PATCH 12/26] risk_scores --- detections/endpoint/ssa___disable_net_user_account.yml | 1 + detections/endpoint/ssa___sdelete_application_execution.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index 05b13c5460..23b8d7ef16 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -84,4 +84,5 @@ tags: - process - cmd_line risk_severity: medium + risk_score: 49 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml index 504c9c1ab0..8aca4bc53b 100644 --- a/detections/endpoint/ssa___sdelete_application_execution.yml +++ b/detections/endpoint/ssa___sdelete_application_execution.yml @@ -48,6 +48,7 @@ tags: dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log impact: 60 + risk_score: 42 kill_chain_phases: - Exploitation message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently From 90b86965693e9a99527aae74d7299eabfa2afb2e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Dec 2021 00:38:46 +0000 Subject: [PATCH 13/26] Bump packaging from 21.2 to 21.3 Bumps [packaging](https://github.com/pypa/packaging) from 21.2 to 21.3. - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pypa/packaging/compare/21.2...21.3) --- updated-dependencies: - dependency-name: packaging dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements.txt b/requirements.txt index 990e0fa84b..f79215d2fb 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,12 +15,12 @@ configparser==5.1.0 contextlib2==21.6.0 distlib==0.3.3 distro==1.6.0 -filelock==3.3.2 +filelock==3.4.0 fire==0.4.0 gitdb==4.0.9 html5lib==1.1 humanfriendly==10.0 -identify==2.3.5 +identify==2.4.0 idna==3.3 importlib-metadata==4.8.2 importlib-resources==5.4.0 @@ -30,9 +30,9 @@ jsonschema==4.2.1 lockfile==0.12.2 MarkupSafe==2.0.1 more-itertools==8.11.0 -msgpack==1.0.2 +msgpack==1.0.3 nodeenv==1.6.0 -packaging==21.2 +packaging==21.3 pathlib2==2.3.6 pendulum==2.1.2 pep517==0.12.0 From 38b5c47405a1b3a85f1a500e9e6177509c7e7d8f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Dec 2021 00:38:54 +0000 Subject: [PATCH 14/26] Bump more-itertools from 8.11.0 to 8.12.0 Bumps [more-itertools](https://github.com/more-itertools/more-itertools) from 8.11.0 to 8.12.0. - [Release notes](https://github.com/more-itertools/more-itertools/releases) - [Commits](https://github.com/more-itertools/more-itertools/compare/v8.11.0...v8.12.0) --- updated-dependencies: - dependency-name: more-itertools dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements.txt b/requirements.txt index 990e0fa84b..79a60fd397 100644 --- a/requirements.txt +++ b/requirements.txt @@ -15,12 +15,12 @@ configparser==5.1.0 contextlib2==21.6.0 distlib==0.3.3 distro==1.6.0 -filelock==3.3.2 +filelock==3.4.0 fire==0.4.0 gitdb==4.0.9 html5lib==1.1 humanfriendly==10.0 -identify==2.3.5 +identify==2.4.0 idna==3.3 importlib-metadata==4.8.2 importlib-resources==5.4.0 @@ -29,8 +29,8 @@ Jinja2==3.0.3 jsonschema==4.2.1 lockfile==0.12.2 MarkupSafe==2.0.1 -more-itertools==8.11.0 -msgpack==1.0.2 +more-itertools==8.12.0 +msgpack==1.0.3 nodeenv==1.6.0 packaging==21.2 pathlib2==2.3.6 From 77f671932e084d723fd3c5781cc6c6fe85fdd2c6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Dec 2021 00:39:06 +0000 Subject: [PATCH 15/26] Bump configparser from 5.1.0 to 5.2.0 Bumps [configparser](https://github.com/jaraco/configparser) from 5.1.0 to 5.2.0. - [Release notes](https://github.com/jaraco/configparser/releases) - [Changelog](https://github.com/jaraco/configparser/blob/main/CHANGES.rst) - [Commits](https://github.com/jaraco/configparser/compare/v5.1.0...v5.2.0) --- updated-dependencies: - dependency-name: configparser dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements.txt b/requirements.txt index 990e0fa84b..68ef7ad954 100644 --- a/requirements.txt +++ b/requirements.txt @@ -11,16 +11,16 @@ chardet==4.0.0 charset-normalizer==2.0.7 colorama==0.4.4 coloredlogs==15.0.1 -configparser==5.1.0 +configparser==5.2.0 contextlib2==21.6.0 distlib==0.3.3 distro==1.6.0 -filelock==3.3.2 +filelock==3.4.0 fire==0.4.0 gitdb==4.0.9 html5lib==1.1 humanfriendly==10.0 -identify==2.3.5 +identify==2.4.0 idna==3.3 importlib-metadata==4.8.2 importlib-resources==5.4.0 @@ -30,7 +30,7 @@ jsonschema==4.2.1 lockfile==0.12.2 MarkupSafe==2.0.1 more-itertools==8.11.0 -msgpack==1.0.2 +msgpack==1.0.3 nodeenv==1.6.0 packaging==21.2 pathlib2==2.3.6 From 11784add74d0688642ffa0c84f5c75e34ac61ad7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Dec 2021 18:18:45 -0700 Subject: [PATCH 16/26] Update ssa___detect_rclone_command_line_usage.yml --- detections/endpoint/ssa___detect_rclone_command_line_usage.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml index b81ccbf90d..4947440542 100644 --- a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -19,13 +19,11 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%") OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, From b51b7dbdf167ef8eb31d20474153f4416e67f423 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 11:40:46 -0700 Subject: [PATCH 17/26] Update ssa___detect_rclone_command_line_usage.yml --- .../endpoint/ssa___detect_rclone_command_line_usage.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml index 4947440542..f88b4a2fb7 100644 --- a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -76,9 +76,7 @@ tags: role: - Child Process product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Behavioral Analytics required_fields: - _time - dest_device_id From 6b36d8c6ec42ff140e3cb9320fd15501587e4a7f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 11:43:34 -0700 Subject: [PATCH 18/26] DNS Exfil --- ...___dns_exfiltration_using_nslookup_app.yml | 87 +++++++++++++++++++ ...s_exfiltration_using_nslookup_app.test.yml | 9 ++ 2 files changed, 96 insertions(+) create mode 100644 detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml create mode 100644 tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml new file mode 100644 index 0000000000..12ff13a018 --- /dev/null +++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -0,0 +1,87 @@ +name: DNS Exfiltration Using Nslookup App +id: 07f490c4-5782-11ec-9ac4-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: + - Endpoint_Processes +description: This search is to detect potential DNS exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are + commonly used by attacker and also the retry parameter which is designed to query + C2 DNS multiple tries. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" AND + (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, "%-q=%") + OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed. +references: + - https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html + - https://www.varonis.com/blog/dns-tunneling/ + - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + analytic_story: + - Suspicious DNS Traffic + - Dynamic DNS + - Command and Control + - Data Exfiltration + dataset: [] + kill_chain_phases: + - Exploitation + - Exfiltration + mitre_attack_id: + - T1048 + security_domain: endpoint + confidence: 80 + context: + - Source:Endpoint + - Stage:Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration. + mitre_attack_id: + - T1048 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + impact: 90 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 72 \ No newline at end of file diff --git a/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml new file mode 100644 index 0000000000..cb4664986f --- /dev/null +++ b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml @@ -0,0 +1,9 @@ +name: DNS Exfiltration Using Nslookup App Unit Test +tests: +- name: DNS Exfiltration Using Nslookup App + file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 77d186e94659f70805731cbb2af8ea20a00e4dc9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 11:51:15 -0700 Subject: [PATCH 19/26] Update ssa___dns_exfiltration_using_nslookup_app.yml --- ...___dns_exfiltration_using_nslookup_app.yml | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 12ff13a018..d5c4195e31 100644 --- a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -1,11 +1,11 @@ name: DNS Exfiltration Using Nslookup App -id: 07f490c4-5782-11ec-9ac4-acde48001122 +id: 2452e632-9e0d-11eb-34ba-acde48001122 version: 1 date: '2021-12-07' author: Michael Haag, Splunk type: TTP datamodel: - - Endpoint_Processes +- Endpoint_Processes description: This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique @@ -31,36 +31,35 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint_Processess` datamodel. known_false_positives: It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed. references: - - https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html - - https://www.varonis.com/blog/dns-tunneling/ - - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ tags: analytic_story: - Suspicious DNS Traffic - Dynamic DNS - Command and Control - Data Exfiltration - dataset: [] - kill_chain_phases: - - Exploitation - - Exfiltration - mitre_attack_id: - - T1048 - security_domain: endpoint + automated_detection_testing: passed confidence: 80 context: - Source:Endpoint - Stage:Exfiltration - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. mitre_attack_id: - T1048 observable: - - name: dest_user_id + - name: user type: User role: - Victim - - name: dest_device_id + - name: dest type: Hostname role: - Victim @@ -72,7 +71,6 @@ tags: type: Process role: - Child Process - impact: 90 product: - Splunk Behavioral Analytics required_fields: @@ -84,4 +82,5 @@ tags: - dest_user_id - process - cmd_line - risk_score: 72 \ No newline at end of file + risk_score: 72 + security_domain: endpoint \ No newline at end of file From 16849ba96e9e9f19568c145603275eda4364ac03 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 11:58:44 -0700 Subject: [PATCH 20/26] Update ssa___dns_exfiltration_using_nslookup_app.yml --- .../endpoint/ssa___dns_exfiltration_using_nslookup_app.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index d5c4195e31..95d44c07d3 100644 --- a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -51,15 +51,15 @@ tags: kill_chain_phases: - Exploitation message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. + on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration. mitre_attack_id: - T1048 observable: - - name: user + - name: dest_user_id type: User role: - Victim - - name: dest + - name: dest_device_id type: Hostname role: - Victim From e2abbaffe14155f906d0062913b5f5463f1c89ef Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 12:19:41 -0700 Subject: [PATCH 21/26] fsutil and bcdedit --- ..._bcdedit_failure_recovery_modification.yml | 84 +++++++++++++++++++ .../endpoint/ssa___fsutil_zeroing_file.yml | 83 ++++++++++++++++++ ...dit_failure_recovery_modification.test.yml | 10 +++ .../ssa___fsutil_zeroing_file.test.yml | 10 +++ 4 files changed, 187 insertions(+) create mode 100644 detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml create mode 100644 detections/endpoint/ssa___fsutil_zeroing_file.yml create mode 100644 tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml create mode 100644 tests/endpoint/ssa___fsutil_zeroing_file.test.yml diff --git a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml new file mode 100644 index 0000000000..63c0ad8acd --- /dev/null +++ b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -0,0 +1,84 @@ +name: BCDEdit Failure Recovery Modification +id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search looks for flags passed to bcdedit.exe modifications to the + built-in Windows error recovery boot configurations. This is typically used by ransomware + to prevent recovery. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" AND + (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%")) + | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Administrators may modify the boot configuration. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair +tags: + analytic_story: + - Ryuk Ransomware + - Ransomware + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Impact + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the + endpoint. + mitre_attack_id: + - T1490 + nist: + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___fsutil_zeroing_file.yml b/detections/endpoint/ssa___fsutil_zeroing_file.yml new file mode 100644 index 0000000000..4d2c223974 --- /dev/null +++ b/detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -0,0 +1,83 @@ +name: Fsutil Zeroing File +id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search is to detect a suspicious fsutil process to zeroing a target + file. This technique was seen in lockbit ransomware where it tries to zero out its + malware path as part of its defense evasion after encrypting the compromised host. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" AND + (like (cmd_line, "%setzerodata%")) + | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting logs + with the process name, parent process, and command-line executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Tune and filter known instances where renamed net.exe may be used. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +references: + - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file +tags: + analytic_story: + - Ransomware + confidence: 90 + context: + - Source:Endpoint + - stage:Defense Evasion + dataset: [] + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion. + mitre_attack_id: + - T1070 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 54 + risk_severity: high + security_domain: endpoint diff --git a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml new file mode 100644 index 0000000000..188d91c8e5 --- /dev/null +++ b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml @@ -0,0 +1,10 @@ +name: BCDEdit Failure Recovery Modification - SSA Unit Test +tests: + - name: BCDEdit Failure Recovery Modification + file: endpoint/ssa___bcdedit_failure_recovery_modification.yml + pass_condition: '@count_gt(0)' + description: Test detection of BCDEdit Failure Recovery Modification + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml new file mode 100644 index 0000000000..11edb21baf --- /dev/null +++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml @@ -0,0 +1,10 @@ +name: FSUtil Zeroing File - SSA Unit Test +tests: + - name: FSUtil Zeroing File + file: endpoint/ssa___fsutil_zeroing_file.yml + pass_condition: '@count_gt(0)' + description: Test detection of FSUtil Zeroing File + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 51a47f76dfb9e5a09f0a9dcd6067f3612c304b73 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 12:30:48 -0700 Subject: [PATCH 22/26] Update ssa___bcdedit_failure_recovery_modification.yml --- .../endpoint/ssa___bcdedit_failure_recovery_modification.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml index 63c0ad8acd..7b19775d61 100644 --- a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -28,7 +28,7 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint_Processess` datamodel. known_false_positives: Administrators may modify the boot configuration. references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair tags: analytic_story: - Ryuk Ransomware @@ -40,7 +40,7 @@ tags: - Source:Endpoint - Stage:Impact dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log impact: 100 kill_chain_phases: - Actions on Objectives From 890e31a9c105389bbd214c7a83a0936cdf58cd99 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 12:38:37 -0700 Subject: [PATCH 23/26] Update ssa___bcdedit_failure_recovery_modification.test.yml --- .../ssa___bcdedit_failure_recovery_modification.test.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml index 188d91c8e5..0127db21ec 100644 --- a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml +++ b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml @@ -4,7 +4,7 @@ tests: file: endpoint/ssa___bcdedit_failure_recovery_modification.yml pass_condition: '@count_gt(0)' description: Test detection of BCDEdit Failure Recovery Modification - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 44bf73018a9fcf5d2cb8aa214f5d4f96bf1b092b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 13:31:19 -0700 Subject: [PATCH 24/26] wbadmin --- .../ssa___wbadmin_delete_system_backups.yml | 86 +++++++++++++++++++ ...a___wbadmin_delete_system_backups.test.yml | 10 +++ 2 files changed, 96 insertions(+) create mode 100644 detections/endpoint/ssa___wbadmin_delete_system_backups.yml create mode 100644 tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml new file mode 100644 index 0000000000..7c18a2e2ca --- /dev/null +++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -0,0 +1,86 @@ +name: WBAdmin Delete System Backups +id: 71efbf52-4dbb-4c00-a520-306aa546cbb7 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator + Tool) that delete backup files. This is typically used by ransomware to prevent + recovery. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" AND + like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%") + | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Administrators may modify the boot configuration. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md + - https://thedfirreport.com/2020/10/08/ryuks-return/ + - https://attack.mitre.org/techniques/T1490/ + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin +tags: + analytic_story: + - Ryuk Ransomware + - Ransomware + cis20: + - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - stage:Defense Evasion + dataset: [] + impact: 30 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups. + mitre_attack_id: + - T1490 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 15 + risk_severity: high + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml new file mode 100644 index 0000000000..d07f9c333a --- /dev/null +++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml @@ -0,0 +1,10 @@ +name: WBAdmin Delete System Backups - SSA Unit Test +tests: + - name: WBAdmin Delete System Backups + file: endpoint/ssa___wbadmin_delete_system_backups.yml + pass_condition: '@count_gt(0)' + description: Test detection of WBAdmin Delete System Backups + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 3c2c99fb9c6b5be1bb35271b486da4aec060a343 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 13:55:05 -0700 Subject: [PATCH 25/26] Update ssa___wbadmin_delete_system_backups.test.yml --- tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml index d07f9c333a..4b77e71e50 100644 --- a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml +++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml @@ -5,6 +5,6 @@ tests: pass_condition: '@count_gt(0)' description: Test detection of WBAdmin Delete System Backups attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 692a565befdaa51595ed29fd002897acdbb7ce63 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 7 Dec 2021 14:01:52 -0700 Subject: [PATCH 26/26] Update ssa___wbadmin_delete_system_backups.test.yml --- tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml index 4b77e71e50..84a6b071df 100644 --- a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml +++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml @@ -5,6 +5,6 @@ tests: pass_condition: '@count_gt(0)' description: Test detection of WBAdmin Delete System Backups attack_data: - - file_name: windows-sysmon.log + - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file