From 58eade42b6c434cfcb985fd96257b70fb5ea451f Mon Sep 17 00:00:00 2001
From: divious1 <josehelps@gmail.com>
Date: Thu, 17 Dec 2020 12:20:26 -0500
Subject: [PATCH] adding new detection and test for sunburst

---
 detections/endpoint/windows_adfind_exe.yml | 45 ++++++++++++++++++++++
 tests/endpoint/windows_adfind_exe.yml      | 12 ++++++
 2 files changed, 57 insertions(+)
 create mode 100644 detections/endpoint/windows_adfind_exe.yml
 create mode 100644 tests/endpoint/windows_adfind_exe.yml

diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
new file mode 100644
index 0000000000..d47a9ce170
--- /dev/null
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -0,0 +1,45 @@
+name: Windows AdFind Exe 
+id: bd3b0187-189b-46c0-be45-f52da2bae67f
+version: 1
+date: '2020-12-16'
+description: This search looks for the execution of "adfind.exe" with command-line
+  arguments that it uses by default. Specifically the filter or search functions. 
+  It also considers the arguments necessary like objectcategory, see readme for more details:
+  https://www.joeware.net/freetools$/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and 
+  actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller.  
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references: 
+  - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ 
+  - https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
+author: Jose Hernandez, Splunk
+search: '
+  | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process=*-f* OR Processes.process=*-b*) AND (Processes.process=*objectcategory* OR Processes.process=*-gcb* OR Processes.process=*-sc*)
+  by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process
+  Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_adfind_exe_filter`
+'
+known_false_positives: administrators rarely use adfind, usually not used for legitimate reasons
+tags:
+  analytics_story:
+    - Sunburst Malware
+  mitre_attack_id:
+    - T1018
+  kill_chain_phases:
+    - Exploitation
+  cis20:
+    - CIS 8
+  nist:
+    - PR.PT
+    - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/windows_adfind_exe.yml b/tests/endpoint/windows_adfind_exe.yml
new file mode 100644
index 0000000000..a5b83bfad8
--- /dev/null
+++ b/tests/endpoint/windows_adfind_exe.yml
@@ -0,0 +1,12 @@
+name: Windows AdFind Exe Unit Test
+tests:
+- name: Windows AdFind Exe
+  file: endpoint/windows_adfind_exe.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog