diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index af8f30ae12..6f7e6da5d8 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - FIN7 + - Remcos automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index a6855f1329..3306d0a93d 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - FIN7 + - Remcos automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 2b169b61ad..a0ab4f8f17 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - FIN7 + - Remcos automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml new file mode 100644 index 0000000000..bfd8a8e4c0 --- /dev/null +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -0,0 +1,80 @@ +name: Possible Browser Pass View Parameter +id: 8ba484e8-4b97-11ec-b19a-acde48001122 +version: 1 +date: '2021-11-22' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic will detect a suspicious process contains a commandline + parameter related to web browser credential dumper. This technique was used by Remcos + RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application + to dump web browser credentials. Remcos use the "/stext" commandline to dump the + credential in text format. This Hunting query is good indicator to look further + for possible remcos infection within the network or possible compromised host. Since + the detections is only base on the parameter command and the possible path where + it will drop the text credential information, It may catch normal tools that having + same command and behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/stext + *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", + "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", + "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" + ) AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positive is quite limited. Filter is needed +references: +- https://www.nirsoft.net/utils/web_browser_password.html +- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1555.003 + - T1555 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 40 + confidence: 40 + risk_score: 16 + context: + - Source:Endpoint + - Stage:Credential Access + message: suspicious process $process_name$ contains commandline $process$ on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index ed4ad3ca11..deda9cfcc4 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Suspicious Regsvr32 Activity + - Remcos automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 0c1cf5bcca..af0150c14f 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -33,6 +33,7 @@ tags: analytic_story: - IcedID - Suspicious Regsvr32 Activity + - Remcos automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml new file mode 100644 index 0000000000..ecdc0021db --- /dev/null +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -0,0 +1,73 @@ +name: System Info Gathering Using Dxdiag Application +id: f92d74f2-4921-11ec-b685-acde48001122 +version: 1 +date: '2021-11-19' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to detect a suspicious dxdiag.exe process commandline + can collect system info of the target host. This technique was seen in remcos, adversaries + and other malware to collect information as part of recon or collection phase of + attack. Even this behavior is rarely seen in a corporate network this commandline + can be used by network administrator to audit host machine specification. Better + to check what it did after it pipes out the result to a file for further processing. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process + = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `system_info_gathering_using_dxdiag_application_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` + node. In addition, confirm the latest CIM App 4.20 or higher is installed and the + latest TA for the endpoint product. +known_false_positives: this commandline can be used by network administrator to audit + host machine specification.filter is needed. +references: +- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: dxdiag.exe process with commandline $process$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/macros/process_dxdiag.yml b/macros/process_dxdiag.yml new file mode 100644 index 0000000000..6e41440993 --- /dev/null +++ b/macros/process_dxdiag.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_dxdiag \ No newline at end of file diff --git a/tests/endpoint/possible_browser_pass_view_parameter.test.yml b/tests/endpoint/possible_browser_pass_view_parameter.test.yml new file mode 100644 index 0000000000..462d4d5f3d --- /dev/null +++ b/tests/endpoint/possible_browser_pass_view_parameter.test.yml @@ -0,0 +1,12 @@ +name: Possible Browser Pass View Parameter Unit Test +tests: +- name: Possible Browser Pass View Parameter + file: endpoint/possible_browser_pass_view_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/system_info_gathering_using_dxdiag_application.test.yml b/tests/endpoint/system_info_gathering_using_dxdiag_application.test.yml new file mode 100644 index 0000000000..bf5d6247a5 --- /dev/null +++ b/tests/endpoint/system_info_gathering_using_dxdiag_application.test.yml @@ -0,0 +1,12 @@ +name: System Info Gathering Using Dxdiag Application Unit Test +tests: +- name: System Info Gathering Using Dxdiag Application + file: endpoint/system_info_gathering_using_dxdiag_application.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file