From ce6318c87b9de1757b7f0119fcd705417518a709 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 19 Nov 2021 12:01:45 +0100 Subject: [PATCH 1/6] more_ioc_detections --- ...nfo_gathering_using_dxdiag_application.yml | 72 +++++++++++++++++++ macros/process_dxdiag.yml | 3 + ...athering_using_dxdiag_application.test.yml | 12 ++++ 3 files changed, 87 insertions(+) create mode 100644 detections/endpoint/system_info_gathering_using_dxdiag_application.yml create mode 100644 macros/process_dxdiag.yml create mode 100644 tests/endpoint/system_info_gathering_using_dxdiag_application.test.yml diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml new file mode 100644 index 0000000000..b20f2d6f74 --- /dev/null +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -0,0 +1,72 @@ +name: System Info Gathering Using Dxdiag Application +id: f92d74f2-4921-11ec-b685-acde48001122 +version: 1 +date: '2021-11-19' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to detect a suspicious dxdiag.exe process commandline can collect system info of the target host. + This technique was seen in remcos, adversaries and other malware to collect information as part of recon or collection phase of attack. + Even this behavior is rarely seen in a corporate network this commandline can be used by network administrator to audit host machine specification. + Better to check what it did after it pipes out the result to a file for further processing. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process = "* /t *" + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `system_info_gathering_using_dxdiag_application_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` + node. In addition, confirm the latest CIM App 4.20 or higher is installed and the + latest TA for the endpoint product. +known_false_positives: this commandline can be used by network administrator to audit host machine specification.filter is needed. +references: +- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1592 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Reconnaissance + message: dxdiag.exe process with commandline $process$ on $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/macros/process_dxdiag.yml b/macros/process_dxdiag.yml new file mode 100644 index 0000000000..6e41440993 --- /dev/null +++ b/macros/process_dxdiag.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_dxdiag \ No newline at end of file diff --git a/tests/endpoint/system_info_gathering_using_dxdiag_application.test.yml b/tests/endpoint/system_info_gathering_using_dxdiag_application.test.yml new file mode 100644 index 0000000000..bf5d6247a5 --- /dev/null +++ b/tests/endpoint/system_info_gathering_using_dxdiag_application.test.yml @@ -0,0 +1,12 @@ +name: System Info Gathering Using Dxdiag Application Unit Test +tests: +- name: System Info Gathering Using Dxdiag Application + file: endpoint/system_info_gathering_using_dxdiag_application.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 126a514ab33d7a03979551f2e73b47b947d53c96 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 19 Nov 2021 11:24:14 +0000 Subject: [PATCH 2/6] Added detection testing service results inSystem Info Gathering Using Dxdiag Application --- ...nfo_gathering_using_dxdiag_application.yml | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index b20f2d6f74..ecdc0021db 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -6,26 +6,27 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to detect a suspicious dxdiag.exe process commandline can collect system info of the target host. - This technique was seen in remcos, adversaries and other malware to collect information as part of recon or collection phase of attack. - Even this behavior is rarely seen in a corporate network this commandline can be used by network administrator to audit host machine specification. - Better to check what it did after it pipes out the result to a file for further processing. +description: This analytic is to detect a suspicious dxdiag.exe process commandline + can collect system info of the target host. This technique was seen in remcos, adversaries + and other malware to collect information as part of recon or collection phase of + attack. Even this behavior is rarely seen in a corporate network this commandline + can be used by network administrator to audit host machine specification. Better + to check what it did after it pipes out the result to a file for further processing. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process = "* /t *" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process + = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_info_gathering_using_dxdiag_application_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: this commandline can be used by network administrator to audit host machine specification.filter is needed. +known_false_positives: this commandline can be used by network administrator to audit + host machine specification.filter is needed. references: -- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ +- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ tags: analytic_story: - Remcos @@ -55,7 +56,6 @@ tags: security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint @@ -69,4 +69,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 3b2bb44e915898bd86bfe99318e09b2dcf6328a9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 22 Nov 2021 12:39:31 +0100 Subject: [PATCH 3/6] more_ioc_detections --- detections/endpoint/jscript_execution_using_cscript_app.yml | 1 + .../endpoint/regsvr32_silent_and_install_param_dll_loading.yml | 1 + .../endpoint/regsvr32_with_known_silent_switch_cmdline.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index af8f30ae12..6f7e6da5d8 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - FIN7 + - Remcos automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index ed4ad3ca11..deda9cfcc4 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Suspicious Regsvr32 Activity + - Remcos automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 0c1cf5bcca..af0150c14f 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -33,6 +33,7 @@ tags: analytic_story: - IcedID - Suspicious Regsvr32 Activity + - Remcos automated_detection_testing: passed confidence: 80 context: From 04c433eedf505faf6a50ad5e4736486cb3dfa155 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 22 Nov 2021 15:09:53 +0100 Subject: [PATCH 4/6] more_ioc_detections --- .../possible_browser_pass_view_parameter.yml | 77 +++++++++++++++++++ ...sible_browser_pass_view_parameter.test.yml | 12 +++ 2 files changed, 89 insertions(+) create mode 100644 detections/endpoint/possible_browser_pass_view_parameter.yml create mode 100644 tests/endpoint/possible_browser_pass_view_parameter.test.yml diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml new file mode 100644 index 0000000000..c7d0919c69 --- /dev/null +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -0,0 +1,77 @@ +name: Possible Browser Pass View Parameter +id: 8ba484e8-4b97-11ec-b19a-acde48001122 +version: 1 +date: '2021-11-22' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic will detect a suspicious process contains a commandline parameter related to web browser credential dumper. + This technique was used by Remcos RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application to dump web browser credentials. + Remcos use the "/stext" commandline to dump the credential in text format. This Hunting query is good indicator to look further for possible remcos infection within the network or possible + compromised host. Since the detections is only base on the parameter command and the possible path where it will drop the text credential information, It may catch normal tools that having same + command and behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes + where Processes.process IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" + , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" ) + AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `possible_browser_pass_view_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positive is quite limited. Filter is needed +references: +- https://www.nirsoft.net/utils/web_browser_password.html +- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1555.003 + - T1555 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 40 + confidence: 40 + # (impact * confidence)/100 + risk_score: 16 + context: + - Source:Endpoint + - Stage:Credential Access + message: suspicious process $process_name$ contains commandline $process$ on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/possible_browser_pass_view_parameter.test.yml b/tests/endpoint/possible_browser_pass_view_parameter.test.yml new file mode 100644 index 0000000000..462d4d5f3d --- /dev/null +++ b/tests/endpoint/possible_browser_pass_view_parameter.test.yml @@ -0,0 +1,12 @@ +name: Possible Browser Pass View Parameter Unit Test +tests: +- name: Possible Browser Pass View Parameter + file: endpoint/possible_browser_pass_view_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 8482d3065673a72ffaed4d155a886bdc6dbb47b5 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 22 Nov 2021 14:44:57 +0000 Subject: [PATCH 5/6] Added detection testing service results inPossible Browser Pass View Parameter --- .../possible_browser_pass_view_parameter.yml | 41 ++++++++++--------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index c7d0919c69..bfd8a8e4c0 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -6,30 +6,33 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic will detect a suspicious process contains a commandline parameter related to web browser credential dumper. - This technique was used by Remcos RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application to dump web browser credentials. - Remcos use the "/stext" commandline to dump the credential in text format. This Hunting query is good indicator to look further for possible remcos infection within the network or possible - compromised host. Since the detections is only base on the parameter command and the possible path where it will drop the text credential information, It may catch normal tools that having same - command and behavior. +description: This analytic will detect a suspicious process contains a commandline + parameter related to web browser credential dumper. This technique was used by Remcos + RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application + to dump web browser credentials. Remcos use the "/stext" commandline to dump the + credential in text format. This Hunting query is good indicator to look further + for possible remcos infection within the network or possible compromised host. Since + the detections is only base on the parameter command and the possible path where + it will drop the text credential information, It may catch normal tools that having + same command and behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes - where Processes.process IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" - , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" ) - AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") + as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/stext + *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", + "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", + "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" + ) AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `possible_browser_pass_view_parameter_filter`' + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: False positive is quite limited. Filter is needed references: -- https://www.nirsoft.net/utils/web_browser_password.html -- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ +- https://www.nirsoft.net/utils/web_browser_password.html +- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ tags: analytic_story: - Remcos @@ -60,9 +63,8 @@ tags: security_domain: endpoint impact: 40 confidence: 40 - # (impact * confidence)/100 risk_score: 16 - context: + context: - Source:Endpoint - Stage:Credential Access message: suspicious process $process_name$ contains commandline $process$ on $dest$ @@ -74,4 +76,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 83576ecb743a5426d7c4d43f9fdafd45b75a78cc Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 23 Nov 2021 11:56:00 +0100 Subject: [PATCH 6/6] more_ioc_detections --- .../endpoint/non_chrome_process_accessing_chrome_default_dir.yml | 1 + .../endpoint/non_firefox_process_access_firefox_profile_dir.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index a6855f1329..3306d0a93d 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - FIN7 + - Remcos automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 2b169b61ad..a0ab4f8f17 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - FIN7 + - Remcos automated_detection_testing: passed confidence: 70 context: