Merge pull request #1927 from splunk/haagin

All Your Haags Belong to Us

detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml

@@ -1,7 +1,7 @@
-name: Malicious PowerShell Process - Connect To Internet With Hidden Window
+name: PowerShell - Connect To Internet With Hidden Window
 id: ee18ed37-0802-4268-9435-b3b91aaa18db
-version: 7
-date: '2021-10-05'
+version: 8
+date: '2022-01-12'
 author: David Dorsey, Michael Haag Splunk
 type: Hunting
 datamodel:
@@ -20,7 +20,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime
   \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
   \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
   \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
-  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`"
+  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.

detections/endpoint/rundll32_control_rundll_hunt.yml

@@ -14,8 +14,7 @@ description: The following hunting detection identifies rundll32.exe with `contr
   to be a bit more broad by not including .cpl. \ During triage, review parallel processes
   to identify any further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
-  OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL*  by
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL*  by
   Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -28,11 +27,12 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: This is a hunting detection, meant to provide a understanding
   of how voluminous control_rundll is within the environment.
 references:
-- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
-- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-- https://attack.mitre.org/techniques/T1218/011/
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+  - https://attack.mitre.org/techniques/T1218/011/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+  - https://redcanary.com/blog/intelligence-insights-december-2021/
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity

detections/endpoint/rundll32_control_rundll_world_writable_directory.yml

@@ -15,8 +15,7 @@ description: The following detection identifies rundll32.exe with `control_rundl
   broad by not including .cpl. The paths are specified, add more as needed. During
   triage, review parallel processes to identify any further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
-  OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL*
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL*
   AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*")  by
   Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
@@ -30,11 +29,12 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: This may be tuned, or a new one related, by adding .cpl to
   command-line. However, it's important to look for both. Tune/filter as needed.
 references:
-- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
-- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-- https://attack.mitre.org/techniques/T1218/011/
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+  - https://attack.mitre.org/techniques/T1218/011/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+  - https://redcanary.com/blog/intelligence-insights-december-2021/
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity

detections/endpoint/windows_possible_credential_dumping.yml

@@ -0,0 +1,88 @@
+name: Windows Possible Credential Dumping
+id: e4723b92-7266-11ec-af45-acde48001122
+version: 1
+date: '2022-01-10'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic is an enhanced version of two previous analytics that identifies common GrantedAccess permission requests and CallTrace DLLs in order to detect credential dumping. \
+
+  GrantedAccess is the requested permissions by the SourceImage into the TargetImage. \
+
+  CallTrace Stack trace of where open process is called. Included is the DLL and the relative virtual address of the functions in the call stack right before the open process call. \
+  
+  dbgcore.dll or dbghelp.dll  are two core Windows debug DLLs that have minidump functions which provide a way for applications to produce crashdump files that contain a useful subset of the entire process context. \
+  
+  The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory, used to execute this module which is related to lsass dumping.'
+search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
+known_false_positives: False positives will occur based on GrantedAccess, filter based on source image as needed.
+references:
+  - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
+  - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
+  - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
+  - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
+  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Detect Zerologon Attack
+  - DarkSide Ransomware
+  dataset: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A process, $Image$, has loaded $ImageLoaded$ that are typically related
+    to credential dumping on $dest$. Review for further details.
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist:
+  - DE.AE
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Parent Process
+    role:
+    - Other
+  - name: Image
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - TargetImage
+  - GrantedAccess
+  - SourceImage
+  - SourceProcessId
+  - SourceUser
+  - TargetUser
+  risk_score: 64
+  security_domain: endpoint

tests/endpoint/powershell___connect_to_internet_with_hidden_window.test.yml

@@ -1,7 +1,7 @@
-name: Malicious PowerShell Process - Connect To Internet With Hidden Window Unit Test
+name: PowerShell - Connect To Internet With Hidden Window Unit Test
 tests:
-- name: Malicious PowerShell Process - Connect To Internet With Hidden Window
-  file: endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+- name: PowerShell - Connect To Internet With Hidden Window
+  file: endpoint/powershell___connect_to_internet_with_hidden_window.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/endpoint/windows_possible_credential_dumping.test.yml

@@ -0,0 +1,12 @@
+name: Windows Possible Credential Dumping Unit Test
+tests:
+- name: Windows Possible Credential Dumping
+  file: endpoint/windows_possible_credential_dumping.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog