diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml similarity index 93% rename from detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml rename to detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index a820995c29..c6cf21808e 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -1,7 +1,7 @@ -name: Malicious PowerShell Process - Connect To Internet With Hidden Window +name: PowerShell - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 7 -date: '2021-10-05' +version: 8 +date: '2022-01-12' author: David Dorsey, Michael Haag Splunk type: Hunting datamodel: @@ -20,7 +20,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\ \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ - |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`" + |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`" how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 0c97df842c..d4d2c5b084 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -14,8 +14,7 @@ description: The following hunting detection identifies rundll32.exe with `contr to be a bit more broad by not including .cpl. \ During triage, review parallel processes to identify any further suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe - OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL* by + as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -28,11 +27,12 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment. references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html + - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ + - https://attack.mitre.org/techniques/T1218/011/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://redcanary.com/blog/intelligence-insights-december-2021/ tags: analytic_story: - Suspicious Rundll32 Activity diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 1ae968e3cc..d7fbb56b40 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -15,8 +15,7 @@ description: The following detection identifies rundll32.exe with `control_rundl broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe - OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL* + as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name @@ -30,11 +29,12 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed. references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html + - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ + - https://attack.mitre.org/techniques/T1218/011/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://redcanary.com/blog/intelligence-insights-december-2021/ tags: analytic_story: - Suspicious Rundll32 Activity diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml new file mode 100644 index 0000000000..788e304c0e --- /dev/null +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -0,0 +1,88 @@ +name: Windows Possible Credential Dumping +id: e4723b92-7266-11ec-af45-acde48001122 +version: 1 +date: '2022-01-10' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic is an enhanced version of two previous analytics that identifies common GrantedAccess permission requests and CallTrace DLLs in order to detect credential dumping. \ + + GrantedAccess is the requested permissions by the SourceImage into the TargetImage. \ + + CallTrace Stack trace of where open process is called. Included is the DLL and the relative virtual address of the functions in the call stack right before the open process call. \ + + dbgcore.dll or dbghelp.dll are two core Windows debug DLLs that have minidump functions which provide a way for applications to produce crashdump files that contain a useful subset of the entire process context. \ + + The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory, used to execute this module which is related to lsass dumping.' +search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. +known_false_positives: False positives will occur based on GrantedAccess, filter based on source image as needed. +references: + - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service + - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump + - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html + - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 + - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN +tags: + analytic_story: + - Credential Dumping + - Detect Zerologon Attack + - DarkSide Ransomware + dataset: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + confidence: 80 + context: + - Source:Endpoint + - Stage:Credential Access + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: A process, $Image$, has loaded $ImageLoaded$ that are typically related + to credential dumping on $dest$. Review for further details. + mitre_attack_id: + - T1003.001 + - T1003 + nist: + - DE.AE + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Parent Process + role: + - Other + - name: Image + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - TargetImage + - GrantedAccess + - SourceImage + - SourceProcessId + - SourceUser + - TargetUser + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml b/tests/endpoint/powershell___connect_to_internet_with_hidden_window.test.yml similarity index 61% rename from tests/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml rename to tests/endpoint/powershell___connect_to_internet_with_hidden_window.test.yml index 98b7dc80c1..c9f8db2233 100644 --- a/tests/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml +++ b/tests/endpoint/powershell___connect_to_internet_with_hidden_window.test.yml @@ -1,7 +1,7 @@ -name: Malicious PowerShell Process - Connect To Internet With Hidden Window Unit Test +name: PowerShell - Connect To Internet With Hidden Window Unit Test tests: -- name: Malicious PowerShell Process - Connect To Internet With Hidden Window - file: endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +- name: PowerShell - Connect To Internet With Hidden Window + file: endpoint/powershell___connect_to_internet_with_hidden_window.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/windows_possible_credential_dumping.test.yml b/tests/endpoint/windows_possible_credential_dumping.test.yml new file mode 100644 index 0000000000..f2979d3803 --- /dev/null +++ b/tests/endpoint/windows_possible_credential_dumping.test.yml @@ -0,0 +1,12 @@ +name: Windows Possible Credential Dumping Unit Test +tests: +- name: Windows Possible Credential Dumping + file: endpoint/windows_possible_credential_dumping.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file