From d4b1b48d5d5d3f61e661b89c16bb9378d4528bb3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Jan 2022 13:14:35 -0700 Subject: [PATCH 1/5] Cred Dump Resolving #1744 . --- .../windows_possible_credential_dumping.yml | 89 +++++++++++++++++++ ...ndows_possible_credential_dumping.test.yml | 12 +++ 2 files changed, 101 insertions(+) create mode 100644 detections/endpoint/windows_possible_credential_dumping.yml create mode 100644 tests/endpoint/windows_possible_credential_dumping.test.yml diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml new file mode 100644 index 0000000000..14d66f23e0 --- /dev/null +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -0,0 +1,89 @@ +name: Windows Possible Credential Dumping +id: e4723b92-7266-11ec-af45-acde48001122 +version: 1 +date: '2022-01-10' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic is an enhanced version of two previous analytics that identifies common GrantedAccess permission requests and CallTrace DLLs in order to detect credential dumping. \ + + GrantedAccess is the requested permissions by the SourceImage into the TargetImage. \ + + CallTrace Stack trace of where open process is called. Included is the DLL and the relative virtual address of the functions in the call stack right before the open process call. \ + + dbgcore.dll or dbghelp.dll are two core Windows debug DLLs that have minidump functions which provide a way for applications to produce crashdump files that contain a useful subset of the entire process context. \ + + The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory, used to execute this module which is related to lsass dumping.' +search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` + | `windows_possible_credential_dumping_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. +known_false_positives: False positives will occur based on GrantedAccess, filter based on source image as needed. +references: + - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service + - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump + - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html + - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 + - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN +tags: + analytic_story: + - Credential Dumping + - Detect Zerologon Attack + - DarkSide Ransomware + dataset: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + confidence: 80 + context: + - Source:Endpoint + - Stage:Credential Access + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: A process, $Image$, has loaded $ImageLoaded$ that are typically related + to credential dumping on $dest$. Review for further details. + mitre_attack_id: + - T1003.001 + - T1003 + nist: + - DE.AE + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Parent Process + role: + - Other + - name: Image + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - TargetImage + - GrantedAccess + - SourceImage + - SourceProcessId + - SourceUser + - TargetUser + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/windows_possible_credential_dumping.test.yml b/tests/endpoint/windows_possible_credential_dumping.test.yml new file mode 100644 index 0000000000..7776a045fe --- /dev/null +++ b/tests/endpoint/windows_possible_credential_dumping.test.yml @@ -0,0 +1,12 @@ +name: Windows Possible Credential Dumping Unit Test +tests: +- name: Windows Possible Credential Dumping + file: endpoint/windows_possible_credential_dumping.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 29cb276dec419eeca8dc4d37d9ced45014bf3847 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Jan 2022 13:16:22 -0700 Subject: [PATCH 2/5] control_rundll32 update --- .../endpoint/rundll32_control_rundll_hunt.yml | 14 +++++++------- ...l32_control_rundll_world_writable_directory.yml | 14 +++++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 0c97df842c..d4d2c5b084 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -14,8 +14,7 @@ description: The following hunting detection identifies rundll32.exe with `contr to be a bit more broad by not including .cpl. \ During triage, review parallel processes to identify any further suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe - OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL* by + as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -28,11 +27,12 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment. references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html + - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ + - https://attack.mitre.org/techniques/T1218/011/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://redcanary.com/blog/intelligence-insights-december-2021/ tags: analytic_story: - Suspicious Rundll32 Activity diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 1ae968e3cc..d7fbb56b40 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -15,8 +15,7 @@ description: The following detection identifies rundll32.exe with `control_rundl broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe - OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL* + as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name @@ -30,11 +29,12 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed. references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html + - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ + - https://attack.mitre.org/techniques/T1218/011/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://redcanary.com/blog/intelligence-insights-december-2021/ tags: analytic_story: - Suspicious Rundll32 Activity From 56b5159b5d52a8a9ccf5f7d39efe463279fdfc67 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 12 Jan 2022 09:39:14 -0700 Subject: [PATCH 3/5] Update windows_possible_credential_dumping.test.yml --- tests/endpoint/windows_possible_credential_dumping.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_possible_credential_dumping.test.yml b/tests/endpoint/windows_possible_credential_dumping.test.yml index 7776a045fe..f2979d3803 100644 --- a/tests/endpoint/windows_possible_credential_dumping.test.yml +++ b/tests/endpoint/windows_possible_credential_dumping.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 815fa610e9b66deea5ea8c2717788f1c0de492a1 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 12 Jan 2022 09:45:32 -0700 Subject: [PATCH 4/5] Updated PowerShell - Connect To Internet With Hidden Window --- ...wershell___connect_to_internet_with_hidden_window.yml} | 8 ++++---- ...ell___connect_to_internet_with_hidden_window.test.yml} | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) rename detections/endpoint/{malicious_powershell_process___connect_to_internet_with_hidden_window.yml => powershell___connect_to_internet_with_hidden_window.yml} (93%) rename tests/endpoint/{malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml => powershell___connect_to_internet_with_hidden_window.test.yml} (61%) diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml similarity index 93% rename from detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml rename to detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index a820995c29..c6cf21808e 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -1,7 +1,7 @@ -name: Malicious PowerShell Process - Connect To Internet With Hidden Window +name: PowerShell - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 7 -date: '2021-10-05' +version: 8 +date: '2022-01-12' author: David Dorsey, Michael Haag Splunk type: Hunting datamodel: @@ -20,7 +20,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\ \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ - |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`" + |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`" how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/tests/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml b/tests/endpoint/powershell___connect_to_internet_with_hidden_window.test.yml similarity index 61% rename from tests/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml rename to tests/endpoint/powershell___connect_to_internet_with_hidden_window.test.yml index 98b7dc80c1..c9f8db2233 100644 --- a/tests/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml +++ b/tests/endpoint/powershell___connect_to_internet_with_hidden_window.test.yml @@ -1,7 +1,7 @@ -name: Malicious PowerShell Process - Connect To Internet With Hidden Window Unit Test +name: PowerShell - Connect To Internet With Hidden Window Unit Test tests: -- name: Malicious PowerShell Process - Connect To Internet With Hidden Window - file: endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +- name: PowerShell - Connect To Internet With Hidden Window + file: endpoint/powershell___connect_to_internet_with_hidden_window.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 649c43f237872fb7face1a2188dd268ee2101ae5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 12 Jan 2022 14:39:35 -0800 Subject: [PATCH 5/5] Update windows_possible_credential_dumping.yml --- detections/endpoint/windows_possible_credential_dumping.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 14d66f23e0..788e304c0e 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -17,8 +17,7 @@ description: 'The following analytic is an enhanced version of two previous anal The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory, used to execute this module which is related to lsass dumping.' search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` - | `windows_possible_credential_dumping_filter`' + `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the