Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

detections/deprecated/dump_lsass_via_procdump_rename.yml

@@ -0,0 +1,81 @@
+name: Dump LSASS via procdump Rename
+id: 21276daa-663d-11eb-ae93-0242ac130002
+version: 1
+date: '2021-02-01'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'Detect a renamed instance of procdump.exe dumping the lsass process.
+  This query looks for both -mm and -ma usage. -mm will produce a mini dump file and
+  -ma will write a dump file with all process memory. Both are highly suspect and
+  should be reviewed. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1
+  (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as
+  dest |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
+  process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$ on $dest$, attempting to dump lsass.exe.
+  mitre_attack_id:
+  - T1003.001
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OriginalFileName
+  - process_name
+  - EventID
+  - CommandLine
+  - Computer
+  - parent_process_name
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -16,11 +16,15 @@ description: This search looks for events where `PsExec.exe` is run with the `ac
   within the command line.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_psexec` Processes.process=*accepteula* by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`|
-  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  where `process_psexec` Processes.process=*accepteula* by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Administrators can leverage PsExec for accessing remote systems
   and might pass `accepteula` as an argument if they are running this tool for the
   first time. However, it is not likely that you'd see multiple occurrences of this

detections/endpoint/dump_lsass_via_procdump.yml

@@ -17,11 +17,15 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   the command line. Review other endpoint data sources for cross process (injection)
   into lsass.exe.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*)
-  Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma*
+  OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name
+  Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: None identified.
 references:
 - https://attack.mitre.org/techniques/T1003/001/

detections/endpoint/local_account_discovery_with_net.yml

@@ -1,7 +1,7 @@
 name: Local Account Discovery with Net
 id: 5d0d4830-0133-11ec-bae3-acde48001122
-version: 1
-date: '2021-08-19'
+version: 2
+date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic looks for the execution of `net.exe` or `net1.exe` wi
   arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. 
   Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") 
+  as lastTime from datamodel=Endpoint.Processes where `process_net`
   (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`'

detections/endpoint/local_account_discovery_with_wmic.yml

@@ -1,7 +1,7 @@
 name: Local Account Discovery With Wmic
 id: 4902d7aa-0134-11ec-9d65-acde48001122
-version: 1
-date: '2021-08-19'
+version: 2
+date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic looks for the execution of `wmic.exe` with command-li
   arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. 
   Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) 
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) 
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`'

detections/endpoint/processes_launching_netsh.yml

@@ -1,8 +1,8 @@
 name: Processes launching netsh
 id: b89919ed-fe5f-492c-b139-95dbb162040e
-version: 3
-date: '2020-07-10'
-author: Josef Kuepker, Splunk
+version: 4
+date: '2021-09-16'
+author: Michael Haag, Josef Kuepker, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -14,11 +14,10 @@ description: This search looks for processes launching netsh.exe. Netsh is a com
   executing commands via the command line.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process=*netsh* by Processes.parent_process_name Processes.parent_process
+  where `process_netsh` by Processes.parent_process_name Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.user Processes.dest |`drop_dm_object_name("Processes")`
   |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
   of these instances, it is unusual for an executable to launch netsh.exe and run
   commands.

tests/endpoint/dump_lsass_via_procdump_rename.test.yml

@@ -1,7 +1,7 @@
 name: Dump lsass via procdump rename Unit Test
 tests:
 - name: Dump lsass via procdump rename
-  file: endpoint/dump_lsass_via_procdump_rename.yml
+  file: deprecated/dump_lsass_via_procdump_rename.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'