From 9c08c1f2f42878fc87574bba30e86d2774a8fbd9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 12:14:26 -0600 Subject: [PATCH 1/5] fixes --- .../dump_lsass_via_procdump_rename.yml | 81 +++++++++++++++++++ .../local_account_discovery_with_net.yml | 6 +- .../local_account_discovery_with_wmic.yml | 6 +- 3 files changed, 87 insertions(+), 6 deletions(-) create mode 100644 detections/deprecated/dump_lsass_via_procdump_rename.yml diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml new file mode 100644 index 0000000000..2b1e26203e --- /dev/null +++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml @@ -0,0 +1,81 @@ +name: Dump LSASS via procdump Rename +id: 21276daa-663d-11eb-ae93-0242ac130002 +version: 1 +date: '2021-02-01' +author: Michael Haag, Splunk +type: Hunting +datamodel: [] +description: 'Detect a renamed instance of procdump.exe dumping the lsass process. + This query looks for both -mm and -ma usage. -mm will produce a mini dump file and + -ma will write a dump file with all process memory. Both are highly suspect and + should be reviewed. Modify the query as needed.\ + + During triage, confirm this is procdump.exe executing. If it is the first time a + Sysinternals utility has been ran, it is possible there will be a -accepteula on + the command line. Review other endpoint data sources for cross process (injection) + into lsass.exe.' +search: '`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 + (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as + dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, + process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: None identified. +references: +- https://attack.mitre.org/techniques/T1003/001/ +- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump +tags: + analytic_story: + - Credential Dumping + - HAFNIUM Group + asset_type: Endpoint + automated_detection_testing: passed + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$ on $dest$, attempting to dump lsass.exe. + mitre_attack_id: + - T1003.001 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - OriginalFileName + - process_name + - EventID + - CommandLine + - Computer + - parent_process_name + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index 505ad8b723..f1723a4acf 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -1,7 +1,7 @@ name: Local Account Discovery with Net id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 1 -date: '2021-08-19' +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -10,7 +10,7 @@ description: This analytic looks for the execution of `net.exe` or `net1.exe` wi arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") + as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`' diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index 58ad212ff3..9f8983958d 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -1,7 +1,7 @@ name: Local Account Discovery With Wmic id: 4902d7aa-0134-11ec-9d65-acde48001122 -version: 1 -date: '2021-08-19' +version: 2 +date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: @@ -10,7 +10,7 @@ description: This analytic looks for the execution of `wmic.exe` with command-li arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) + as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`' From 6f9c536f8e870db76793fbe836043fe480423771 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 12:15:53 -0600 Subject: [PATCH 2/5] error --- tests/endpoint/dump_lsass_via_procdump_rename.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml index fd04f46735..b1225d12fd 100644 --- a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml +++ b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml @@ -1,7 +1,7 @@ name: Dump lsass via procdump rename Unit Test tests: - name: Dump lsass via procdump rename - file: endpoint/dump_lsass_via_procdump_rename.yml + file: deprecated/dump_lsass_via_procdump_rename.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 4178c03b52d358465588696ba3c02f224ee6c603 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 18:19:16 +0000 Subject: [PATCH 3/5] Added detection testing service results inDetect PsExec With accepteula Flag --- .../detect_psexec_with_accepteula_flag.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 0c4142bc28..690fa3d715 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -16,11 +16,15 @@ description: This search looks for events where `PsExec.exe` is run with the `ac within the command line. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_psexec` Processes.process=*accepteula* by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| - `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + where `process_psexec` Processes.process=*accepteula* by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this From fbc3185dbc2ba97c48cba95a4e629d58d74a049a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 12:24:53 -0600 Subject: [PATCH 4/5] Update processes_launching_netsh.yml --- detections/endpoint/processes_launching_netsh.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 7252e476ad..6cd75754bf 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -1,8 +1,8 @@ name: Processes launching netsh id: b89919ed-fe5f-492c-b139-95dbb162040e -version: 3 -date: '2020-07-10' -author: Josef Kuepker, Splunk +version: 4 +date: '2021-09-16' +author: Michael Haag, Josef Kuepker, Splunk type: TTP datamodel: - Endpoint @@ -14,11 +14,10 @@ description: This search looks for processes launching netsh.exe. Netsh is a com executing commands via the command line. search: '| tstats `security_content_summariesonly` count values(Processes.process) AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process=*netsh* by Processes.parent_process_name Processes.parent_process + where `process_netsh` by Processes.parent_process_name Processes.parent_process Processes.original_file_name Processes.process_name Processes.user Processes.dest |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands. From 20565487024acc78a91b4655b482b7d89a1abafd Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 18:25:52 +0000 Subject: [PATCH 5/5] Added detection testing service results inDump LSASS via procdump --- detections/endpoint/dump_lsass_via_procdump.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index ba27a7007d..4c97cba1aa 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -17,11 +17,15 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*) - Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* + OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name + Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: None identified. references: - https://attack.mitre.org/techniques/T1003/001/