From c43646a827050fdda73dccda61404f334be31b5a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 31 Jan 2022 11:47:41 -0800
Subject: [PATCH] building SSA package

---
 ...ssa___anomalous_usage_of_archive_tools.yml |   2 +
 ...ar_unallocated_sector_using_cipher_app.yml | 106 ++++++++++++++++++
 ...ssa___detect_rclone_command-line_usage.yml |   2 +
 ...___dns_exfiltration_using_nslookup_app.yml |   2 +
 dist/ssa/srs/ssa___fsutil_zeroing_file.yml    |   5 +-
 ..._files_and_directories_with_attrib_exe.yml |  94 ++++++++++++++++
 .../ssa___sdelete_application_execution.yml   |   2 +
 ...dows_curl_upload_to_remote_destination.yml |   2 +
 8 files changed, 212 insertions(+), 3 deletions(-)
 create mode 100644 dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
 create mode 100644 dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml

diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
index 47e96ac15c..acf8f36911 100644
--- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
+++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Cobalt Strike
   - NOBELIUM Group
+  cis20: []
   confidence: 60
   context:
   - Source:Endpoint
@@ -51,6 +52,7 @@ tags:
   mitre_attack_id:
   - T1560.001
   - T1560
+  nist: []
   observable:
   - name: user
     role:
diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
new file mode 100644
index 0000000000..534b55d47f
--- /dev/null
+++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
@@ -0,0 +1,106 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2021-12-20'
+description: this search is to detect execution of `cipher.exe` to clear the unallocated
+  sectors of a specific disk. This technique was seen in some ransomware to make it
+  impossible to forensically recover deleted files.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 8f907d90-6173-11ec-9c23-acde48001122
+known_false_positives: administrator may execute this app to manage disk
+name: Clear Unallocated Sector Using Cipher App
+product:
+- Splunk Behavioral Analytics
+references:
+- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
+- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of
+  a specific disk.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" |
+  eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Ransomware
+  - Information Sabotage
+  cis20:
+  - CIS 14
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
+    of a specific disk.
+  mitre_attack_id:
+  - T1070.004
+  - T1070
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: user
+    role:
+    - Victim
+    type: User
+  - name: dest
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+test:
+  name: Clear Unallocated Sector Using Cipher - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+      file_name: security.log
+      source: WinEventLog:Security
+    description: Test detection of Cipher Application execution
+    file: endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+    name: Clear Unallocated Sector Using Cipher App
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___detect_rclone_command-line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command-line_usage.yml
index b63d934c44..6dc4492876 100644
--- a/dist/ssa/srs/ssa___detect_rclone_command-line_usage.yml
+++ b/dist/ssa/srs/ssa___detect_rclone_command-line_usage.yml
@@ -48,6 +48,7 @@ tags:
   - DarkSide Ransomware
   - Ransomware
   automated_detection_testing: passed
+  cis20: []
   confidence: 70
   context:
   - Source:Endpoint
@@ -62,6 +63,7 @@ tags:
     remote cloud service to move files or folders.
   mitre_attack_id:
   - T1020
+  nist: []
   observable:
   - name: dest_user_id
     role:
diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
index 8b169d2d72..3368c2bc10 100644
--- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
+++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
@@ -45,6 +45,7 @@ tags:
   - Command and Control
   - Data Exfiltration
   automated_detection_testing: passed
+  cis20: []
   confidence: 80
   context:
   - Source:Endpoint
@@ -59,6 +60,7 @@ tags:
     to DNS exfiltration.
   mitre_attack_id:
   - T1048
+  nist: []
   observable:
   - name: dest_user_id
     role:
diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml
index 0aebd9fba7..9af81d412f 100644
--- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml
+++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml
@@ -35,6 +35,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
 tags:
   analytic_story:
   - Ransomware
+  cis20: []
   confidence: 90
   context:
   - Source:Endpoint
@@ -49,9 +50,7 @@ tags:
     deletion.
   mitre_attack_id:
   - T1070
-  nist:
-  - PR.AC
-  - PR.IP
+  nist: []
   observable:
   - name: dest_user_id
     role:
diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
new file mode 100644
index 0000000000..9a7f5579b1
--- /dev/null
+++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -0,0 +1,94 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint_Processes
+date: '2021-12-20'
+description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
+  as hidden by using specific flags so that the victim does not see the file.  The
+  search looks for specific command-line arguments to detect the use of attrib.exe
+  to hide files.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: 028e4406-6176-11ec-aec2-acde48001122
+known_false_positives: 'Some applications and users may legitimately use attrib.exe
+  to interact with the files. '
+name: Hiding Files And Directories With Attrib exe
+product:
+- Splunk Behavioral Analytics
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
+risk_message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is
+  detected.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" |
+  eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Persistence Techniques
+  - Information Sabotage
+  cis20:
+  - CIS 14
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
+  mitre_attack_id:
+  - T1222.001
+  - T1222
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: user
+    role:
+    - Victim
+    type: User
+  - name: dest
+    role:
+    - Victim
+    type: Endpoint
+  - name: parent_process
+    role:
+    - Attacker
+    - Parent Process
+    type: Other
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  risk_score: 72
+  risk_severity: medium
+  security_domain: endpoint
+test:
+  name: Hiding Files And Directories With Attrib exe - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+      file_name: security.log
+      source: WinEventLog:Security
+    description: Test detection of attrib Application execution
+    file: endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+    name: Hiding Files And Directories With Attrib exe
+    pass_condition: '@count_gt(0)'
+type: TTP
+version: 1
diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml
index a4c7aeb1cc..10c0009209 100644
--- a/dist/ssa/srs/ssa___sdelete_application_execution.yml
+++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml
@@ -47,6 +47,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
 tags:
   analytic_story:
   - Information Sabotage
+  cis20: []
   confidence: 70
   context:
   - Source:Endpoint
@@ -62,6 +63,7 @@ tags:
   - T1485
   - T1070.004
   - T1070
+  nist: []
   observable:
   - name: dest_user_id
     role:
diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
index af6e699d71..2883aa9f5d 100644
--- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
+++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
@@ -56,6 +56,7 @@ tags:
   analytic_story:
   - Ingress Tool Transfer
   automated_detection_testing: passed
+  cis20: []
   confidence: 100
   context:
   - Source:Endpoint
@@ -70,6 +71,7 @@ tags:
     destination.
   mitre_attack_id:
   - T1105
+  nist: []
   observable:
   - name: dest_user_id
     role: