From 628fe8f257928aeddb49f98e05ceeccdd0c7721e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 20 Sep 2021 12:37:32 -0600 Subject: [PATCH] removing originalfilename artifacts --- detections/endpoint/detect_renamed_7_zip.yml | 19 ++++++++++------- detections/endpoint/detect_renamed_psexec.yml | 19 ++++++++++------- detections/endpoint/detect_renamed_rclone.yml | 21 +++++++++++-------- .../endpoint/detect_sharphound_usage.yml | 4 ++-- .../endpoint/dump_lsass_via_procdump.yml | 2 +- ...ious_dllhost_no_command_line_arguments.yml | 3 ++- .../endpoint/suspicious_rundll32_rename.yml | 2 +- 7 files changed, 40 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 0a522bdafb..28fcfe502d 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -65,13 +65,16 @@ tags: - Splunk Cloud required_fields: - _time - - dest - - User - - parent_process_name - - process_name - - OriginalFileName - - process_path - - CommandLine - - Product + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 033f2842a0..64b8ffeaa5 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -73,13 +73,16 @@ tags: - Splunk Cloud required_fields: - _time - - dest - - User - - parent_process_name - - process_name - - OriginalFileName - - process_path - - CommandLine - - Product + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 2bdc5b7bb6..23cb676fc4 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -18,10 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. @@ -70,10 +67,16 @@ tags: - Splunk Cloud required_fields: - _time - - OriginalFileName - - process_name - - process_path - - CommandLine - - dest + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index cb65357b27..afbd7b2146 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -7,8 +7,8 @@ type: TTP datamodel: - Endpoint description: The following analytic identifies SharpHound binary usage by using the - `OriginalFileName`. In addition to renaming the PE, other coverage is available - to detect command-line arguments. This particular analytic looks for the OriginalFileName + original filena,e. In addition to renaming the PE, other coverage is available + to detect command-line arguments. This particular analytic looks for the original_file_name of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 4c97cba1aa..1de3f88d35 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -9,7 +9,7 @@ datamodel: description: 'Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This - query does not monitor for the internal name (OriginalFileName=procdump) of the + query does not monitor for the internal name (original_file_name=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ During triage, confirm this is procdump.exe executing. If it is the first time a diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index da953aeba8..2da1797624 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -4,7 +4,8 @@ version: 2 date: '2021-09-20' author: Michael Haag, Splunk type: TTP -datamodel: [] +datamodel: + - Endpoint description: The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index c61f510865..173215731d 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script - content it is loading. This query relies on the OriginalFileName from Sysmon, or + content it is loading. This query relies on the original filename or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)