diff --git a/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml b/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml index 8cea32f024..0b6a2bf0c6 100644 --- a/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml +++ b/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_data_output/detections/cobalt_strike_named_pipes.yml @@ -1,9 +1,9 @@ name: Cobalt Strike Named Pipes id: 5876d429-0240-4709-8b93-ea8330b411b5 -version: 1 -date: '2021-02-22' -author: MICHAEL HAAG, SPLUNK -type: TTP +version: 2 +date: '2022-07-15' +author: Michael Haag, Splunk +type: Hunting datamodel: [] description: 'The following analytic identifies the use of default or publicly known named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index eaf6ec2b1c..186b04b778 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -1,7 +1,7 @@ name: Certutil exe certificate extraction id: 337a46be-600f-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-26' +version: 2 +date: '2022-07-15' author: Rod Soto, Splunk type: TTP datamodel: @@ -9,18 +9,20 @@ datamodel: description: This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe - Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `certutil_exe_certificate_extraction_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. -references: [] +references: + - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack + - https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html tags: analytic_story: - Windows Persistence Techniques diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 3e74f365d1..f8e32a1f94 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -1,7 +1,7 @@ name: Powershell Disable Security Monitoring id: c148a894-dd93-11eb-bf2a-acde48001122 -version: 2 -date: '2021-07-05' +version: 3 +date: '2022-07-15' author: Michael Haag, Splunk type: TTP datamodel: @@ -11,7 +11,7 @@ description: This search is to identifies a modification in registry to disable seen in RAT, bot, or Trojan to disable AV to evade detections. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" - AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") + AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*drtm *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *") by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -25,6 +25,7 @@ known_false_positives: Limited false positives. However, tune based on scripts t may perform this action. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell +- https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps tags: analytic_story: - Ransomware diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml new file mode 100644 index 0000000000..d8d851af0f --- /dev/null +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -0,0 +1,87 @@ +name: Windows MOF Event Triggered Execution via WMI +id: e59b5a73-32bf-4467-a585-452c36ae10c1 +version: 1 +date: '2022-07-15' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. + Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. + A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. + The default path of mofcomp.exe is C:\Windows\System32\wbem. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where + (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) + OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_mof_event_triggered_execution_via_wmi_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f +references: + - https://attack.mitre.org/techniques/T1546/003/ + - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ + - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp + - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ + - https://www.sakshamdixit.com/wmi-events/ +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file. + mitre_attack_id: + - T1546.003 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_mof_event_triggered_execution_via_wmi.test.yml b/tests/endpoint/windows_mof_event_triggered_execution_via_wmi.test.yml new file mode 100644 index 0000000000..2d1dcaa4b2 --- /dev/null +++ b/tests/endpoint/windows_mof_event_triggered_execution_via_wmi.test.yml @@ -0,0 +1,13 @@ +name: Windows MOF Event Triggered Execution via WMI Unit Test +tests: +- name: Windows MOF Event Triggered Execution via WMI + file: endpoint/windows_mof_event_triggered_execution_via_wmi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: mofcomp.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true