From 9fa410ac29fd75f4b12263698e05f0289f498088 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 16:09:42 +0100 Subject: [PATCH 01/14] ioc_detections --- .../csc__net_on_the_fly_compilation.yml | 69 +++++++++++++++++++ .../firewall_allowed_program_enable.yml | 68 ++++++++++++++++++ ...equency_copy_of_files_in_network_share.yml | 65 +++++++++++++++++ ...work_discovery_using_route_windows_app.yml | 69 +++++++++++++++++++ .../runas_execution_in_commandline.yml | 67 ++++++++++++++++++ macros/process_csc.yml | 3 + macros/process_route.yml | 3 + macros/process_runas.yml | 3 + .../csc__net_on_the_fly_compilation.test.yml | 12 ++++ .../firewall_allowed_program_enable.test.yml | 12 ++++ ...cy_copy_of_files_in_network_share.test.yml | 12 ++++ ...discovery_using_route_windows_app.test.yml | 12 ++++ .../runas_execution_in_commandline.test.yml | 12 ++++ 13 files changed, 407 insertions(+) create mode 100644 detections/endpoint/csc__net_on_the_fly_compilation.yml create mode 100644 detections/endpoint/firewall_allowed_program_enable.yml create mode 100644 detections/endpoint/high_frequency_copy_of_files_in_network_share.yml create mode 100644 detections/endpoint/network_discovery_using_route_windows_app.yml create mode 100644 detections/endpoint/runas_execution_in_commandline.yml create mode 100644 macros/process_csc.yml create mode 100644 macros/process_route.yml create mode 100644 macros/process_runas.yml create mode 100644 tests/endpoint/csc__net_on_the_fly_compilation.test.yml create mode 100644 tests/endpoint/firewall_allowed_program_enable.test.yml create mode 100644 tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml create mode 100644 tests/endpoint/network_discovery_using_route_windows_app.test.yml create mode 100644 tests/endpoint/runas_execution_in_commandline.test.yml diff --git a/detections/endpoint/csc__net_on_the_fly_compilation.yml b/detections/endpoint/csc__net_on_the_fly_compilation.yml new file mode 100644 index 0000000000..1e471ff446 --- /dev/null +++ b/detections/endpoint/csc__net_on_the_fly_compilation.yml @@ -0,0 +1,69 @@ +name: CSC .Net On The Fly Compilation +id: ea73128a-43ab-11ec-9753-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: this analytic is to detect a suspicious compile before delivery approach of .net compiler csc.exe. + This technique was seen in several adversaries, malware and even in red teams to take advantage the csc.exe .net compiler tool + to compile on the fly a malicious .net code to evade detection from security product. This is a good hunting query to check further + the file or process created after this event and check the file path that passed to csc.exe which is the .net code. + Aside from that, powershell is capable of using this compiler in executing .net code in a powershell script so filter on that case is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where `process_csc` Processes.process = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `csc__net_on_the_fly_compilation_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated powershell script taht execute .net code that may generate false positive. filter is needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ +- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027.004 + - T1027 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml new file mode 100644 index 0000000000..9526296987 --- /dev/null +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -0,0 +1,68 @@ +name: Firewall Allowed Program Enable +id: 9a8f63a8-43ac-11ec-904c-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic detects a potential suspicious modification of firewall + rule allowing to execute specific application. This technique was identified when + an adversary and red teams to bypassed firewall file execution restriction in a targetted host. + Take note that this event or command can run by administrator during testing or allowing legitimate tool or application. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process = "*ENABLE*" + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `firewall_allowed_program_enable_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated or manual execution of this firewall rule that may generate false positives. + Filter as needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1562.004 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml new file mode 100644 index 0000000000..f9064d0b2e --- /dev/null +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -0,0 +1,65 @@ +name: High Frequency Copy Of Files In Network Share +id: 40925f12-4709-11ec-bb43-acde48001122 +version: 1 +date: '2021-11-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a suspicious high frequency copying/moving of files in network share as part of information sabotage. + This anomaly event can be a good indicator of insider trying to sabotage data by transfering classified or internal files within network share to exfitrate it after or + to lure evidence of insider attack to other user. + This behavior may catch several noise if network share is a common place for classified or internal document processing. +search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") + Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" + | bucket _time span=5m + | stats values(Relative_Target_Name) as valRelativeTargetName, values(Share_Name) as valShareName, values(Object_Type) as valObjectType, values(Access_Mask) as valAccessmask, + values(src_port) as valSrcPort, values(Source_Address) as valSrcAddress count as numShareName by dest, _time, EventCode, user + | eventstats avg(numShareName) as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest, _time, EventCode, user + | eval upperThreshold=(avgShareName + stdShareName *3) + | eval isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) + | search isOutlier=1 + | `high_frequency_copy_of_files_in_network_share_filter`' +how_to_implement: o successfully implement this search, you need to be ingesting + Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also + required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: this behavior may seen in normal transfer of file within network if network share is common place for sharing documents. +references: +- https://attack.mitre.org/techniques/T1537/ +tags: + analytic_story: + - Information Sabotage + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1537 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Share_Name + - Relative_Target_Name + - Object_Type + - Access_Mask + - user + - src_port + - Source_Address + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Exfiltration + message: high frequency copy of document in network share $Share_Name$ from $Source_Address$ by $user$ + observable: + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml new file mode 100644 index 0000000000..79f238a0c2 --- /dev/null +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -0,0 +1,69 @@ +name: Network Discovery Using Route Windows App +id: dd83407e-439f-11ec-ab8e-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic look for a spawned process of route.exe windows application. + Adversaries and red teams alike abuse this application the recon or do a network discovery on a target host. + but one possible false positive might be an automated tool used by a system administator or a powershell script in amazon + ec2 config services. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where `process_route` + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `network_discovery_using_route_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated host discovery application that may generate false positives or an amazon ec2 script that uses this application. + Filter as needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1016 + - T1016.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Network Connection discovery on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml new file mode 100644 index 0000000000..e7d85c4ac6 --- /dev/null +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -0,0 +1,67 @@ +name: Runas Execution in CommandLine +id: 4807e716-43a4-11ec-a0e7-acde48001122 +version: 1 +date: '2021-11-12' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic look for a spawned runas.exe process with a administrator user option parameter. + This parameter was abused by adversaries, malware author or even red teams to gain elevated privileges in target host. + This is a good hunting query to figure out privilege escalation tactics that may used for different stages like lateral movement but + take note that administrator may use this command in purpose so its better to see other event context before and after this analytic. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where `process_runas` AND Processes.process = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `runas_execution_in_commandline_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: A network operator or systems administrator may utilize an + automated or manual execute this command that may generate false positives. filter is needed. +references: +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +tags: + analytic_story: + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1134 + - T1134.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - stage:Privilege Escalation + message: elevated process using runas on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/macros/process_csc.yml b/macros/process_csc.yml new file mode 100644 index 0000000000..c545b6208f --- /dev/null +++ b/macros/process_csc.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_csc \ No newline at end of file diff --git a/macros/process_route.yml b/macros/process_route.yml new file mode 100644 index 0000000000..f319fbf134 --- /dev/null +++ b/macros/process_route.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=route.exe OR Processes.original_file_name=route.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_route \ No newline at end of file diff --git a/macros/process_runas.yml b/macros/process_runas.yml new file mode 100644 index 0000000000..eeb06a9867 --- /dev/null +++ b/macros/process_runas.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_runas \ No newline at end of file diff --git a/tests/endpoint/csc__net_on_the_fly_compilation.test.yml b/tests/endpoint/csc__net_on_the_fly_compilation.test.yml new file mode 100644 index 0000000000..268430f278 --- /dev/null +++ b/tests/endpoint/csc__net_on_the_fly_compilation.test.yml @@ -0,0 +1,12 @@ +name: CSC .Net On The Fly Compilation Unit Test +tests: +- name: CSC .Net On The Fly Compilation + file: endpoint/csc__net_on_the_fly_compilation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/firewall_allowed_program_enable.test.yml b/tests/endpoint/firewall_allowed_program_enable.test.yml new file mode 100644 index 0000000000..76d460eded --- /dev/null +++ b/tests/endpoint/firewall_allowed_program_enable.test.yml @@ -0,0 +1,12 @@ +name: Firewall Allowed Program Enable Unit Test +tests: +- name: Firewall Allowed Program Enable + file: endpoint/firewall_allowed_program_enable.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml b/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml new file mode 100644 index 0000000000..f4ccc3120d --- /dev/null +++ b/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml @@ -0,0 +1,12 @@ +name: High Frequency Copy Of Files In Network Share Unit Test +tests: +- name: High Frequency Copy Of Files In Network Share + file: endpoint/high_frequency_copy_of_files_in_network_share.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/high_copy_files_in_net_share/security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/network_discovery_using_route_windows_app.test.yml b/tests/endpoint/network_discovery_using_route_windows_app.test.yml new file mode 100644 index 0000000000..1cff1b8c69 --- /dev/null +++ b/tests/endpoint/network_discovery_using_route_windows_app.test.yml @@ -0,0 +1,12 @@ +name: Network Discovery Using Route Windows App Unit Test +tests: +- name: Network Discovery Using Route Windows App + file: endpoint/network_discovery_using_route_windows_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/runas_execution_in_commandline.test.yml b/tests/endpoint/runas_execution_in_commandline.test.yml new file mode 100644 index 0000000000..158ddc932c --- /dev/null +++ b/tests/endpoint/runas_execution_in_commandline.test.yml @@ -0,0 +1,12 @@ +name: Runas Execution in CommandLine Unit Test +tests: +- name: Runas Execution in CommandLine + file: endpoint/runas_execution_in_commandline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file From aadd9fb471125f014a612b5ef4cf9e103d19d146 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 16:20:52 +0100 Subject: [PATCH 02/14] ioc_detections --- ...y_compilation.yml => csc_net_on_the_fly_compilation.yml} | 4 ++-- ...ion.test.yml => csc_net_on_the_fly_compilation.test.yml} | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) rename detections/endpoint/{csc__net_on_the_fly_compilation.yml => csc_net_on_the_fly_compilation.yml} (97%) rename tests/endpoint/{csc__net_on_the_fly_compilation.test.yml => csc_net_on_the_fly_compilation.test.yml} (71%) diff --git a/detections/endpoint/csc__net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml similarity index 97% rename from detections/endpoint/csc__net_on_the_fly_compilation.yml rename to detections/endpoint/csc_net_on_the_fly_compilation.yml index 1e471ff446..b44f1dcfd8 100644 --- a/detections/endpoint/csc__net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -1,4 +1,4 @@ -name: CSC .Net On The Fly Compilation +name: CSC Net On The Fly Compilation id: ea73128a-43ab-11ec-9753-acde48001122 version: 1 date: '2021-11-12' @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `csc__net_on_the_fly_compilation_filter`' + | `csc_net_on_the_fly_compilation_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/tests/endpoint/csc__net_on_the_fly_compilation.test.yml b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml similarity index 71% rename from tests/endpoint/csc__net_on_the_fly_compilation.test.yml rename to tests/endpoint/csc_net_on_the_fly_compilation.test.yml index 268430f278..f6f93238ba 100644 --- a/tests/endpoint/csc__net_on_the_fly_compilation.test.yml +++ b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml @@ -1,7 +1,7 @@ -name: CSC .Net On The Fly Compilation Unit Test +name: CSC Net On The Fly Compilation Unit Test tests: -- name: CSC .Net On The Fly Compilation - file: endpoint/csc__net_on_the_fly_compilation.yml +- name: CSC Net On The Fly Compilation + file: endpoint/csc_net_on_the_fly_compilation.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 596de7d6625054a00d53313a8e6782d717fe9cb4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 17:09:43 +0100 Subject: [PATCH 03/14] ioc_detections --- tests/endpoint/csc_net_on_the_fly_compilation.test.yml | 2 +- tests/endpoint/firewall_allowed_program_enable.test.yml | 2 +- .../high_frequency_copy_of_files_in_network_share.test.yml | 2 +- .../endpoint/network_discovery_using_route_windows_app.test.yml | 2 +- tests/endpoint/runas_execution_in_commandline.test.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/endpoint/csc_net_on_the_fly_compilation.test.yml b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml index f6f93238ba..c7cdd783f0 100644 --- a/tests/endpoint/csc_net_on_the_fly_compilation.test.yml +++ b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml @@ -3,7 +3,7 @@ tests: - name: CSC Net On The Fly Compilation file: endpoint/csc_net_on_the_fly_compilation.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: sysmon.log diff --git a/tests/endpoint/firewall_allowed_program_enable.test.yml b/tests/endpoint/firewall_allowed_program_enable.test.yml index 76d460eded..be58f823b2 100644 --- a/tests/endpoint/firewall_allowed_program_enable.test.yml +++ b/tests/endpoint/firewall_allowed_program_enable.test.yml @@ -3,7 +3,7 @@ tests: - name: Firewall Allowed Program Enable file: endpoint/firewall_allowed_program_enable.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: sysmon.log diff --git a/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml b/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml index f4ccc3120d..66b0e63cbe 100644 --- a/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml +++ b/tests/endpoint/high_frequency_copy_of_files_in_network_share.test.yml @@ -3,7 +3,7 @@ tests: - name: High Frequency Copy Of Files In Network Share file: endpoint/high_frequency_copy_of_files_in_network_share.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: security.log diff --git a/tests/endpoint/network_discovery_using_route_windows_app.test.yml b/tests/endpoint/network_discovery_using_route_windows_app.test.yml index 1cff1b8c69..c50b167f6d 100644 --- a/tests/endpoint/network_discovery_using_route_windows_app.test.yml +++ b/tests/endpoint/network_discovery_using_route_windows_app.test.yml @@ -3,7 +3,7 @@ tests: - name: Network Discovery Using Route Windows App file: endpoint/network_discovery_using_route_windows_app.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: sysmon.log diff --git a/tests/endpoint/runas_execution_in_commandline.test.yml b/tests/endpoint/runas_execution_in_commandline.test.yml index 158ddc932c..f547f9a538 100644 --- a/tests/endpoint/runas_execution_in_commandline.test.yml +++ b/tests/endpoint/runas_execution_in_commandline.test.yml @@ -3,7 +3,7 @@ tests: - name: Runas Execution in CommandLine file: endpoint/runas_execution_in_commandline.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-30d' latest_time: 'now' attack_data: - file_name: sysmon.log From ff8df1c3da7623d4a4a4ade55747da068bdb1604 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 17 Nov 2021 17:59:06 +0100 Subject: [PATCH 04/14] ioc_detections --- tests/endpoint/csc_net_on_the_fly_compilation.test.yml | 4 ++-- tests/endpoint/firewall_allowed_program_enable.test.yml | 4 ++-- .../network_discovery_using_route_windows_app.test.yml | 2 +- tests/endpoint/runas_execution_in_commandline.test.yml | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/endpoint/csc_net_on_the_fly_compilation.test.yml b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml index c7cdd783f0..983c1f10a8 100644 --- a/tests/endpoint/csc_net_on_the_fly_compilation.test.yml +++ b/tests/endpoint/csc_net_on_the_fly_compilation.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/firewall_allowed_program_enable.test.yml b/tests/endpoint/firewall_allowed_program_enable.test.yml index be58f823b2..23ebd31f6d 100644 --- a/tests/endpoint/firewall_allowed_program_enable.test.yml +++ b/tests/endpoint/firewall_allowed_program_enable.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/network_discovery_using_route_windows_app.test.yml b/tests/endpoint/network_discovery_using_route_windows_app.test.yml index c50b167f6d..0389608b65 100644 --- a/tests/endpoint/network_discovery_using_route_windows_app.test.yml +++ b/tests/endpoint/network_discovery_using_route_windows_app.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/runas_execution_in_commandline.test.yml b/tests/endpoint/runas_execution_in_commandline.test.yml index f547f9a538..df59958ca8 100644 --- a/tests/endpoint/runas_execution_in_commandline.test.yml +++ b/tests/endpoint/runas_execution_in_commandline.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 5720f62c97c3217b1e6213ce5d2bed950090c8a7 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 17 Nov 2021 17:12:42 +0000 Subject: [PATCH 05/14] Added detection testing service results inHigh Frequency Copy Of Files In Network Share --- ...equency_copy_of_files_in_network_share.yml | 48 ++++++++++--------- 1 file changed, 26 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index f9064d0b2e..34b767180b 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -6,26 +6,29 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious high frequency copying/moving of files in network share as part of information sabotage. - This anomaly event can be a good indicator of insider trying to sabotage data by transfering classified or internal files within network share to exfitrate it after or - to lure evidence of insider attack to other user. - This behavior may catch several noise if network share is a common place for classified or internal document processing. -search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") - Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" - | bucket _time span=5m - | stats values(Relative_Target_Name) as valRelativeTargetName, values(Share_Name) as valShareName, values(Object_Type) as valObjectType, values(Access_Mask) as valAccessmask, - values(src_port) as valSrcPort, values(Source_Address) as valSrcAddress count as numShareName by dest, _time, EventCode, user - | eventstats avg(numShareName) as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest, _time, EventCode, user - | eval upperThreshold=(avgShareName + stdShareName *3) - | eval isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) - | search isOutlier=1 - | `high_frequency_copy_of_files_in_network_share_filter`' -how_to_implement: o successfully implement this search, you need to be ingesting - Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also - required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: this behavior may seen in normal transfer of file within network if network share is common place for sharing documents. +description: This analytic is to detect a suspicious high frequency copying/moving + of files in network share as part of information sabotage. This anomaly event can + be a good indicator of insider trying to sabotage data by transfering classified + or internal files within network share to exfitrate it after or to lure evidence + of insider attack to other user. This behavior may catch several noise if network + share is a common place for classified or internal document processing. +search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") + Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= + "0x2" | bucket _time span=5m | stats values(Relative_Target_Name) as valRelativeTargetName, + values(Share_Name) as valShareName, values(Object_Type) as valObjectType, values(Access_Mask) + as valAccessmask, values(src_port) as valSrcPort, values(Source_Address) as valSrcAddress + count as numShareName by dest, _time, EventCode, user | eventstats avg(numShareName) + as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest, + _time, EventCode, user | eval upperThreshold=(avgShareName + stdShareName *3) | eval + isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) | search + isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`' +how_to_implement: o successfully implement this search, you need to be ingesting Windows + Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. + Also enable the object Audit access success/failure in your group policy. +known_false_positives: this behavior may seen in normal transfer of file within network + if network share is common place for sharing documents. references: -- https://attack.mitre.org/techniques/T1537/ +- https://attack.mitre.org/techniques/T1537/ tags: analytic_story: - Information Sabotage @@ -52,14 +55,15 @@ tags: security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - Source:Endpoint - Stage:Exfiltration - message: high frequency copy of document in network share $Share_Name$ from $Source_Address$ by $user$ + message: high frequency copy of document in network share $Share_Name$ from $Source_Address$ + by $user$ observable: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From c1e4366302c2710f4cf6081f31b192ebf8a8df72 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 17 Nov 2021 17:16:04 +0000 Subject: [PATCH 06/14] Added detection testing service results inFirewall Allowed Program Enable --- .../firewall_allowed_program_enable.yml | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 9526296987..daef9a0a4b 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -7,15 +7,16 @@ type: Anomaly datamodel: - Endpoint description: This analytic detects a potential suspicious modification of firewall - rule allowing to execute specific application. This technique was identified when - an adversary and red teams to bypassed firewall file execution restriction in a targetted host. - Take note that this event or command can run by administrator during testing or allowing legitimate tool or application. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process = "*ENABLE*" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + rule allowing to execute specific application. This technique was identified when + an adversary and red teams to bypassed firewall file execution restriction in a + targetted host. Take note that this event or command can run by administrator during + testing or allowing legitimate tool or application. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" + Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process + = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `firewall_allowed_program_enable_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -23,10 +24,10 @@ how_to_implement: To successfully implement this search you need to be ingesting confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: A network operator or systems administrator may utilize an - automated or manual execution of this firewall rule that may generate false positives. + automated or manual execution of this firewall rule that may generate false positives. Filter as needed. references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# tags: analytic_story: - Windows Defense Evasion Tactics @@ -43,26 +44,26 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - Source:Endpoint - Stage:Defense Evasion - message: firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$ + message: firewall allowed program commandline $process$ of $process_name$ on $dest$ + by $user$ observable: - name: dest type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 0d919f6d15f5f78963f8c77eb80618d14543469a Mon Sep 17 00:00:00 2001 From: root Date: Wed, 17 Nov 2021 17:18:17 +0000 Subject: [PATCH 07/14] Added detection testing service results inCSC Net On The Fly Compilation --- .../csc_net_on_the_fly_compilation.yml | 43 ++++++++++--------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml index b44f1dcfd8..ae91b068f7 100644 --- a/detections/endpoint/csc_net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -6,17 +6,20 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: this analytic is to detect a suspicious compile before delivery approach of .net compiler csc.exe. - This technique was seen in several adversaries, malware and even in red teams to take advantage the csc.exe .net compiler tool - to compile on the fly a malicious .net code to evade detection from security product. This is a good hunting query to check further - the file or process created after this event and check the file path that passed to csc.exe which is the .net code. - Aside from that, powershell is capable of using this compiler in executing .net code in a powershell script so filter on that case is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where `process_csc` Processes.process = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: this analytic is to detect a suspicious compile before delivery approach + of .net compiler csc.exe. This technique was seen in several adversaries, malware + and even in red teams to take advantage the csc.exe .net compiler tool to compile + on the fly a malicious .net code to evade detection from security product. This + is a good hunting query to check further the file or process created after this + event and check the file path that passed to csc.exe which is the .net code. Aside + from that, powershell is capable of using this compiler in executing .net code in + a powershell script so filter on that case is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_csc` Processes.process + = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" by + Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `csc_net_on_the_fly_compilation_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -24,7 +27,8 @@ how_to_implement: To successfully implement this search you need to be ingesting confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: A network operator or systems administrator may utilize an - automated powershell script taht execute .net code that may generate false positive. filter is needed. + automated powershell script taht execute .net code that may generate false positive. + filter is needed. references: - https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ - https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html @@ -44,18 +48,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - Source:Endpoint @@ -66,4 +69,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From be52e7f8204413c4953cb850357c58eac002b9ea Mon Sep 17 00:00:00 2001 From: root Date: Wed, 17 Nov 2021 17:21:51 +0000 Subject: [PATCH 08/14] Added detection testing service results inNetwork Discovery Using Route Windows App --- ...work_discovery_using_route_windows_app.yml | 41 +++++++++---------- 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index 79f238a0c2..94a9e73975 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -7,27 +7,24 @@ type: Hunting datamodel: - Endpoint description: This analytic look for a spawned process of route.exe windows application. - Adversaries and red teams alike abuse this application the recon or do a network discovery on a target host. - but one possible false positive might be an automated tool used by a system administator or a powershell script in amazon - ec2 config services. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where `process_route` - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `network_discovery_using_route_windows_app_filter`' + Adversaries and red teams alike abuse this application the recon or do a network + discovery on a target host. but one possible false positive might be an automated + tool used by a system administator or a powershell script in amazon ec2 config services. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest + Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives or an amazon ec2 script that uses this application. - Filter as needed. + automated host discovery application that may generate false positives or an amazon + ec2 script that uses this application. Filter as needed. references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# tags: analytic_story: - Active Directory Discovery @@ -44,18 +41,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - Source:Endpoint @@ -66,4 +62,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 1697f8fdc1d1443fde95f0219fe0fba4d6d58250 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 17 Nov 2021 17:29:56 +0000 Subject: [PATCH 09/14] Added detection testing service results inRunas Execution in CommandLine --- .../runas_execution_in_commandline.yml | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index e7d85c4ac6..5fdc2249db 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -6,26 +6,28 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic look for a spawned runas.exe process with a administrator user option parameter. - This parameter was abused by adversaries, malware author or even red teams to gain elevated privileges in target host. - This is a good hunting query to figure out privilege escalation tactics that may used for different stages like lateral movement but - take note that administrator may use this command in purpose so its better to see other event context before and after this analytic. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where `process_runas` AND Processes.process = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `runas_execution_in_commandline_filter`' +description: This analytic look for a spawned runas.exe process with a administrator + user option parameter. This parameter was abused by adversaries, malware author + or even red teams to gain elevated privileges in target host. This is a good hunting + query to figure out privilege escalation tactics that may used for different stages + like lateral movement but take note that administrator may use this command in purpose + so its better to see other event context before and after this analytic. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_runas` AND Processes.process + = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: A network operator or systems administrator may utilize an - automated or manual execute this command that may generate false positives. filter is needed. + automated or manual execute this command that may generate false positives. filter + is needed. references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# +- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/# tags: analytic_story: - Windows Privilege Escalation @@ -42,18 +44,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - Source:Endpoint @@ -64,4 +65,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From b566f7c72f944ba7c1551c56b8a25d13e994d371 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 18 Nov 2021 12:05:43 +0100 Subject: [PATCH 10/14] ioc_detections --- .../endpoint/loading_of_dynwrapx_module.yml | 74 +++++++++++++++++++ ...ess_dns_query_known_abuse_web_services.yml | 65 ++++++++++++++++ .../loading_of_dynwrapx_module.test.yml | 12 +++ ...ns_query_known_abuse_web_services.test.yml | 12 +++ 4 files changed, 163 insertions(+) create mode 100644 detections/endpoint/loading_of_dynwrapx_module.yml create mode 100644 detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml create mode 100644 tests/endpoint/loading_of_dynwrapx_module.test.yml create mode 100644 tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml new file mode 100644 index 0000000000..3b78007e01 --- /dev/null +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -0,0 +1,74 @@ +name: Loading Of Dynwrapx Module +id: eac5e8ba-4857-11ec-9371-acde48001122 +version: 1 +date: '2021-11-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: DynamicWrapperX is an ActiveX component that can be used in a script + to call Windows API functions, but it requires the dynwrapx.dll to be installed + and registered. With that, registering or loading dynwrapx.dll to a host highly suspect. + Why is it needed? In most malicious instances, During triage, review parallel + processes and pivot on the process_guid. Review the registry for any suspicious + modifications meant to load dynwrapx.dll. Identify any suspicious module loads of + dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR Product = "DynamicWrapperX") + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name Computer EventCode Signed ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `loading_of_dynwrapx_module_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` + node. In addition, confirm the latest CIM App 4.20 or higher is installed and the + latest TA for the endpoint product. +known_false_positives: False positives should be limited, however it is possible to + filter by Processes.process_name and specific processes (ex. wscript.exe). Filter + as needed. This may need modification based on EDR telemetry and how it brings in + registry data. For example, removal of (Default). +references: +- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ +- https://www.script-coding.com/dynwrapx_eng.html +- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + - T1055.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - OriginalFileName + - Product + - process_name + - Computer + - EventCode + - Signed + - ProcessId + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: dynwrapx.dll loaded by process $process_name$ on $Computer$ + observable: + - name: Computer + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml new file mode 100644 index 0000000000..180fbf05a6 --- /dev/null +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -0,0 +1,65 @@ +name: Suspicious Process DNS Query Known Abuse Web Services +id: 3cf0dc36-484d-11ec-a6bc-acde48001122 +version: 1 +date: '2021-11-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious process having a dns query on known abuse text paste web services, + or VoIP, instant messaging and digital distribution platform to download some files. This technique is abused by adversaries, + malware attacker and red team to download a malicious file on the target host. This is a good TTP indicator for possible initial access + technique. Noise and false positive can be seen if the following instant messaging is allowed or common application in corporate network. +search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") + process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_process_dns_query_known_abuse_web_services_filter`' +how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver + loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll + is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. + We suggest to run this detection at least once a day over the last 14 days. +known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. filter is needed. +references: +- https://urlhaus.abuse.ch/url/1798923/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.005 + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults + - Computer + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Execution + message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker \ No newline at end of file diff --git a/tests/endpoint/loading_of_dynwrapx_module.test.yml b/tests/endpoint/loading_of_dynwrapx_module.test.yml new file mode 100644 index 0000000000..3c7b55ad5d --- /dev/null +++ b/tests/endpoint/loading_of_dynwrapx_module.test.yml @@ -0,0 +1,12 @@ +name: Loading Of Dynwrapx Module Unit Test +tests: +- name: Loading Of Dynwrapx Module + file: endpoint/loading_of_dynwrapx_module.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml b/tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml new file mode 100644 index 0000000000..6bb663c2a7 --- /dev/null +++ b/tests/endpoint/suspicious_process_dns_query_known_abuse_web_services.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Process DNS Query Known Abuse Web Services Unit Test +tests: +- name: Suspicious Process DNS Query Known Abuse Web Services + file: endpoint/suspicious_process_dns_query_known_abuse_web_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 8d42e737203b093bfc7923468f6784ed5684d6e1 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 18 Nov 2021 11:27:52 +0000 Subject: [PATCH 11/14] Added detection testing service results inSuspicious Process DNS Query Known Abuse Web Services --- ...ess_dns_query_known_abuse_web_services.yml | 43 ++++++++++--------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 180fbf05a6..5531d26ba7 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -6,23 +6,26 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious process having a dns query on known abuse text paste web services, - or VoIP, instant messaging and digital distribution platform to download some files. This technique is abused by adversaries, - malware attacker and red team to download a malicious file on the target host. This is a good TTP indicator for possible initial access - technique. Noise and false positive can be seen if the following instant messaging is allowed or common application in corporate network. -search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") - process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") - | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_process_dns_query_known_abuse_web_services_filter`' +description: This analytic is to detect a suspicious process having a dns query on + known abuse text paste web services, or VoIP, instant messaging and digital distribution + platform to download some files. This technique is abused by adversaries, malware + attacker and red team to download a malicious file on the target host. This is a + good TTP indicator for possible initial access technique. Noise and false positive + can be seen if the following instant messaging is allowed or common application + in corporate network. +search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", + "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", + "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image + QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days. -known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. filter is needed. +known_false_positives: Noise and false positive can be seen if the following instant + messaging is allowed to use within corporate network. filter is needed. references: -- https://urlhaus.abuse.ch/url/1798923/ +- https://urlhaus.abuse.ch/url/1798923/ tags: analytic_story: - Remcos @@ -39,16 +42,15 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - QueryName - - QueryStatus - - process_name - - QueryResults + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults - Computer security_domain: endpoint impact: 80 - confidence: 80 - # (impact * confidence)/100 + confidence: 80 risk_score: 64 context: - Source:Endpoint @@ -62,4 +64,5 @@ tags: - name: process_name type: process name role: - - Attacker \ No newline at end of file + - Attacker + automated_detection_testing: passed From f2f3eb32312dfd05dbb047a65f37a6115ff716f6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 18 Nov 2021 13:00:20 +0100 Subject: [PATCH 12/14] ioc_detections --- tests/endpoint/loading_of_dynwrapx_module.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/loading_of_dynwrapx_module.test.yml b/tests/endpoint/loading_of_dynwrapx_module.test.yml index 3c7b55ad5d..b5ed4b6cbb 100644 --- a/tests/endpoint/loading_of_dynwrapx_module.test.yml +++ b/tests/endpoint/loading_of_dynwrapx_module.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon.log + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 08cc78c72388646e82a5dd7fa5b35598f51f40a9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 18 Nov 2021 15:10:02 +0100 Subject: [PATCH 13/14] ioc_detections --- detections/endpoint/loading_of_dynwrapx_module.yml | 2 +- tests/endpoint/loading_of_dynwrapx_module.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 3b78007e01..38030ada9f 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -37,7 +37,7 @@ tags: analytic_story: - Remcos dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/loading_of_dynwrapx_module.test.yml b/tests/endpoint/loading_of_dynwrapx_module.test.yml index b5ed4b6cbb..c8b1472965 100644 --- a/tests/endpoint/loading_of_dynwrapx_module.test.yml +++ b/tests/endpoint/loading_of_dynwrapx_module.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/windows-sysmon.log + - file_name: sysmon_dynwraper.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From b78ea71386a5af886ea98c692cd783172700aadd Mon Sep 17 00:00:00 2001 From: root Date: Thu, 18 Nov 2021 14:28:20 +0000 Subject: [PATCH 14/14] Added detection testing service results inLoading Of Dynwrapx Module --- .../endpoint/loading_of_dynwrapx_module.yml | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 38030ada9f..0424a4d064 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -8,15 +8,15 @@ datamodel: - Endpoint description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed - and registered. With that, registering or loading dynwrapx.dll to a host highly suspect. - Why is it needed? In most malicious instances, During triage, review parallel + and registered. With that, registering or loading dynwrapx.dll to a host highly + suspect. Why is it needed? In most malicious instances, During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. -search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR Product = "DynamicWrapperX") - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name Computer EventCode Signed ProcessId - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName + = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name + Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -49,26 +49,26 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - ImageLoaded - - OriginalFileName - - Product - - process_name - - Computer - - EventCode - - Signed - - ProcessId + - Image + - ImageLoaded + - OriginalFileName + - Product + - process_name + - Computer + - EventCode + - Signed + - ProcessId security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - - Stage:Defense Evasion + - Stage:Defense Evasion message: dynwrapx.dll loaded by process $process_name$ on $Computer$ observable: - name: Computer type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed