diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 0550aed76a..d58d8970f2 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -1,7 +1,7 @@ name: CMD Carry Out String Command Parameter id: 54a6ed00-3256-11ec-b031-acde48001122 -version: 2 -date: '2021-12-13' +version: 3 +date: '2022-01-18' author: Teoderick Contreras, Bhavin Patel, Splunk type: Hunting datamodel: @@ -27,10 +27,12 @@ known_false_positives: False positives may be high based on legitimate scripted in any environment. Filter as needed. references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - IcedID - Log4Shell CVE-2021-44228 + - WhisperGate automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index d2c6c8d24a..8f6faa77bf 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -1,7 +1,7 @@ name: Impacket Lateral Movement Commandline Parameters id: 8ce07472-496f-11ec-ab3b-3e22fbd008af -version: 1 -date: '2021-11-19' +version: 2 +date: '2022-01-18' author: Mauricio Velazco, Splunk type: TTP datamodel: @@ -34,9 +34,11 @@ references: - https://attack.mitre.org/techniques/T1053/005 - https://github.com/SecureAuthCorp/impacket - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Active Directory Lateral Movement + - WhisperGate automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index f0ac9f5873..0b1bb8f3ea 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -1,7 +1,7 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -version: 6 -date: '2021-10-05' +version: 7 +date: '2022-01-18' author: David Dorsey, Michael Haag, Splunk type: Hunting datamodel: @@ -37,10 +37,12 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 - https://ss64.com/ps/powershell.html - https://twitter.com/M_haggis/status/1440758396534214658?s=20 +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Malicious PowerShell - NOBELIUM Group + - WhisperGate asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 2cd03644c4..5edadd08ce 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -1,7 +1,7 @@ name: Suspicious Process DNS Query Known Abuse Web Services id: 3cf0dc36-484d-11ec-a6bc-acde48001122 -version: 1 -date: '2021-11-18' +version: 2 +date: '2022-01-18' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -25,9 +25,11 @@ known_false_positives: Noise and false positive can be seen if the following ins needed. references: - https://urlhaus.abuse.ch/url/1798923/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Remcos + - WhisperGate automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml new file mode 100644 index 0000000000..e7480f59ca --- /dev/null +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -0,0 +1,84 @@ +name: Windows DotNet Binary in Non Standard Path +id: fddf3b56-7933-11ec-98a6-acde48001122 +version: 1 +date: '2022-01-19' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a lookup and compares the process name and original file name (internal name). + The analytic utilizes a lookup with the is_net_windows_file macro to identify the binary process name and original file name. if one or the other matches an alert will be generated. + Adversaries abuse these binaries as they are native to windows and native DotNet. Note that not all SDK (post install of Windows) are captured in the lookup. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `is_net_windows_file` + | `windows_dotnet_binary_in_non_standard_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml + - https://attack.mitre.org/techniques/T1036/003/ + - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Masquerading - Rename System Utilities + - Unusual Processes + - Ransomware + - Signed Binary Proxy Execution InstallUtil + - WhisperGate + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1036 + - T1036.003 + - T1218 + - T1218.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log + automated_detection_testing: passed \ No newline at end of file diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml new file mode 100644 index 0000000000..44c24e0eed --- /dev/null +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -0,0 +1,81 @@ +name: Windows InstallUtil in Non Standard Path +id: dcf74b22-7933-11ec-857c-acde48001122 +version: 1 +date: '2022-01-19' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location. The analytic utilizes a macro for InstallUtil and identifies both the process_name and original_file_name. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_installutil_in_non_standard_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml + - https://attack.mitre.org/techniques/T1036/003/ + - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Masquerading - Rename System Utilities + - Unusual Processes + - Ransomware + - Signed Binary Proxy Execution InstallUtil + - WhisperGate + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1036 + - T1036.003 + - T1218 + - T1218.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log + automated_detection_testing: passed \ No newline at end of file diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml new file mode 100644 index 0000000000..bf33828abe --- /dev/null +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -0,0 +1,77 @@ +name: Windows NirSoft AdvancedRun +id: bb4f3090-7ae4-11ec-897f-acde48001122 +version: 1 +date: '2022-01-21' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec. AdvancedRun may also ingest a configuration file with all settings defined and perform its activity. + The analytic is written in a way to identify a renamed binary and also the common command-line arguments. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=advancedrun.exe OR Processes.original_file_name=advancedrun.exe) + Processes.process IN ("*EXEFilename*","*/cfg*","*RunAs*", "*WindowState*") by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `windows_nirsoft_advancedrun_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited as it is specific to AdvancedRun. Filter as needed based on legitimate usage. +references: + - http://www.nirsoft.net/utils/advanced_run.html + - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +tags: + analytic_story: + - Unusual Processes + - Ransomware + - WhisperGate + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1588.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 60 + confidence: 100 + # (impact * confidence)/100 + risk_score: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log + automated_detection_testing: passed \ No newline at end of file diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml new file mode 100644 index 0000000000..d2d81d96b4 --- /dev/null +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -0,0 +1,74 @@ +name: Windows NirSoft Utilities +id: 5b2f4596-7d4c-11ec-88a7-acde48001122 +version: 1 +date: '2022-01-24' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic assists with identifying the proces execution of commonly used utilities from NirSoft. Potentially not adversary behavior, but worth identifying to know if the software is present and being used. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `is_nirsoft_software` + | `windows_nirsoft_utilities_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present. Filtering may be required before setting to alert. +references: + - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A + - http://www.nirsoft.net/ + - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +tags: + analytic_story: + - WhisperGate + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1588.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log + automated_detection_testing: passed \ No newline at end of file diff --git a/lookups/is_net_windows_file.csv b/lookups/is_net_windows_file.csv new file mode 100644 index 0000000000..4c21dbd007 --- /dev/null +++ b/lookups/is_net_windows_file.csv @@ -0,0 +1,47 @@ +filename,originalFileName,netFile +MSBuild.exe,MSBuild.exe,True +ComSvcConfig.exe,ComSvcConfig.exe,True +DfsrAdmin.exe,DfsrAdmin.exe,True +dfsvc.exe,dfsvc.exe,True +Microsoft.Workflow.Compiler.exe,Microsoft.Workflow.Compiler.exe,True +SMSvcHost.exe,SMSvcHost.exe,True +WsatConfig.exe,WsatConfig.exe,True +AddInProcess.exe,AddInProcess.exe,True +AddInProcess32.exe,AddInProcess32.exe,True +AddInUtil.exe,AddInUtil.exe,True +aspnet_compiler.exe,aspnet_compiler.exe,True +aspnet_regbrowsers.exe,aspnet_regbrowsers.exe,True +aspnet_regsql.exe,aspnet_regsql.exe,True +CasPol.exe,CasPol.exe,True +DataSvcUtil.exe,DataSvcUtil.exe,True +EdmGen.exe,EdmGen.exe,True +InstallUtil.exe,InstallUtil.exe,True +jsc.exe,jsc.exe,True +ngentask.exe,ngentask.exe,True +ngen.exe,ngen.exe,True +RegAsm.exe,RegAsm.exe,True +RegSvcs.exe,RegSvcs.exe,True +SDNBR.exe,SDNBR.exe,True +acu.exe,acu.exe,True +AppVStreamingUX.exe,,True +dsac.exe,dsac.exe,True +LbfoAdmin.exe,LBFOADMIN.EXE,True +Microsoft.Uev.SyncController.exe,Microsoft.Uev.SyncController.exe,True +mtedit.exe,mtedit.exe,True +ScriptRunner.exe,ScriptRunner.exe,True +ServerManager.exe,servermanager.dll,True +stordiag.exe,stordiag.exe,True +storeadm.exe,storeadm.exe,True +tzsync.exe,tzsync.exe,True +UevAgentPolicyGenerator.exe,UevAgentPolicyGenerator.exe,True +UevAppMonitor.exe,UevAppMonitor.exe,True +UevTemplateBaselineGenerator.exe,UevTemplateBaselineGenerator.exe,True +UevTemplateConfigItemGenerator.exe,UevTemplateConfigItemGenerator.exe,True +powershell_ise.exe,powershell_ise.EXE,True +iediagcmd.exe,IEDiagCmd.exe,True +XBox.TCUI.exe,XBox.TCUI.exe,True +Microsoft.ActiveDirectory.WebServices.exe,Microsoft.ActiveDirectory.WebServices.exe,True +iisual.exe,iisual.exe,True +FileHistory.exe,FileHistory.exe,True +SecureAssessmentBrowser.exe,SecureAssessmentBrowser.exe,True +aspnet_regiis.exe,aspnet_regiis.exe,True \ No newline at end of file diff --git a/lookups/is_net_windows_file.yml b/lookups/is_net_windows_file.yml new file mode 100644 index 0000000000..c7cc9e77ef --- /dev/null +++ b/lookups/is_net_windows_file.yml @@ -0,0 +1,6 @@ +default_match: 'false' +description: A full baseline of executable files in \Windows\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline. +filename: is_net_windows_file.csv +min_matches: 1 +name: is_net_windows_file +case_sensitive_match: 'false' \ No newline at end of file diff --git a/lookups/is_nirsoft_software.csv b/lookups/is_nirsoft_software.csv new file mode 100644 index 0000000000..8e2ad32430 --- /dev/null +++ b/lookups/is_nirsoft_software.csv @@ -0,0 +1,15 @@ +filename,nirsoftFile +AdvancedRun.exe,True +ChromePass.exe,True +CredHistView.exe,True +Dialupass.exe,True +iepv.exe,True +LostMyPassword.exe,True +mailpv.exe,True +mspass.exe,True +netpass.exe,True +PasswordFox.exe,True +PasswordHashesView.exe,True +PstPassword.exe,True +RegHiveBackup.exe,True +WebBrowserPassView.exe,True \ No newline at end of file diff --git a/lookups/is_nirsoft_software.yml b/lookups/is_nirsoft_software.yml new file mode 100644 index 0000000000..bc3d662349 --- /dev/null +++ b/lookups/is_nirsoft_software.yml @@ -0,0 +1,6 @@ +default_match: 'false' +description: A subset of utilities provided by NirSoft that may be used by adversaries. +filename: is_nirsoft_software.csv +min_matches: 1 +name: is_nirsoft_software +case_sensitive_match: 'false' \ No newline at end of file diff --git a/lookups/is_windows_system_file.yml b/lookups/is_windows_system_file.yml index d41c0a87dc..934f568bc7 100644 --- a/lookups/is_windows_system_file.yml +++ b/lookups/is_windows_system_file.yml @@ -3,3 +3,4 @@ description: A full baseline of executable files in Windows\System32 and Windows filename: is_windows_system_file.csv min_matches: 1 name: is_windows_system_file +case_sensitive_match: 'false' \ No newline at end of file diff --git a/macros/is_net_windows_file.yml b/macros/is_net_windows_file.yml new file mode 100644 index 0000000000..b7061bc6a0 --- /dev/null +++ b/macros/is_net_windows_file.yml @@ -0,0 +1,3 @@ +definition: lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true +description: This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11. +name: is_net_windows_file \ No newline at end of file diff --git a/macros/is_nirsoft_software.yml b/macros/is_nirsoft_software.yml new file mode 100644 index 0000000000..3c1f3cabfc --- /dev/null +++ b/macros/is_nirsoft_software.yml @@ -0,0 +1,3 @@ +definition: lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true +description: This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based. +name: is_nirsoft_software \ No newline at end of file diff --git a/tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml b/tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml new file mode 100644 index 0000000000..13eb9a4236 --- /dev/null +++ b/tests/endpoint/windows_dotnet_binary_in_non_standard_path.test.yml @@ -0,0 +1,12 @@ +name: Windows DotNet Binary in Non Standard Path Unit Test +tests: +- name: Windows DotNet Binary in Non Standard Path + file: endpoint/windows_dotnet_binary_in_non_standard_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_installutil_path.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_installutil_in_non_standard_path.test.yml b/tests/endpoint/windows_installutil_in_non_standard_path.test.yml new file mode 100644 index 0000000000..aab6dcf46c --- /dev/null +++ b/tests/endpoint/windows_installutil_in_non_standard_path.test.yml @@ -0,0 +1,12 @@ +name: Windows InstallUtil in Non Standard Path Unit Test +tests: +- name: Windows InstallUtil in Non Standard Path + file: endpoint/windows_installutil_in_non_standard_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_installutil_path.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_nirsoft_advancedrun.test.yml b/tests/endpoint/windows_nirsoft_advancedrun.test.yml new file mode 100644 index 0000000000..94a1827e21 --- /dev/null +++ b/tests/endpoint/windows_nirsoft_advancedrun.test.yml @@ -0,0 +1,12 @@ +name: Windows NirSoft AdvancedRun Unit Test +tests: +- name: Windows NirSoft AdvancedRun + file: endpoint/windows_nirsoft_advancedrun.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_nirsoft_utilities.test.yml b/tests/endpoint/windows_nirsoft_utilities.test.yml new file mode 100644 index 0000000000..8b709a49ce --- /dev/null +++ b/tests/endpoint/windows_nirsoft_utilities.test.yml @@ -0,0 +1,12 @@ +name: Windows NirSoft Utilities Unit Test +tests: +- name: Windows NirSoft Utilities + file: endpoint/windows_nirsoft_utilities.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file