From 6df7df2622e6b891738172f79fbdfc24506db485 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 19 Nov 2021 16:40:04 -0500 Subject: [PATCH 01/20] adding first detection --- ...ateral_movement_commandline_parameters.yml | 76 +++++++++++++++++++ ...l_movement_commandline_parameters.test.yml | 12 +++ 2 files changed, 88 insertions(+) create mode 100644 detections/endpoint/impacket_lateral_movement_commandline_parameters.yml create mode 100644 tests/endpoint/impacket_lateral_movement_commandline_parameters.test.yml diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml new file mode 100644 index 0000000000..0b44f484e3 --- /dev/null +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -0,0 +1,76 @@ +name: Impacket Lateral Movement Commandline Parameters +id: 8ce07472-496f-11ec-ab3b-3e22fbd008af +version: 1 +date: '2021-11-19' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the presence of suspicious commandline parameters + typically present when using Impacket tools. Impacket is a collection of python classes + meant to be used with Microsoft network protocols. There are multiple scripts that leverage impacket + libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` and `atexec.py` used to execute commands on remote endpoints. + By default, these scripts leverage administrative shares and hardcoded parameters that can be used as a signature to detect its use. + Red Teams and adversaries alike may leverage Impackets tools for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*" OR Processes.process= "*/c* 2>&1") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start + a process on remote systems for system administration or automation use cases. +references: +- https://attack.mitre.org/techniques/T1021/002/ +- https://attack.mitre.org/techniques/T1021/003/ +- https://attack.mitre.org/techniques/T1047/ +- https://attack.mitre.org/techniques/T1053/ +- https://attack.mitre.org/techniques/T1053/005 +- https://github.com/SecureAuthCorp/impacket +- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.002 + - T1021.003 + - T1047 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 70 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/impacket_lateral_movement_commandline_parameters.test.yml b/tests/endpoint/impacket_lateral_movement_commandline_parameters.test.yml new file mode 100644 index 0000000000..f709d110f8 --- /dev/null +++ b/tests/endpoint/impacket_lateral_movement_commandline_parameters.test.yml @@ -0,0 +1,12 @@ +name: Impacket Lateral Movement Commandline Parameters Unit Test +tests: +- name: Impacket Lateral Movement Commandline Parameters + file: endpoint/impacket_lateral_movement_commandline_parameters.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From afc5bf9a9aa9d6c77b8cb04cbd9105186c30def2 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 19 Nov 2021 22:16:55 +0000 Subject: [PATCH 02/20] Added detection testing service results inImpacket Lateral Movement Commandline Parameters --- ...ateral_movement_commandline_parameters.yml | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 0b44f484e3..a6a80d99ab 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -7,21 +7,25 @@ type: TTP datamodel: - Endpoint description: This analytic looks for the presence of suspicious commandline parameters - typically present when using Impacket tools. Impacket is a collection of python classes - meant to be used with Microsoft network protocols. There are multiple scripts that leverage impacket - libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` and `atexec.py` used to execute commands on remote endpoints. - By default, these scripts leverage administrative shares and hardcoded parameters that can be used as a signature to detect its use. - Red Teams and adversaries alike may leverage Impackets tools for lateral movement and remote code execution. + typically present when using Impacket tools. Impacket is a collection of python + classes meant to be used with Microsoft network protocols. There are multiple scripts + that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` + and `atexec.py` used to execute commands on remote endpoints. By default, these + scripts leverage administrative shares and hardcoded parameters that can be used + as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets + tools for lateral movement and remote code execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*" OR Processes.process= "*/c* 2>&1") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*" + OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `impacket_lateral_movement_commandline_parameters_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start - a process on remote systems for system administration or automation use cases. +known_false_positives: Although uncommon, Administrators may leverage Impackets tools + to start a process on remote systems for system administration or automation use + cases. references: - https://attack.mitre.org/techniques/T1021/002/ - https://attack.mitre.org/techniques/T1021/003/ @@ -67,10 +71,11 @@ tags: context: - Source:Endpoint - Stage:Lateral Movement - message: Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools + message: Suspicious command line parameters on $dest may represent a lateral movement + attack with Impackets tools observable: - name: dest type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 8c2baf103e0ef872cb921f04576daa0c7f8ca750 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 22 Nov 2021 16:21:43 -0500 Subject: [PATCH 03/20] creating an extra detection --- ..._created_with_suspicious_service_path.yml} | 26 +++++--- ...ows_service_created_within_public_path.yml | 63 +++++++++++++++++++ ...ted_with_suspicious_service_path.test.yml} | 6 +- ...ervice_created_within_public_path.test.yml | 12 ++++ 4 files changed, 94 insertions(+), 13 deletions(-) rename detections/endpoint/{create_service_in_suspicious_file_path.yml => windows_service_created_with_suspicious_service_path.yml} (64%) create mode 100644 detections/endpoint/windows_service_created_within_public_path.yml rename tests/endpoint/{create_service_in_suspicious_file_path.test.yml => windows_service_created_with_suspicious_service_path.test.yml} (62%) create mode 100644 tests/endpoint/windows_service_created_within_public_path.test.yml diff --git a/detections/endpoint/create_service_in_suspicious_file_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml similarity index 64% rename from detections/endpoint/create_service_in_suspicious_file_path.yml rename to detections/endpoint/windows_service_created_with_suspicious_service_path.yml index fc021d10ca..20277b8dc4 100644 --- a/detections/endpoint/create_service_in_suspicious_file_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,40 +1,46 @@ -name: Create Service In Suspicious File Path +name: Windows Service Created With Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: 1 -date: '2021-03-12' -author: Teoderick Contreras +version: 2 +date: '2021-11-22' +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This detection is to identify a creation of "user mode service" where - the service file path is located in non-common service folder in windows. +description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, + to identify the creation of a Windows Service where the service binary path path is located in + a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious + Services for lateral movement or remote code execution as well as persistence and execution. + The Clop ransomware has also been seen in the wild abusing Windows services. search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) - Service_Type = "user mode service" | stats count min(_time) as firstTime max(_time) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_service_in_suspicious_file_path_filter`' + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -known_false_positives: unknown +known_false_positives: Legitimate applications may install services with uncommon services paths. references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: analytic_story: - Clop Ransomware + - Lateral Movement automated_detection_testing: passed confidence: 80 context: - Source:Endpoint - Stage:Privilege Escalation + - Stage:Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log impact: 70 kill_chain_phases: - Privilege Escalation + - Lateral Movement message: A service $Service_File_Name$ was created from a non-standard path using - $Service_Name$, potentially leading to a privilege escalation. + $Service_Name$ mitre_attack_id: - T1569 - T1569.002 diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml new file mode 100644 index 0000000000..655d64db70 --- /dev/null +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -0,0 +1,63 @@ +name: Windows Service Created Within Public Path +id: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af +version: 1 +date: '2021-11-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, + to identify the creation of a Windows Service where the service binary path is located + in public paths. This behavior could represent the installation of a malicious service. + Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution +search: '`wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name + IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) + | stats count min(_time) as firstTime max(_time) + as lastTime by ComputerName EventCode Service_File_Name Service_Name Service_Start_Type Service_Type + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_within_public_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: Legitimate applications may install services with uncommon services paths. +references: +- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager +- https://pentestlab.blog/2020/07/21/lateral-movement-services/ +tags: + analytic_story: + - Lateral Movement + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1543 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - Service_File_Name + - Service_Type + - _time + - Service_Name + - Service_Start_Type + security_domain: endpoint + impact: 90 + confidence: 60 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A Windows Service $Service_File_Name$ with a public path was created on $ComputerName + observable: + - name: Service_File_Name + type: Other + role: + - Other + - name: ComputerName + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/create_service_in_suspicious_file_path.test.yml b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml similarity index 62% rename from tests/endpoint/create_service_in_suspicious_file_path.test.yml rename to tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml index eba6df52b3..44d5779417 100644 --- a/tests/endpoint/create_service_in_suspicious_file_path.test.yml +++ b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml @@ -1,7 +1,7 @@ -name: Create Service In Suspicious File Path Unit Test +name: Windows Service Created With Suspicious Service Path Unit Test tests: -- name: Create Service In Suspicious File Path - file: endpoint/create_service_in_suspicious_file_path.yml +- name: Windows Service Created With Suspicious Service Path + file: endpoint/windows_service_created_with_suspicious_service_path.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/windows_service_created_within_public_path.test.yml b/tests/endpoint/windows_service_created_within_public_path.test.yml new file mode 100644 index 0000000000..716ea0eaf7 --- /dev/null +++ b/tests/endpoint/windows_service_created_within_public_path.test.yml @@ -0,0 +1,12 @@ +name: Windows Service Created Within Public Path Unit Test +tests: +- name: Windows Service Created Within Public Path + file: endpoint/windows_service_created_within_public_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/techniques/ + source: WinEventLog:System + sourcetype: WinEventLog \ No newline at end of file From 9b944b67a2f06806983a7513c7d66f0744d799f0 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 10:13:07 -0500 Subject: [PATCH 04/20] adding 4 new detections --- ...ces_exe_lolbas_execution_process_spawn.yml | 43 +++++++++++++++++++ ...ost_exe_lolbas_execution_process_spawn.yml | 43 +++++++++++++++++++ ...ows_service_created_within_public_path.yml | 2 +- ...sve_exe_lolbas_execution_process_spawn.yml | 42 ++++++++++++++++++ ...ost_exe_lolbas_execution_process_spawn.yml | 43 +++++++++++++++++++ ...xe_lolbas_execution_process_spawn.test.yml | 12 ++++++ ...xe_lolbas_execution_process_spawn.test.yml | 12 ++++++ ...ervice_created_within_public_path.test.yml | 2 +- ...xe_lolbas_execution_process_spawn.test.yml | 12 ++++++ ...xe_lolbas_execution_process_spawn.test.yml | 12 ++++++ 10 files changed, 221 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/services_exe_lolbas_execution_process_spawn.yml create mode 100644 detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml create mode 100644 detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml create mode 100644 detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml create mode 100644 tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml create mode 100644 tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml create mode 100644 tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml create mode 100644 tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..3ea6a104d8 --- /dev/null +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -0,0 +1,43 @@ +name: Services.exe LOLBAS Execution Process Spawn +id: ba9e1954-4c04-11ec-8b74-3e22fbd008af +version: 1 +date: '2021-11-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| UPDATE_SPL | `services_exe_lolbas_execution_process_spawn_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1543 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..9db5ca346e --- /dev/null +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -0,0 +1,43 @@ +name: Svchost.exe LOLBAS Execution Process Spawn +id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af +version: 1 +date: '2021-11-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| UPDATE_SPL | `svchost_exe_lolbas_execution_process_spawn_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1053 + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index 655d64db70..373d29e98b 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -26,7 +26,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_suspicious_path/windows-system.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..41572f15ff --- /dev/null +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -0,0 +1,42 @@ +name: Wmiprsve.exe LOLBAS Execution Process Spawn +id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af +version: 1 +date: '2021-11-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| UPDATE_SPL | `wmiprsve_exe_lolbas_execution_process_spawn_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1047 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..21b5d9e164 --- /dev/null +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -0,0 +1,43 @@ +name: Wsmprovhost.exe LOLBAS Execution Process Spawn +id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af +version: 1 +date: '2021-11-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| UPDATE_SPL | `wsmprovhost_exe_lolbas_execution_process_spawn_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.006 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml new file mode 100644 index 0000000000..d8e27f4523 --- /dev/null +++ b/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml @@ -0,0 +1,12 @@ +name: Services.exe LOLBAS Execution Process Spawn Unit Test +tests: +- name: Services.exe LOLBAS Execution Process Spawn + file: endpoint/services_exe_lolbas_execution_process_spawn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml new file mode 100644 index 0000000000..b106017bff --- /dev/null +++ b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml @@ -0,0 +1,12 @@ +name: Svchost.exe LOLBAS Execution Process Spawn Unit Test +tests: +- name: Svchost.exe LOLBAS Execution Process Spawn + file: endpoint/svchost_exe_lolbas_execution_process_spawn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/windows_service_created_within_public_path.test.yml b/tests/endpoint/windows_service_created_within_public_path.test.yml index 716ea0eaf7..4eb8ec138f 100644 --- a/tests/endpoint/windows_service_created_within_public_path.test.yml +++ b/tests/endpoint/windows_service_created_within_public_path.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-system.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/techniques/ + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_suspicious_path/windows-system.log source: WinEventLog:System sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml new file mode 100644 index 0000000000..328a21d894 --- /dev/null +++ b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml @@ -0,0 +1,12 @@ +name: Wmiprsve.exe LOLBAS Execution Process Spawn Unit Test +tests: +- name: Wmiprsve.exe LOLBAS Execution Process Spawn + file: endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml new file mode 100644 index 0000000000..2792b59d72 --- /dev/null +++ b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml @@ -0,0 +1,12 @@ +name: Wsmprovhost.exe LOLBAS Execution Process Spawn Unit Test +tests: +- name: Wsmprovhost.exe LOLBAS Execution Process Spawn + file: endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 4c696f9ad8f21e2a650dbeedfe45e9120da90843 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 14:01:28 -0500 Subject: [PATCH 05/20] updating detections --- ...mmc_exe_lolbas_execution_process_spawn.yml | 63 +++++++++++++++++++ ...ces_exe_lolbas_execution_process_spawn.yml | 54 +++++++++++----- ...ost_exe_lolbas_execution_process_spawn.yml | 52 ++++++++++----- ...sve_exe_lolbas_execution_process_spawn.yml | 52 ++++++++++----- ...ost_exe_lolbas_execution_process_spawn.yml | 52 ++++++++++----- ...xe_lolbas_execution_process_spawn.test.yml | 12 ++++ ...xe_lolbas_execution_process_spawn.test.yml | 2 +- ...xe_lolbas_execution_process_spawn.test.yml | 2 +- ...xe_lolbas_execution_process_spawn.test.yml | 2 +- ...xe_lolbas_execution_process_spawn.test.yml | 2 +- 10 files changed, 221 insertions(+), 72 deletions(-) create mode 100644 detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml create mode 100644 tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..80be6033a1 --- /dev/null +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -0,0 +1,63 @@ +name: Mmc LOLBAS Execution Process Spawn +id: f6601940-4c74-11ec-b9b7-3e22fbd008af +version: 1 +date: '2021-11-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. + When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 + COM object, the executed command is spawned as a child processs of `mmc.exe`. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to + perform tasks like executing malicious code. Looking for child processes of mmc.exe + that are part of the LOLBAS project can help defenders identify lateral movement activity. +search: '| UPDATE_SPL | `mmc_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as needed. +references: +- https://attack.mitre.org/techniques/T1021/003/ +- https://www.cybereason.com/blog/dcom-lateral-movement-techniques +- https://lolbas-project.github.io/ +tags: + analytic_story: + - Lateral Movement + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1021 + - T1021.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 60 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: Mmc.exe spawned a LOLBAS process on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index 3ea6a104d8..9c50e99be9 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -1,4 +1,4 @@ -name: Services.exe LOLBAS Execution Process Spawn +name: Services LOLBAS Execution Process Spawn id: ba9e1954-4c04-11ec-8b74-3e22fbd008af version: 1 date: '2021-11-22' @@ -6,19 +6,24 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| UPDATE_SPL | `services_exe_lolbas_execution_process_spawn_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: The following analytic identifies `services.exe` spawning a LOLBAS execution process. + When adversaries execute code on remote endpoints abusing the Service Control Manager and + creating a remote malicious service, the executed command is spawned as a child processs of `services.exe`. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to + perform tasks like executing malicious code. Looking for child processes of services.exe + that are part of the LOLBAS project can help defenders identify lateral movement activity. +search: '| UPDATE_SPL | `services_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: -- +- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1543.003 +- https://pentestlab.blog/2020/07/21/lateral-movement-services/ +- https://lolbas-project.github.io/ tags: analytic_story: - - UPDATE_STORY_NAME + - Lateral Movement dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -32,12 +37,27 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint - impact: - confidence: - # (impact * confidence)/100 - risk_score: + impact: 90 + confidence: 60 + risk_score: 54 context: - message: + - Source:Endpoint + - Stage:Lateral Movement + message: Services.exe spawned a LOLBAS process on $dest observable: - \ No newline at end of file + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index 9db5ca346e..c77688aa58 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -1,4 +1,4 @@ -name: Svchost.exe LOLBAS Execution Process Spawn +name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af version: 1 date: '2021-11-22' @@ -6,19 +6,22 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| UPDATE_SPL | `svchost_exe_lolbas_execution_process_spawn_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. + When adversaries execute code on remote endpoints abusing the Task Scheduler and + creating a malicious remote scheduled task, the executed command is spawned as a child processs of `svchost.exe`. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to + perform tasks like executing malicious code. Looking for child processes of svchost.exe + that are part of the LOLBAS project can help defenders identify lateral movement activity. +search: '| UPDATE_SPL | `svchost_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: -- +- https://lolbas-project.github.io/ tags: analytic_story: - - UPDATE_STORY_NAME + - Lateral Movement dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -32,12 +35,27 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint - impact: - confidence: - # (impact * confidence)/100 - risk_score: + impact: 90 + confidence: 60 + risk_score: 54 context: - message: + - Source:Endpoint + - Stage:Lateral Movement + message: Svchost.exe spawned a LOLBAS process on $dest observable: - \ No newline at end of file + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index 41572f15ff..d42c078ce6 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -1,4 +1,4 @@ -name: Wmiprsve.exe LOLBAS Execution Process Spawn +name: Wmiprsve LOLBAS Execution Process Spawn id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af version: 1 date: '2021-11-22' @@ -6,19 +6,22 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| UPDATE_SPL | `wmiprsve_exe_lolbas_execution_process_spawn_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. + When adversaries execute code on remote endpoints abusing Windows Management Instrumention (WMI), + the executed command is spawned as a child processs of `wmiprvse.exe`. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to + perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe + that are part of the LOLBAS project can help defenders identify lateral movement activity. +search: '| UPDATE_SPL | `wmiprsve_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: -- +- https://lolbas-project.github.io/ tags: analytic_story: - - UPDATE_STORY_NAME + - Lateral Movement dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -31,12 +34,27 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint - impact: - confidence: - # (impact * confidence)/100 - risk_score: + impact: 90 + confidence: 60 + risk_score: 54 context: - message: + - Source:Endpoint + - Stage:Lateral Movement + message: Wmiprsve.exe spawned a LOLBAS process on $dest observable: - \ No newline at end of file + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index 21b5d9e164..c461f666d6 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -1,4 +1,4 @@ -name: Wsmprovhost.exe LOLBAS Execution Process Spawn +name: Wsmprovhost LOLBAS Execution Process Spawn id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af version: 1 date: '2021-11-22' @@ -6,19 +6,22 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| UPDATE_SPL | `wsmprovhost_exe_lolbas_execution_process_spawn_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution process. + When adversaries execute code on remote endpoints abusing the Windows Remote Management (WinRm) + protocol, the executed command is spawned as a child processs of `Wsmprovhost.exe`. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to + perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe + that are part of the LOLBAS project can help defenders identify lateral movement activity. +search: '| UPDATE_SPL | `wsmprovhost_lolbas_execution_process_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: -- +- https://lolbas-project.github.io/ tags: analytic_story: - - UPDATE_STORY_NAME + - Lateral Movement dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -32,12 +35,27 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint - impact: - confidence: - # (impact * confidence)/100 - risk_score: + impact: 90 + confidence: 60 + risk_score: 54 context: - message: + - Source:Endpoint + - Stage:Lateral Movement + message: Wsmprovhost.exe spawned a LOLBAS process on $dest observable: - \ No newline at end of file + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml new file mode 100644 index 0000000000..3046557b1a --- /dev/null +++ b/tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml @@ -0,0 +1,12 @@ +name: Mmc EXE LOLBAS Execution Process Spawn Unit Test +tests: +- name: Mmc.exe LOLBAS Execution Process Spawn + file: endpoint/mmc_exe_lolbas_execution_process_spawn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml index d8e27f4523..1dd568a769 100644 --- a/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml @@ -1,4 +1,4 @@ -name: Services.exe LOLBAS Execution Process Spawn Unit Test +name: Services LOLBAS Execution Process Spawn Unit Test tests: - name: Services.exe LOLBAS Execution Process Spawn file: endpoint/services_exe_lolbas_execution_process_spawn.yml diff --git a/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml index b106017bff..dfc9a8d753 100644 --- a/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml @@ -1,4 +1,4 @@ -name: Svchost.exe LOLBAS Execution Process Spawn Unit Test +name: Svchost LOLBAS Execution Process Spawn Unit Test tests: - name: Svchost.exe LOLBAS Execution Process Spawn file: endpoint/svchost_exe_lolbas_execution_process_spawn.yml diff --git a/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml index 328a21d894..d8493fca80 100644 --- a/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml @@ -1,4 +1,4 @@ -name: Wmiprsve.exe LOLBAS Execution Process Spawn Unit Test +name: Wmiprsve LOLBAS Execution Process Spawn Unit Test tests: - name: Wmiprsve.exe LOLBAS Execution Process Spawn file: endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml diff --git a/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml index 2792b59d72..8c4494d3bc 100644 --- a/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml @@ -1,4 +1,4 @@ -name: Wsmprovhost.exe LOLBAS Execution Process Spawn Unit Test +name: Wsmprovhost LOLBAS Execution Process Spawn Unit Test tests: - name: Wsmprovhost.exe LOLBAS Execution Process Spawn file: endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml From c8c731e449d32f38b2de6a024cd8549f41c33af9 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 23 Nov 2021 19:20:48 +0000 Subject: [PATCH 06/20] Added detection testing service results inWindows Service Created With Suspicious Service Path --- ...ce_created_with_suspicious_service_path.yml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 20277b8dc4..63dfff09af 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -7,19 +7,21 @@ type: TTP datamodel: - Endpoint description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, - to identify the creation of a Windows Service where the service binary path path is located in - a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious - Services for lateral movement or remote code execution as well as persistence and execution. - The Clop ransomware has also been seen in the wild abusing Windows services. + to identify the creation of a Windows Service where the service binary path path + is located in a non-common Service folder in Windows. Red Teams and adversaries + alike may create malicious Services for lateral movement or remote code execution + as well as persistence and execution. The Clop ransomware has also been seen in + the wild abusing Windows services. search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name + Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -known_false_positives: Legitimate applications may install services with uncommon services paths. +known_false_positives: Legitimate applications may install services with uncommon + services paths. references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html From 5211a97f11f8b2d8468bcc2344810b0cbdd28fa7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 16:00:04 -0500 Subject: [PATCH 07/20] update detections --- .../mmc_exe_lolbas_execution_process_spawn.yml | 15 ++++++++++++++- ...vices_exe_lolbas_execution_process_spawn.yml | 17 +++++++++++++++-- ...chost_exe_lolbas_execution_process_spawn.yml | 17 ++++++++++++++++- ...prsve_exe_lolbas_execution_process_spawn.yml | 17 ++++++++++++++++- ...vhost_exe_lolbas_execution_process_spawn.yml | 17 ++++++++++++++++- stories/lateral_movement.yml | 5 +++-- 6 files changed, 80 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index 80be6033a1..102ba04994 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -12,7 +12,20 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `mmc_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index 9c50e99be9..f3779cc136 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -12,13 +12,26 @@ description: The following analytic identifies `services.exe` spawning a LOLBAS The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `services_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=services.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: -- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1543.003 +- https://attack.mitre.org/techniques/T1543/003/ - https://pentestlab.blog/2020/07/21/lateral-movement-services/ - https://lolbas-project.github.io/ tags: diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index c77688aa58..e849074b07 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -12,12 +12,27 @@ description: The following analytic identifies `svchost.exe` spawning a LOLBAS e The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `svchost_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ired.team/offensive-security/persistence/t1053-schtask - https://lolbas-project.github.io/ tags: analytic_story: diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index d42c078ce6..190313322e 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -12,12 +12,27 @@ description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `wmiprsve_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: +- https://attack.mitre.org/techniques/T1047/ +- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement - https://lolbas-project.github.io/ tags: analytic_story: diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index c461f666d6..afb7353178 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -12,13 +12,28 @@ description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLB The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. -search: '| UPDATE_SPL | `wsmprovhost_lolbas_execution_process_spawn_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wsmprovhost.exe) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", + "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", + "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", + "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", + "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", + "Pcalua.exe", "Msconfig.exe")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. known_false_positives: Legitimate applications may trigger this behavior, filter as needed. references: +- https://attack.mitre.org/techniques/T1021/006/ - https://lolbas-project.github.io/ +- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - Lateral Movement diff --git a/stories/lateral_movement.yml b/stories/lateral_movement.yml index f5ac2aa14b..b245f947c7 100644 --- a/stories/lateral_movement.yml +++ b/stories/lateral_movement.yml @@ -1,8 +1,8 @@ name: Lateral Movement id: 399d65dc-1f08-499b-a259-aad9051f38ad version: 2 -date: '2020-02-04' -author: David Dorsey, Splunk +date: '2021-11-23' +author: David Dorsey, Mauricio Velazco Splunk description: Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. @@ -32,6 +32,7 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek \ for all processes to ensure that the attackers did not install unauthorized software." references: - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html +- https://www.youtube.com/watch?v=hVTkkkM9XDg tags: analytic_story: Lateral Movement category: From c2fd0a4b290862803695952182e0b73f64553081 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 17:15:06 -0500 Subject: [PATCH 08/20] adding dataset fields --- .../endpoint/mmc_exe_lolbas_execution_process_spawn.yml | 2 +- .../services_exe_lolbas_execution_process_spawn.yml | 2 +- .../mmc_exe_lolbas_execution_process_spawn.test.yml | 8 ++++---- .../services_exe_lolbas_execution_process_spawn.test.yml | 8 ++++---- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index 102ba04994..cddd9a56d0 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -38,7 +38,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: - Privilege Escalation mitre_attack_id: diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index f3779cc136..c7d792bd29 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -38,7 +38,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml index 3046557b1a..abbe6c30f8 100644 --- a/tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/mmc_exe_lolbas_execution_process_spawn.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml index 1dd568a769..aef94cf037 100644 --- a/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/services_exe_lolbas_execution_process_spawn.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 37f4a3264733dbc00f11503d349c7eaeb3534935 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 23 Nov 2021 22:39:17 +0000 Subject: [PATCH 09/20] Added detection testing service results inServices.exe LOLBAS Execution Process Spawn --- ...ces_exe_lolbas_execution_process_spawn.yml | 43 +++++++++++-------- 1 file changed, 24 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index c7d792bd29..3e5f40f6d6 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -6,30 +6,34 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies `services.exe` spawning a LOLBAS execution process. - When adversaries execute code on remote endpoints abusing the Service Control Manager and - creating a remote malicious service, the executed command is spawned as a child processs of `services.exe`. - The LOLBAS project documents Windows native binaries that can be abused by threat actors to - perform tasks like executing malicious code. Looking for child processes of services.exe - that are part of the LOLBAS project can help defenders identify lateral movement activity. +description: The following analytic identifies `services.exe` spawning a LOLBAS execution + process. When adversaries execute code on remote endpoints abusing the Service Control + Manager and creating a remote malicious service, the executed command is spawned + as a child processs of `services.exe`. The LOLBAS project documents Windows native + binaries that can be abused by threat actors to perform tasks like executing malicious + code. Looking for child processes of services.exe that are part of the LOLBAS project + can help defenders identify lateral movement activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=services.exe) - (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", - "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", - "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", - "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", - "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", - "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", - "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", - "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", - "Pcalua.exe", "Msconfig.exe")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", + "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", + "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", + "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", + "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", + "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", + "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", + "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as needed. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. references: - https://attack.mitre.org/techniques/T1543/003/ - https://pentestlab.blog/2020/07/21/lateral-movement-services/ @@ -73,4 +77,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From c13de25f73ac16491988974ede6713b1649749dd Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 18:42:48 -0500 Subject: [PATCH 10/20] update dataset metadata --- .../wmiprsve_exe_lolbas_execution_process_spawn.yml | 2 +- ...prsve_exe_lolbas_execution_process_spawn.test.yml | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index 190313322e..d15f02ffd2 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -38,7 +38,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml index d8493fca80..cf683a1dcb 100644 --- a/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml @@ -6,7 +6,11 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + + \ No newline at end of file From e7ad40a54b548d89479851450312fe2cd3e74e35 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 23 Nov 2021 23:52:08 +0000 Subject: [PATCH 11/20] Added detection testing service results inMmc.exe LOLBAS Execution Process Spawn --- ...mmc_exe_lolbas_execution_process_spawn.yml | 45 ++++++++++--------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index cddd9a56d0..a16660a08b 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -6,33 +6,37 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. - When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 - COM object, the executed command is spawned as a child processs of `mmc.exe`. - The LOLBAS project documents Windows native binaries that can be abused by threat actors to - perform tasks like executing malicious code. Looking for child processes of mmc.exe - that are part of the LOLBAS project can help defenders identify lateral movement activity. +description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution + process. When adversaries execute code on remote endpoints abusing the DCOM protocol + and the MMC20 COM object, the executed command is spawned as a child processs of + `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused + by threat actors to perform tasks like executing malicious code. Looking for child + processes of mmc.exe that are part of the LOLBAS project can help defenders identify + lateral movement activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe) - (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", - "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", - "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", - "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", - "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", - "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", - "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", - "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", - "Pcalua.exe", "Msconfig.exe")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", + "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", + "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", + "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", + "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", + "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", + "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", + "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as needed. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. references: - https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques +- https://www.cybereason.com/blog/dcom-lateral-movement-techniques - https://lolbas-project.github.io/ tags: analytic_story: @@ -73,4 +77,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 6c45a549e3979f2624907fca113c138784c07390 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 24 Nov 2021 00:03:25 +0000 Subject: [PATCH 12/20] Added detection testing service results inWmiprsve.exe LOLBAS Execution Process Spawn --- ...sve_exe_lolbas_execution_process_spawn.yml | 43 +++++++++++-------- 1 file changed, 24 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index d15f02ffd2..2eac23c4b6 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -6,30 +6,34 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. - When adversaries execute code on remote endpoints abusing Windows Management Instrumention (WMI), - the executed command is spawned as a child processs of `wmiprvse.exe`. - The LOLBAS project documents Windows native binaries that can be abused by threat actors to - perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe - that are part of the LOLBAS project can help defenders identify lateral movement activity. +description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution + process. When adversaries execute code on remote endpoints abusing Windows Management + Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`. + The LOLBAS project documents Windows native binaries that can be abused by threat + actors to perform tasks like executing malicious code. Looking for child processes + of wmiprvse.exe that are part of the LOLBAS project can help defenders identify + lateral movement activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe) - (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", - "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", - "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", - "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", - "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", - "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", - "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", - "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", - "Pcalua.exe", "Msconfig.exe")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", + "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", + "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", + "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", + "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", + "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", + "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", + "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as needed. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. references: - https://attack.mitre.org/techniques/T1047/ - https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement @@ -72,4 +76,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From ad273d4ca15eb74fe8a7daef3e90d54ef4729ff9 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 20:33:27 -0500 Subject: [PATCH 13/20] update datasets --- ...smprovhost_exe_lolbas_execution_process_spawn.yml | 2 +- ...vhost_exe_lolbas_execution_process_spawn.test.yml | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index afb7353178..aa346dc721 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -38,7 +38,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml index 8c4494d3bc..d768bfa805 100644 --- a/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml @@ -6,7 +6,11 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + + \ No newline at end of file From 9e165574c050f398705827e0a802c10592d6e017 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 24 Nov 2021 01:53:58 +0000 Subject: [PATCH 14/20] Added detection testing service results inWsmprovhost.exe LOLBAS Execution Process Spawn --- ...ost_exe_lolbas_execution_process_spawn.yml | 43 +++++++++++-------- 1 file changed, 24 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index aa346dc721..02b6c21895 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -6,30 +6,34 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution process. - When adversaries execute code on remote endpoints abusing the Windows Remote Management (WinRm) - protocol, the executed command is spawned as a child processs of `Wsmprovhost.exe`. - The LOLBAS project documents Windows native binaries that can be abused by threat actors to - perform tasks like executing malicious code. Looking for child processes of Wsmprovhost.exe - that are part of the LOLBAS project can help defenders identify lateral movement activity. +description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS + execution process. When adversaries execute code on remote endpoints abusing the + Windows Remote Management (WinRm) protocol, the executed command is spawned as a + child processs of `Wsmprovhost.exe`. The LOLBAS project documents Windows native + binaries that can be abused by threat actors to perform tasks like executing malicious + code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS + project can help defenders identify lateral movement activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wsmprovhost.exe) - (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", - "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", - "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", - "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", - "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", - "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", - "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", - "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", - "Pcalua.exe", "Msconfig.exe")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", + "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", + "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", + "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", + "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", + "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", + "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", + "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as needed. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. references: - https://attack.mitre.org/techniques/T1021/006/ - https://lolbas-project.github.io/ @@ -73,4 +77,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 33e959730470b7f32729e18113bfe4a8d6ad0084 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Nov 2021 21:04:04 -0500 Subject: [PATCH 15/20] updating logic and adding datasets --- ...ost_exe_lolbas_execution_process_spawn.yml | 22 ++++++++++--------- ...xe_lolbas_execution_process_spawn.test.yml | 8 +++---- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index e849074b07..44d96c157f 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -14,15 +14,17 @@ description: The following analytic identifies `svchost.exe` spawning a LOLBAS e that are part of the LOLBAS project can help defenders identify lateral movement activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe) - (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", - "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", - "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", - "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", - "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", - "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", - "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", - "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", - "Pcalua.exe", "Msconfig.exe")) + (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", + "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", + "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", + "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", + "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", + "SettingSyncHost.exe", "Cmstp.exe", "Stordiag.exe", "Scriptrunner.exe", + "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", + "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Regsvr32.exe", "Msiexec.exe", + "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", + "Verclsid.exe", "Infdefaultinstall.exe", "Installutil.exe", "Netsh.exe", + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`' @@ -38,7 +40,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml index dfc9a8d753..69d85a6839 100644 --- a/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 42913444c4a46ad94fdbb9b8d7e51861794ba06d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 24 Nov 2021 09:37:47 -0500 Subject: [PATCH 16/20] update dataset location --- .../endpoint/svchost_exe_lolbas_execution_process_spawn.yml | 2 +- .../svchost_exe_lolbas_execution_process_spawn.test.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index 44d96c157f..a6574519ff 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -40,7 +40,7 @@ tags: analytic_story: - Lateral Movement dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml index 69d85a6839..ca7f00c14b 100644 --- a/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml +++ b/tests/endpoint/svchost_exe_lolbas_execution_process_spawn.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file From 9f122d542c6c4942c9ea2106a3f074a0506366ec Mon Sep 17 00:00:00 2001 From: root Date: Wed, 24 Nov 2021 14:58:42 +0000 Subject: [PATCH 17/20] Added detection testing service results inSvchost.exe LOLBAS Execution Process Spawn --- ...ost_exe_lolbas_execution_process_spawn.yml | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index a6574519ff..64011402f9 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -6,35 +6,36 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. - When adversaries execute code on remote endpoints abusing the Task Scheduler and - creating a malicious remote scheduled task, the executed command is spawned as a child processs of `svchost.exe`. - The LOLBAS project documents Windows native binaries that can be abused by threat actors to - perform tasks like executing malicious code. Looking for child processes of svchost.exe - that are part of the LOLBAS project can help defenders identify lateral movement activity. +description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution + process. When adversaries execute code on remote endpoints abusing the Task Scheduler + and creating a malicious remote scheduled task, the executed command is spawned + as a child processs of `svchost.exe`. The LOLBAS project documents Windows native + binaries that can be abused by threat actors to perform tasks like executing malicious + code. Looking for child processes of svchost.exe that are part of the LOLBAS project + can help defenders identify lateral movement activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", - "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", - "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", - "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", - "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", - "SettingSyncHost.exe", "Cmstp.exe", "Stordiag.exe", "Scriptrunner.exe", - "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", - "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Regsvr32.exe", "Msiexec.exe", - "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", - "Verclsid.exe", "Infdefaultinstall.exe", "Installutil.exe", "Netsh.exe", - "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name + "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", + "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", + "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", + "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", + "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", + "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", + "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", + "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", + "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", + "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as needed. +known_false_positives: Legitimate applications may trigger this behavior, filter as + needed. references: - https://attack.mitre.org/techniques/T1053/005/ -- https://www.ired.team/offensive-security/persistence/t1053-schtask +- https://www.ired.team/offensive-security/persistence/t1053-schtask - https://lolbas-project.github.io/ tags: analytic_story: @@ -75,4 +76,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From ba111107f8c94edba22410814b557963864484ac Mon Sep 17 00:00:00 2001 From: root Date: Wed, 24 Nov 2021 15:24:21 +0000 Subject: [PATCH 18/20] Added detection testing service results inWindows Service Created Within Public Path --- ...ows_service_created_within_public_path.yml | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index 373d29e98b..c1e2ac529a 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -9,19 +9,21 @@ datamodel: description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path is located in public paths. This behavior could represent the installation of a malicious service. - Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution + Red Teams and adversaries alike may create malicious Services for lateral movement + or remote code execution search: '`wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) - as lastTime by ComputerName EventCode Service_File_Name Service_Name Service_Start_Type Service_Type - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_within_public_path_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode + Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_created_within_public_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -known_false_positives: Legitimate applications may install services with uncommon services paths. +known_false_positives: Legitimate applications may install services with uncommon + services paths. references: - https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager -- https://pentestlab.blog/2020/07/21/lateral-movement-services/ +- https://pentestlab.blog/2020/07/21/lateral-movement-services/ tags: analytic_story: - Lateral Movement @@ -45,12 +47,13 @@ tags: - Service_Start_Type security_domain: endpoint impact: 90 - confidence: 60 + confidence: 60 risk_score: 54 context: - Source:Endpoint - Stage:Lateral Movement - message: A Windows Service $Service_File_Name$ with a public path was created on $ComputerName + message: A Windows Service $Service_File_Name$ with a public path was created on + $ComputerName observable: - name: Service_File_Name type: Other @@ -60,4 +63,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 097683ffbb02f7f88fe2b5596616bfa408dd6772 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 24 Nov 2021 10:07:35 -0700 Subject: [PATCH 19/20] Update wmiprsve_exe_lolbas_execution_process_spawn.yml --- .../endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index 2eac23c4b6..98696cc301 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -71,7 +71,7 @@ tags: context: - Source:Endpoint - Stage:Lateral Movement - message: Wmiprsve.exe spawned a LOLBAS process on $dest + message: Wmiprsve.exe spawned a LOLBAS process on $dest$. observable: - name: dest type: Endpoint From 144b6971d27baf34cbebf2cab5d4e957d388f3d7 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 24 Nov 2021 10:08:13 -0700 Subject: [PATCH 20/20] Update wsmprovhost_exe_lolbas_execution_process_spawn.yml --- .../endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index 02b6c21895..9713a3fb68 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -72,7 +72,7 @@ tags: context: - Source:Endpoint - Stage:Lateral Movement - message: Wsmprovhost.exe spawned a LOLBAS process on $dest + message: Wsmprovhost.exe spawned a LOLBAS process on $dest$. observable: - name: dest type: Endpoint