diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 51081a8e89..6b107836ed 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -37,6 +37,7 @@ class DetectionTags(BaseModel): risk_level: str = None observable_str: str = None kill_chain_phases_id: list = None + research_site_url: str = None @validator('cis20') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 52f382511b..bda2fb25d6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -14,6 +14,7 @@ class ObjToYmlAdapter(Adapter): def writeObjectsInPlace(self, objects: list) -> None: for object in objects: + file_path = object['file_path'] object.pop('file_path') object.pop('deprecated') @@ -28,6 +29,11 @@ class ObjToYmlAdapter(Adapter): file_path = os.path.join(output_path, 'complex', file_name) else: file_path = os.path.join(output_path, 'srs', file_name) + + # add research object + RESEARCH_SITE_BASE = 'https://research.splunk.com/' + research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/" + obj.tags.research_site_url = research_site_url body = FindingReportObject.writeFindingReport(obj) @@ -53,7 +59,8 @@ class ObjToYmlAdapter(Adapter): "risk_severity": True, "risk_score": True, "security_domain": True, - "required_fields": True + "required_fields": True, + "research_site_url": True }, "test": { @@ -86,7 +93,6 @@ class ObjToYmlAdapter(Adapter): f.write(data) f.close() - def writeObjectNewContent(self, object: dict, type: SecurityContentType) -> None: if type == SecurityContentType.detections: file_path = os.path.join(self.input_path, 'detections', object['source'], self.convertNameToFileName(object['name'],object['tags']['product'])) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml index d5123ab61a..2098cad653 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -53,6 +53,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml index d5123ab61a..2098cad653 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -53,6 +53,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index 10f7109acd..8b3402e2e1 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk type: Anomaly datamodel: [] description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance. -search: '| `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time +search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time | where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment. known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time. @@ -57,4 +57,4 @@ tags: - sourceIPAddress - awsRegion risk_score: 49 - security_domain: threat \ No newline at end of file + security_domain: threat diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml new file mode 100644 index 0000000000..a0f226f099 --- /dev/null +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux AWK Privilege Escalation +id: 4510cae0-96a2-4840-9919-91d262db210a +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Awk is mostly used for processing and scanning patterns. + It checks one or more files to determine whether any lines fit the specified patterns, + and if so, it does the appropriate action. If sudo right is given to AWK binary for the user, then the user + can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*" AND Processes.process="*awk*" AND Processes.process="*BEGIN*system*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://www.hacknos.com/awk-privilege-escalation/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml new file mode 100644 index 0000000000..f3bcadd123 --- /dev/null +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -0,0 +1,81 @@ +name: Linux Curl Upload File +id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies curl being utilized with the -F or --form, --upload-file, -T, -d, --data, --data-raw, -I and --head switches to upload AWS credentials or config to a remote destination. + This enables uploading of binary files and so forth. To force the 'content' part to be a file, prefix the file name with an @ sign. To just get the content part from a file, prefix the file name with the symbol <. The difference between @ and < is then that @ makes a file get attached in the post as a file upload, while the < makes a text field and just get the contents for that text field from a file. + This technique was utlized by the TeamTNT group to exfiltrate AWS credentials. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl + Processes.process IN ("*-F *", "*--form *","*--upload-file *","*-T *","*-d *","*--data *","*--data-raw *", "*-I *", "*--head *") AND Processes.process IN ("*.aws/credentials*". "*.aws/config*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_curl_upload_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Filtering may be required. In addition to AWS credentials, add other important files and monitor. The inverse would be to look for _all_ -F behavior and tune from there. +references: + - https://curl.se/docs/manpage.html + - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ + - https://gtfobins.github.io/gtfobins/curl/ +tags: + analytic_story: + - Linux Living Off The Land + - Data Exfiltration + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination. + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml new file mode 100644 index 0000000000..0978880cdf --- /dev/null +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux Docker Privilege Escalation +id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Docker is an open source containerization platform. It helps programmers to bundle applications into containers, + which are standardized executable parts that include the application source code along with the OS libraries and dependencies needed to run + that code in any setting. The user can add mount the root directory into a container and edit the /etc/password file to add a super user. + This requires the user to be privileged enough to run docker, i.e. being in the docker group or being root. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process IN("*docker*-v*/*:*","*docker*--volume*/*:*") OR Processes.process IN("*docker*exec*sh*","*docker*exec*bash*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/docker/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 24 + security_domain: endpoint diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml new file mode 100644 index 0000000000..2883bb7b68 --- /dev/null +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -0,0 +1,80 @@ +name: Linux Ingress Tool Transfer Hunting +id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic hunts for curl and wget being utilized in the environment. This is meant to help with identifying normal usage and potentially malicious. Utilize this query to tune other curl and wget analytics. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=curl OR Processes.process_name=wget) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_ingress_tool_transfer_hunting_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be present. This query is meant to help tune other curl and wget analytics. +references: + - https://gtfobins.github.io/gtfobins/curl/ + - https://curl.se/docs/manpage.html#-I + - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/rapid7/metasploit-framework/search?q=curl +tags: + analytic_story: + - Linux Living Off The Land + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 10 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 10 + kill_chain_phases: + - Delivery + - Installation + - Actions on Objectives + message: An instance of $process_name$ was identified + on endpoint $dest$ by user $user$ utilizing curl or wget. + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 1 + security_domain: endpoint diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml new file mode 100644 index 0000000000..7a8f04c92a --- /dev/null +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -0,0 +1,82 @@ +name: Linux Ingress Tool Transfer with Curl +id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies curl with the command-line switches that are commonly used to download, output, a remote script or binary. + MetaSploit Framework will combine the -sO switch with | chmod +x to enable a simple one liner to download and set the execute bit to run the file immediately. + During triage, review the remote domain and file being downloaded for legitimacy. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where match(process, "(?i)(-O|-sO|-ksO|--output)") + | `linux_ingress_tool_transfer_with_curl_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be present. Tune and then change type to TTP. +references: + - https://gtfobins.github.io/gtfobins/curl/ + - https://curl.se/docs/manpage.html#-I + - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/rapid7/metasploit-framework/search?q=curl +tags: + analytic_story: + - Linux Living Off The Land + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 40 + kill_chain_phases: + - Delivery + message: An instance of $process_name$ was identified + on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details. + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 12 + security_domain: endpoint diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml new file mode 100644 index 0000000000..8aacf88865 --- /dev/null +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux Node Privilege Escalation +id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Node.js is a back-end JavaScript runtime environment that is open-source, cross-platform, runs on the V8 engine, + and executes JavaScript code outside of a web browser. It was created to help create scalable network applications. + If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, + escalate or maintain privileged access. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*node*" AND Processes.process="*-e*" AND Processes.process="*child_process.spawn*" AND Processes.process="*stdio*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/docker/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml new file mode 100644 index 0000000000..202091a466 --- /dev/null +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -0,0 +1,84 @@ +name: Linux Proxy Socks Curl +id: bd596c22-ad1e-44fc-b242-817253ce8b08 +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies curl being utilized with a proxy based on command-line arguments - -x, socks, --preproxy and --proxy. This behavior is built into the MetaSploit Framework as a auxiliary module. What does socks buy an adversary? + SOCKS4a extends the SOCKS4 protocol to allow a client to specify a destination domain name rather than an IP address. + The SOCKS5 protocol is defined in RFC 1928. It is an incompatible extension of the SOCKS4 protocol; it offers more choices for authentication and adds support for IPv6 and UDP, the latter of which can be used for DNS lookups. + The protocols, and a proxy itself, allow an adversary to evade controls in place monitoring traffic, making it harder for the defender to identify and track activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl + Processes.process IN ("*-x *", "*socks4a://*", "*socks5h://*", "*socks4://*","*socks5://*", "*--preproxy *", "--proxy*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_proxy_socks_curl_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present based on proxy usage internally. Filter as needed. +references: + - https://www.offensive-security.com/metasploit-unleashed/proxytunnels/ + - https://curl.se/docs/manpage.html + - https://en.wikipedia.org/wiki/SOCKS + - https://oxylabs.io/blog/curl-with-proxy + - https://reqbin.com/req/c-ddxflki5/curl-proxy-server#:~:text=To%20use%20a%20proxy%20with,be%20URL%20decoded%20by%20Curl. + - https://gtfobins.github.io/gtfobins/curl/ +tags: + analytic_story: + - Linux Living Off The Land + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 70 + kill_chain_phases: + - Delivery + message: An instance of $process_name$ was identified + on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details. + mitre_attack_id: + - T1090 + - T1095 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 56 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index cc5a66a67f..4ef0b987f3 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -32,6 +32,7 @@ tags: - Windows Persistence Techniques - Living Off The Land - Azorult + - DarkCrystal RAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 2b5dad1423..0e7ba9a82f 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -33,6 +33,7 @@ tags: - Windows Persistence Techniques - Living Off The Land - Azorult + - DarkCrystal RAT confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index d6580aab96..5bfdf515aa 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -6,27 +6,24 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies DCRat "forkbomb" payload feature. This - technique was seen in dark crystal RAT backdoor capabilities where it will execute - several cmd child process executing "notepad.exe & pause". This analytic detects - the multiple cmd.exe and child process notepad.exe execution using batch script - in the targeted host within 30s timeframe. this TTP can be a good pivot to check - DCRat infection. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.parent_process) as parent_process values(Processes.parent_process_id) - as parent_process_id values(Processes.process_id) as process_id dc(Processes.parent_process_id) - as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) - as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name= - "cmd.exe" (Processes.process_name = "notepad.exe" OR Processes.original_file_name= - "notepad.exe") Processes.parent_process = "*.bat*" by Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.parent_process Processes.dest - Processes.user _time span=30s | where parent_process_id_count>= 10 AND process_id_count - >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `windows_command_shell_dcrat_forkbomb_payload_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +description: The following analytic identifies DCRat "forkbomb" payload feature. + This technique was seen in dark crystal RAT backdoor capabilities where it will execute several cmd child process + executing "notepad.exe & pause". This analytic detects the multiple cmd.exe and child process notepad.exe execution using batch script + in the targeted host within 30s timeframe. this TTP can be a good pivot to check DCRat infection. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.parent_process_id) as parent_process_id values(Processes.process_id) as process_id dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" OR Processes.original_file_name= "notepad.exe") Processes.parent_process = "*.bat*" + by Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.parent_process Processes.dest Processes.user _time + span=30s | where parent_process_id_count>= 10 AND process_id_count >=10 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_command_shell_dcrat_forkbomb_payload_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: unknown references: - https://cert.gov.ua/article/405538 diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml new file mode 100644 index 0000000000..9f979a5927 --- /dev/null +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -0,0 +1,84 @@ +name: Windows DLL Search Order Hijacking with iscsicpl +id: f39ee679-3b1e-4f47-841c-5c3c580acda2 +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a recently disclosed search ordler DLL hijack in iscsicpl.exe. The malicious DLL must be in a new path and iscsicpl.exe, upon load, will execute the payload. The analytic is restricted to Windows shells. + Two proof of concepts were identified and utilized to determine the behavior. The command-line is an option to go after, but most likely identifying a child process off iscsicpl.exe will be more effective. Monitoring for suspicious DLL loads is also an option. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=iscsicpl.exe + `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `windows_dll_search_order_hijacking_with_iscsicpl_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe. +references: + - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC + - https://github.com/422926799/csplugin/tree/master/bypassUAC +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Inbound + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access. + mitre_attack_id: + - T1574.001 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml new file mode 100644 index 0000000000..6b7741af67 --- /dev/null +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -0,0 +1,68 @@ +name: Windows Gather Victim Host Information Camera +id: e4df4676-ea41-4397-b160-3ee0140dc332 +version: 1 +date: '2022-07-28' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic detects a powershell script that enumerate camera mounted to the targeted host. + This technique was seen in DCRat malware, where it runs a powershell command to look for camera information that will be pass on to its + C2 server. This anomaly detection can be a good pivot to check who and why this enumeration is needed and what parent process execute this powershell + script command. +search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_gather_victim_host_information_camera_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may execute this powershell command to get hardware information related to camera. +references: +- https://cert.gov.ua/article/405538 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat +- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor +tags: + analytic_story: + - DarkCrystal RAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log + impact: 60 + kill_chain_phases: + - Reconnaissance + message: powershell script $ScriptBlockText$ to enumerate camera in $Computer$ + mitre_attack_id: + - T1592.001 + - T1592 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - EventCode + risk_score: 42 + security_domain: endpoint diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml index dc42cb5d08..369fcff49c 100644 --- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml @@ -17,9 +17,9 @@ search: '`sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) a how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. + Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. known_false_positives: False positives will occur based on GrantedAccess and SourceUser, - filter based on source image as needed. + filter based on source image as needed. Utilize this hunting analytic to tune out false positives in TTP or anomaly analytics. references: - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump @@ -39,8 +39,7 @@ tags: impact: 80 kill_chain_phases: - Actions on Objectives - message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related - to credential dumping on $dest$. Review for further details. + message: A process, $SourceImage$, has requested access to LSASS on $dest$. Review for further details. mitre_attack_id: - T1003.001 - T1003 @@ -48,18 +47,10 @@ tags: - DE.AE - DE.CM observable: - - name: user - type: User - role: - - Victim - name: dest type: Hostname role: - Victim - - name: ImageLoaded - type: Process - role: - - Other - name: SourceImage type: Process role: diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml new file mode 100644 index 0000000000..7866b9324f --- /dev/null +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -0,0 +1,74 @@ +name: Windows Ingress Tool Transfer Using Explorer +id: 76753bab-f116-4ea3-8fb9-89b638be58a9 +version: 1 +date: '2022-08-01' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic detects an explorer.exe with a possible url link process command line on it. + Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. + So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application + in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check + which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ingress_tool_transfer_using_explorer_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: +- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor +tags: + analytic_story: + - DarkCrystal RAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log + impact: 50 + kill_chain_phases: + - Exploitation + message: a explorer process with url link $process$ in $dest$ + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 1ad65699a6..bc9eda222e 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -1,7 +1,7 @@ name: Windows Non-System Account Targeting Lsass id: b1ce9a72-73cf-11ec-981b-acde48001122 -version: 1 -date: '2022-01-12' +version: 2 +date: '2022-07-30' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -10,7 +10,7 @@ description: The following analytic identifies non SYSTEM accounts requesting ac requiring access to credentials. Triaging this event will require understanding the GrantedAccess from the SourceImage. In addition, whether the account is privileged or not. Review the process requesting permissions and review parallel processes. -search: '`sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*" +search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index 18864c80fc..2fc19caf64 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -6,26 +6,23 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to logoff a windows - host machine. This technique was seen in several APT, RAT like dcrat and other commodity - malware to shutdown the machine to add more impact, interrupt access, aid destruction - of the system like wiping disk or inhibit system recovery. This TTP is a good pivot - to check why application trigger this commandline which is not so common way to - logoff a machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: The following analytic identifies Windows commandline to logoff a windows host machine. + This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, + interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. + This TTP is a good pivot to check why application trigger this commandline which is not so common way to logoff a machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_system_logoff_commandline_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator may execute this commandline to trigger shutdown, - logoff or restart the host machine. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrator may execute this commandline to trigger shutdown, logoff or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index c85dd588db..6a8d0d2cde 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -6,27 +6,24 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to reboot a windows - host machine. This technique was seen in several APT, RAT like dcrat and other commodity - malware to shutdown the machine to add more impact, interrupt access, aid destruction - of the system like wiping disk or inhibit system recovery. This TTP is a good pivot - to check why application trigger this commandline which is not so common way to - reboot a machine. Compare to shutdown and logoff shutdown.exe feature, reboot seen - in some automation script like ansible to reboot the machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: The following analytic identifies Windows commandline to reboot a windows host machine. + This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, + interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. + This TTP is a good pivot to check why application trigger this commandline which is not so common way to reboot a machine. + Compare to shutdown and logoff shutdown.exe feature, reboot seen in some automation script like ansible to reboot the machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_system_reboot_commandline_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator may execute this commandline to trigger shutdown - or restart the host machine. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 3f2fdbb2c5..d825a51f6d 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -6,26 +6,23 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to shutdown a - windows host machine. This technique was seen in several APT, RAT like dcrat and - other commodity malware to shutdown the machine to add more impact, interrupt access, - aid destruction of the system like wiping disk or inhibit system recovery. This - TTP is a good pivot to check why application trigger this commandline which is not - so common way to shutdown a machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" Processes.process="* /s*" Processes.process="* /t*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: The following analytic identifies Windows commandline to shutdown a windows host machine. + This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, + interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. + This TTP is a good pivot to check why application trigger this commandline which is not so common way to shutdown a machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /s*" Processes.process="* /t*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator may execute this commandline to trigger shutdown - or restart the host machine. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index 670a286f30..c68d28ae2b 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies DCRat delay time tactics using w32tm. - This technique was seen in DCRAT malware where it uses stripchart function of w32tm.exe - application to delay the execution of its payload like c2 communication , beaconing - and execution. This anomaly detection may help the analyst to check other possible - event like the process who execute this command that may lead to DCRat attack. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process= - "* /computer:localhost *" Processes.process= "* /period:*" Processes.process= "* - /dataonly *" Processes.process= "* /samples:*" by Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_time_discovery_w32tm_delay_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +description: The following analytic identifies DCRat delay time tactics using w32tm. + This technique was seen in DCRAT malware where it uses stripchart function of w32tm.exe application to delay the execution of its payload like + c2 communication , beaconing and execution. This anomaly detection may help the analyst to check other possible event like the process who + execute this command that may lead to DCRat attack. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process= "* /computer:localhost *" + Processes.process= "* /period:*" Processes.process= "* /dataonly *" Processes.process= "* /samples:*" + by Processes.parent_process Processes.process_name Processes.original_file_name Processes.process + Processes.process_id Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_system_time_discovery_w32tm_delay_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: unknown references: - https://cert.gov.ua/article/405538 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index a021bdb930..6741d19efd 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -32,6 +32,7 @@ tags: - IcedID - Windows Persistence Techniques - Industroyer2 + - DarkCrystal RAT confidence: 100 context: - Source:Endpoint diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index f0813ee8ba..6569156817 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -46,6 +46,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index cf50f2edcc..b97e58523b 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -55,6 +55,7 @@ tags: risk_score: 36 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/ test: name: Attempt To Delete Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 2cfaca6e36..91351c5140 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -54,6 +54,7 @@ tags: risk_score: 36 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/ test: name: Attempt To Disable Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 444dc103ae..55124fcc46 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -50,6 +50,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ test: name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 8613482410..a641bac103 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -47,6 +47,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/ test: name: BCDEdit Failure Recovery Modification Unit Test tests: diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 9d6a6d9d0e..723fb37720 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -54,6 +54,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/ test: name: Clear Unallocated Sector Using Cipher - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 7e6dbad662..17c5a937c6 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -53,6 +53,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/ test: name: Delete A Net User Unit Test tests: diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 71f24d112a..4abed4382d 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -50,6 +50,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/ test: name: Deny Permission using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index e2323fffa2..72227dde47 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -52,6 +52,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/ test: name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index 275dd6d3f3..d5a54d0619 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -57,6 +57,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/ test: name: Detect RClone Command-Line Usage Unit Test tests: diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index d2cac833f6..90fcf77928 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -54,6 +54,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/ test: name: Disable Net User Account Unit Test tests: diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 7a4b6a8764..98a1f181e7 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -54,6 +54,7 @@ tags: risk_score: 72 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/ test: name: DNS Exfiltration Using Nslookup App Unit Test tests: diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 7a6cef077e..050c17c188 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -46,6 +46,7 @@ tags: risk_score: 54 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/ test: name: Fsutil Zeroing File Unit Test tests: diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index 1c3841d8e4..d6dc21e7de 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -50,6 +50,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/ test: name: Grant Permission Using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index e0a9b5940e..74d6688ac3 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -47,6 +47,7 @@ tags: risk_score: 72 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/ test: name: Hiding Files And Directories With Attrib exe - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index f065ba01e8..7527d8b6fb 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -54,6 +54,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/ test: name: Modify ACLs Permission Of Files Or Folders Unit Test tests: diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 3e9bdbb058..e865a128fb 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -53,6 +53,7 @@ tags: risk_score: 64 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/ test: name: Resize Shadowstorage Volume Unit Test tests: diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 58c8d956f7..bd10fa95d5 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -63,6 +63,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/ test: name: Sdelete Application Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 380636d2fd..ceaf466082 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -249,6 +249,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/ test: name: System Process Running from Unexpected Location Unit Test tests: diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 12916987b5..6fa1179c6e 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -51,6 +51,7 @@ tags: risk_score: 15 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/ test: name: WBAdmin Delete System Backups Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index ff2f683048..8017f3c543 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -55,6 +55,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/ test: name: WevtUtil Usage To Clear Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index f94fc8ee9c..287252279e 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -51,6 +51,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/ test: name: Wevtutil Usage To Disable Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 27e0401c36..abee8d7d9f 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -58,6 +58,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/ test: name: Windows Bits Job Persistence Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 63aaef432f..c19ba4c5bf 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -65,6 +65,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/ test: name: Windows Bitsadmin Download File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67ebe38322..c95b23c276 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -59,6 +59,7 @@ tags: risk_score: 40 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/ test: name: Windows CertUtil Decode File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 759614f3db..1b1445dda9 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -56,6 +56,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/ test: name: Windows CertUtil URLCache Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index f7e4f65f4b..a2aa277852 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -57,6 +57,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/ test: name: Windows CertUtil VerifyCtl Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 5fcfaa9bec..eb828d2278 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -65,6 +65,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/ test: name: Windows Curl Upload to Remote Destination Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index a4455e1b05..9b2b8918ab 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -45,6 +45,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/ test: name: Windows Defender Tools in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index b146bf22e9..e3b3f5e002 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -50,6 +50,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/ test: name: BA Windows Diskshadow Proxy Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index cd5d7489ac..0725a19f4f 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -77,6 +77,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/ test: name: Windows DotNet Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml index 78b17f39a6..2e538f0486 100644 --- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -59,6 +59,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/ test: name: Windows Eventvwr UAC Bypass Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index c722f05199..3c745c91b3 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -88,6 +88,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/ test: name: Windows LOLBin Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 018887b7e8..ad74833f85 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/ test: name: Windows MSHTA Child Process Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 065c2c4c90..cdf152b32b 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -58,6 +58,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/ test: name: Windows MSHTA Command-Line URL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 783f2f883f..902ff24976 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/ test: name: Windows MSHTA Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 9493f8dce5..b26ef34d3c 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -64,6 +64,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/ test: name: Windows Powershell Connect to Internet With Hidden Window Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 1e640f6906..783ee2a239 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -58,6 +58,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/ test: name: Windows Powershell DownloadFile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index dbd60b9417..ac16322b40 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -57,6 +57,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/ test: name: Windows PowerShell Start-BitsTransfer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 3ad2da43fc..0042ab9b8b 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -57,6 +57,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/ test: name: Windows Rasautou DLL Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index f42b9a9af2..dade0a7c34 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -45,6 +45,7 @@ tags: risk_score: 40 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/ test: name: Windows Rundll32 Comsvcs Memory Dump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 88a090bba3..cb18a878e5 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -59,6 +59,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/ test: name: Windows Rundll32 Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 801886f472..07f64c8c90 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/ test: name: Windows Script Host Spawn MSBuild Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index afdfddbbfa..ca34125c3a 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -57,6 +57,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/ test: name: Windows WMIPrvse Spawn MSBuild Unit Test tests: diff --git a/tests/endpoint/linux_awk_privilege_escalation.test.yml b/tests/endpoint/linux_awk_privilege_escalation.test.yml new file mode 100644 index 0000000000..584d69461b --- /dev/null +++ b/tests/endpoint/linux_awk_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux AWK Privilege Escalation Unit Test +tests: +- name: Linux AWK Privilege Escalation + file: endpoint/linux_awk_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_curl_upload_file.test.yml b/tests/endpoint/linux_curl_upload_file.test.yml new file mode 100644 index 0000000000..4115fcb1df --- /dev/null +++ b/tests/endpoint/linux_curl_upload_file.test.yml @@ -0,0 +1,13 @@ +name: Linux Curl Upload File Unit Test +tests: +- name: Linux Curl Upload File + file: endpoint/linux_curl_upload_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/linux_docker_privilege_escalation.test.yml b/tests/endpoint/linux_docker_privilege_escalation.test.yml new file mode 100644 index 0000000000..0ad9f72e83 --- /dev/null +++ b/tests/endpoint/linux_docker_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Docker Privilege Escalation Unit Test +tests: +- name: Linux Docker Privilege Escalation + file: endpoint/linux_docker_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml b/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml new file mode 100644 index 0000000000..b97f8b97dc --- /dev/null +++ b/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml @@ -0,0 +1,13 @@ +name: Linux Ingress Tool Transfer Hunting Unit Test +tests: +- name: Linux Ingress Tool Transfer Hunting + file: endpoint/linux_ingress_tool_transfer_hunting.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml new file mode 100644 index 0000000000..2683732440 --- /dev/null +++ b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml @@ -0,0 +1,13 @@ +name: Linux Ingress Tool Transfer With Curl Unit Test +tests: +- name: Linux Ingress Tool Transfer With Curl + file: endpoint/linux_ingress_tool_transfer_with_curl.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/linux_node_privilege_escalation.test.yml b/tests/endpoint/linux_node_privilege_escalation.test.yml new file mode 100644 index 0000000000..cf29457dfd --- /dev/null +++ b/tests/endpoint/linux_node_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Node Privilege Escalation Unit Test +tests: +- name: Linux Node Privilege Escalation + file: endpoint/linux_node_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_proxy_socks_curl.test.yml b/tests/endpoint/linux_proxy_socks_curl.test.yml new file mode 100644 index 0000000000..615cefef18 --- /dev/null +++ b/tests/endpoint/linux_proxy_socks_curl.test.yml @@ -0,0 +1,13 @@ +name: Linux Proxy Socks Curl Unit Test +tests: +- name: Linux Proxy Socks Curl + file: endpoint/linux_proxy_socks_curl.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml new file mode 100644 index 0000000000..01d93d02f7 --- /dev/null +++ b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml @@ -0,0 +1,13 @@ +name: Windows DLL Search Order Hijacking with iscsicpl Unit Test +tests: +- name: Windows DLL Search Order Hijacking with iscsicpl + file: endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: iscsicpl-windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_gather_victim_host_information_camera.test.yml b/tests/endpoint/windows_gather_victim_host_information_camera.test.yml new file mode 100644 index 0000000000..b93ff23971 --- /dev/null +++ b/tests/endpoint/windows_gather_victim_host_information_camera.test.yml @@ -0,0 +1,13 @@ +name: Windows Gather Victim Host Information Camera Unit Test +tests: +- name: Windows Gather Victim Host Information Camera + file: endpoint/windows_gather_victim_host_information_camera.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml b/tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml new file mode 100644 index 0000000000..a88a8dbade --- /dev/null +++ b/tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml @@ -0,0 +1,13 @@ +name: Windows Ingress Tool Transfer Using Explorer Unit Test +tests: +- name: Windows Ingress Tool Transfer Using Explorer + file: endpoint/windows_ingress_tool_transfer_using_explorer.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true