From e0bdf82ff32db0e11e72c62323fa9e1b64b0353b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 28 Jul 2022 13:37:50 -0600 Subject: [PATCH 01/26] Fix https://splunk.atlassian.net/browse/TR-2308 --- ...ows_hunting_system_account_targeting_lsass.yml | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml index dc42cb5d08..369fcff49c 100644 --- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml @@ -17,9 +17,9 @@ search: '`sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) a how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. + Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. known_false_positives: False positives will occur based on GrantedAccess and SourceUser, - filter based on source image as needed. + filter based on source image as needed. Utilize this hunting analytic to tune out false positives in TTP or anomaly analytics. references: - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump @@ -39,8 +39,7 @@ tags: impact: 80 kill_chain_phases: - Actions on Objectives - message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related - to credential dumping on $dest$. Review for further details. + message: A process, $SourceImage$, has requested access to LSASS on $dest$. Review for further details. mitre_attack_id: - T1003.001 - T1003 @@ -48,18 +47,10 @@ tags: - DE.AE - DE.CM observable: - - name: user - type: User - role: - - Victim - name: dest type: Hostname role: - Victim - - name: ImageLoaded - type: Process - role: - - Other - name: SourceImage type: Process role: From bcb5aab4eed2ed3d7954aa8fffbba96ed6079c1a Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 29 Jul 2022 10:06:40 +0200 Subject: [PATCH 02/26] dcrat-analytics3 --- ..._gather_victim_host_information_camera.yml | 65 +++++++++++++++++++ ...er_victim_host_information_camera.test.yml | 13 ++++ 2 files changed, 78 insertions(+) create mode 100644 detections/endpoint/windows_gather_victim_host_information_camera.yml create mode 100644 tests/endpoint/windows_gather_victim_host_information_camera.test.yml diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml new file mode 100644 index 0000000000..022ce44500 --- /dev/null +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -0,0 +1,65 @@ +name: Windows Gather Victim Host Information Camera +id: e4df4676-ea41-4397-b160-3ee0140dc332 +version: 1 +date: '2022-07-28' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: UPDATE_DESCRIPTION +search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText IN ("*PNPClass = 'Image'*", "*PNPClass = 'Camera'*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_gather_victim_host_information_camera_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: admin may execute this powershell command to get hardware information related to camera. +references: +- https://cert.gov.ua/article/405538 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat +- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor +tags: + analytic_story: + - DarkCrystal RAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log + impact: 60 + kill_chain_phases: + - Reconnaissance + message: powershell script $ScriptBlockText$ to enumerate camera in $Computer$ + mitre_attack_id: + - T1592.001 + - T1592 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Computer + - EventCode + risk_score: 42 + security_domain: endpoint diff --git a/tests/endpoint/windows_gather_victim_host_information_camera.test.yml b/tests/endpoint/windows_gather_victim_host_information_camera.test.yml new file mode 100644 index 0000000000..b93ff23971 --- /dev/null +++ b/tests/endpoint/windows_gather_victim_host_information_camera.test.yml @@ -0,0 +1,13 @@ +name: Windows Gather Victim Host Information Camera Unit Test +tests: +- name: Windows Gather Victim Host Information Camera + file: endpoint/windows_gather_victim_host_information_camera.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true From a0336d013a34dcf2565f85b4ebffe8a25164349b Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 29 Jul 2022 10:12:22 +0200 Subject: [PATCH 03/26] dcrat-analytics3 --- .../endpoint/windows_gather_victim_host_information_camera.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml index 022ce44500..42c18734d4 100644 --- a/detections/endpoint/windows_gather_victim_host_information_camera.yml +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: UPDATE_DESCRIPTION -search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText IN ("*PNPClass = 'Image'*", "*PNPClass = 'Camera'*") +search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 8ad83a0b5f8c948508b7482f5400b2ae2c1541ef Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 29 Jul 2022 11:17:19 -0600 Subject: [PATCH 04/26] Haag It Linux Curl Upload File Linux Ingress Tool Transfer Hunting Linux Ingress Tool Transfer with Curl Linux Proxy Socks Curl --- .../endpoint/linux_curl_upload_file.yml | 81 ++++++++++++++++++ .../linux_ingress_tool_transfer_hunting.yml | 80 ++++++++++++++++++ .../linux_ingress_tool_transfer_with_curl.yml | 82 ++++++++++++++++++ .../endpoint/linux_proxy_socks_curl.yml | 84 +++++++++++++++++++ .../endpoint/linux_curl_upload_file.test.yml | 13 +++ ...nux_ingress_tool_transfer_hunting.test.yml | 13 +++ ...x_ingress_tool_transfer_with_curl.test.yml | 13 +++ .../endpoint/linux_proxy_socks_curl.test.yml | 13 +++ 8 files changed, 379 insertions(+) create mode 100644 detections/endpoint/linux_curl_upload_file.yml create mode 100644 detections/endpoint/linux_ingress_tool_transfer_hunting.yml create mode 100644 detections/endpoint/linux_ingress_tool_transfer_with_curl.yml create mode 100644 detections/endpoint/linux_proxy_socks_curl.yml create mode 100644 tests/endpoint/linux_curl_upload_file.test.yml create mode 100644 tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml create mode 100644 tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml create mode 100644 tests/endpoint/linux_proxy_socks_curl.test.yml diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml new file mode 100644 index 0000000000..f3bcadd123 --- /dev/null +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -0,0 +1,81 @@ +name: Linux Curl Upload File +id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies curl being utilized with the -F or --form, --upload-file, -T, -d, --data, --data-raw, -I and --head switches to upload AWS credentials or config to a remote destination. + This enables uploading of binary files and so forth. To force the 'content' part to be a file, prefix the file name with an @ sign. To just get the content part from a file, prefix the file name with the symbol <. The difference between @ and < is then that @ makes a file get attached in the post as a file upload, while the < makes a text field and just get the contents for that text field from a file. + This technique was utlized by the TeamTNT group to exfiltrate AWS credentials. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl + Processes.process IN ("*-F *", "*--form *","*--upload-file *","*-T *","*-d *","*--data *","*--data-raw *", "*-I *", "*--head *") AND Processes.process IN ("*.aws/credentials*". "*.aws/config*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_curl_upload_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Filtering may be required. In addition to AWS credentials, add other important files and monitor. The inverse would be to look for _all_ -F behavior and tune from there. +references: + - https://curl.se/docs/manpage.html + - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ + - https://gtfobins.github.io/gtfobins/curl/ +tags: + analytic_story: + - Linux Living Off The Land + - Data Exfiltration + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination. + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml new file mode 100644 index 0000000000..191d9ceed8 --- /dev/null +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -0,0 +1,80 @@ +name: Linux Ingress Tool Transfer Hunting +id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic hunts for curl and wget being utilized in the environment. This is meant to help with identifying normal usage and potentially malicious. Utilize this query to tune other curl and wget analytics. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=curl OR Processes.process_name=wget) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_ingress_tool_transfer_hunting_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be present. This query is meant to help tune other curl and wget analytics. +references: + - https://gtfobins.github.io/gtfobins/curl/ + - https://curl.se/docs/manpage.html#-I + - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/rapid7/metasploit-framework/search?q=curl +tags: + analytic_story: + - Linux Living Off The Land + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 0 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 0 + kill_chain_phases: + - Delivery + - Installation + - Actions on Objectives + message: An instance of $process_name$ was identified + on endpoint $dest$ by user $user$ utilizing curl or wget. + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 0 + security_domain: endpoint diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml new file mode 100644 index 0000000000..7a8f04c92a --- /dev/null +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -0,0 +1,82 @@ +name: Linux Ingress Tool Transfer with Curl +id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies curl with the command-line switches that are commonly used to download, output, a remote script or binary. + MetaSploit Framework will combine the -sO switch with | chmod +x to enable a simple one liner to download and set the execute bit to run the file immediately. + During triage, review the remote domain and file being downloaded for legitimacy. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where match(process, "(?i)(-O|-sO|-ksO|--output)") + | `linux_ingress_tool_transfer_with_curl_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be present. Tune and then change type to TTP. +references: + - https://gtfobins.github.io/gtfobins/curl/ + - https://curl.se/docs/manpage.html#-I + - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/rapid7/metasploit-framework/search?q=curl +tags: + analytic_story: + - Linux Living Off The Land + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 40 + kill_chain_phases: + - Delivery + message: An instance of $process_name$ was identified + on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details. + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 12 + security_domain: endpoint diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml new file mode 100644 index 0000000000..202091a466 --- /dev/null +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -0,0 +1,84 @@ +name: Linux Proxy Socks Curl +id: bd596c22-ad1e-44fc-b242-817253ce8b08 +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies curl being utilized with a proxy based on command-line arguments - -x, socks, --preproxy and --proxy. This behavior is built into the MetaSploit Framework as a auxiliary module. What does socks buy an adversary? + SOCKS4a extends the SOCKS4 protocol to allow a client to specify a destination domain name rather than an IP address. + The SOCKS5 protocol is defined in RFC 1928. It is an incompatible extension of the SOCKS4 protocol; it offers more choices for authentication and adds support for IPv6 and UDP, the latter of which can be used for DNS lookups. + The protocols, and a proxy itself, allow an adversary to evade controls in place monitoring traffic, making it harder for the defender to identify and track activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl + Processes.process IN ("*-x *", "*socks4a://*", "*socks5h://*", "*socks4://*","*socks5://*", "*--preproxy *", "--proxy*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_proxy_socks_curl_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present based on proxy usage internally. Filter as needed. +references: + - https://www.offensive-security.com/metasploit-unleashed/proxytunnels/ + - https://curl.se/docs/manpage.html + - https://en.wikipedia.org/wiki/SOCKS + - https://oxylabs.io/blog/curl-with-proxy + - https://reqbin.com/req/c-ddxflki5/curl-proxy-server#:~:text=To%20use%20a%20proxy%20with,be%20URL%20decoded%20by%20Curl. + - https://gtfobins.github.io/gtfobins/curl/ +tags: + analytic_story: + - Linux Living Off The Land + - Ingress Tool Transfer + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + impact: 70 + kill_chain_phases: + - Delivery + message: An instance of $process_name$ was identified + on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details. + mitre_attack_id: + - T1090 + - T1095 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 56 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/linux_curl_upload_file.test.yml b/tests/endpoint/linux_curl_upload_file.test.yml new file mode 100644 index 0000000000..4115fcb1df --- /dev/null +++ b/tests/endpoint/linux_curl_upload_file.test.yml @@ -0,0 +1,13 @@ +name: Linux Curl Upload File Unit Test +tests: +- name: Linux Curl Upload File + file: endpoint/linux_curl_upload_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml b/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml new file mode 100644 index 0000000000..b97f8b97dc --- /dev/null +++ b/tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml @@ -0,0 +1,13 @@ +name: Linux Ingress Tool Transfer Hunting Unit Test +tests: +- name: Linux Ingress Tool Transfer Hunting + file: endpoint/linux_ingress_tool_transfer_hunting.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml new file mode 100644 index 0000000000..2683732440 --- /dev/null +++ b/tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml @@ -0,0 +1,13 @@ +name: Linux Ingress Tool Transfer With Curl Unit Test +tests: +- name: Linux Ingress Tool Transfer With Curl + file: endpoint/linux_ingress_tool_transfer_with_curl.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/linux_proxy_socks_curl.test.yml b/tests/endpoint/linux_proxy_socks_curl.test.yml new file mode 100644 index 0000000000..615cefef18 --- /dev/null +++ b/tests/endpoint/linux_proxy_socks_curl.test.yml @@ -0,0 +1,13 @@ +name: Linux Proxy Socks Curl Unit Test +tests: +- name: Linux Proxy Socks Curl + file: endpoint/linux_proxy_socks_curl.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: curl-linux-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true \ No newline at end of file From 978e4c3ef7b62e313cf0fa6180eaad7422906c8b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 29 Jul 2022 11:19:42 -0600 Subject: [PATCH 05/26] Update linux_ingress_tool_transfer_hunting.yml fixed risk --- detections/endpoint/linux_ingress_tool_transfer_hunting.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index 191d9ceed8..2883bb7b68 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -30,12 +30,12 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 0 + confidence: 10 context: - Source:Endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - impact: 0 + impact: 10 kill_chain_phases: - Delivery - Installation @@ -76,5 +76,5 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 0 + risk_score: 1 security_domain: endpoint From 8bc3086675a970f259fdafdb88bdd16670bdc83b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 29 Jul 2022 17:39:55 -0600 Subject: [PATCH 06/26] iscsicpl --- ...l_search_order_hijacking_with_iscsicpl.yml | 84 +++++++++++++++++++ ...rch_order_hijacking_with_iscsicpl.test.yml | 13 +++ 2 files changed, 97 insertions(+) create mode 100644 detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml create mode 100644 tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml new file mode 100644 index 0000000000..40376d92dd --- /dev/null +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -0,0 +1,84 @@ +name: Windows DLL Search Order Hijacking with iscsicpl +id: f39ee679-3b1e-4f47-841c-5c3c580acda2 +version: 1 +date: '2022-07-29' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a recently disclosed search ordler DLL hijack in iscsicpl.exe. The malicious DLL must be in a new path and iscsicpl.exe, upon load, will execute the payload. The analytic is restricted to Windows shells. + Two proof of concepts were identified and utilized to determine the behavior. The command-line is an option to go after, but most likely identifying a child process off iscsicpl.exe will be more effective. Monitoring for suspicious DLL loads is also an option. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=iscsicpl.exe + `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `windows_dll_search_order_hijacking_with_iscsicpl_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe. +references: + - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC + - https://github.com/422926799/csplugin/tree/master/bypassUAC +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Inbound + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access. + mitre_attack_id: + - T1574.001 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml new file mode 100644 index 0000000000..5a75853806 --- /dev/null +++ b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml @@ -0,0 +1,13 @@ +name: Windows DLL Search Order Hijacking with iscsicpl Unit Test +tests: +- name: Windows DLL Search Order Hijacking with iscsicpl + file: endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: iscsi-windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From bbd4b67e9d4a459c6f4ba3f86760f0b3aacec2bb Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sat, 30 Jul 2022 06:02:04 -0600 Subject: [PATCH 07/26] fixed query modified query to use NOT instead of != --- .../endpoint/windows_non_system_account_targeting_lsass.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 1ad65699a6..bc9eda222e 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -1,7 +1,7 @@ name: Windows Non-System Account Targeting Lsass id: b1ce9a72-73cf-11ec-981b-acde48001122 -version: 1 -date: '2022-01-12' +version: 2 +date: '2022-07-30' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -10,7 +10,7 @@ description: The following analytic identifies non SYSTEM accounts requesting ac requiring access to credentials. Triaging this event will require understanding the GrantedAccess from the SourceImage. In addition, whether the account is privileged or not. Review the process requesting permissions and review parallel processes. -search: '`sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*" +search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` From b67f2c69a1934aedab1a155748f51ca30c4d74cc Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 1 Aug 2022 14:15:02 +0200 Subject: [PATCH 08/26] dcrat-analytics3 --- ...gress_tool_transfer_using_explorer_exe.yml | 73 +++++++++++++++++++ ..._tool_transfer_using_explorer_exe.test.yml | 13 ++++ 2 files changed, 86 insertions(+) create mode 100644 detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml create mode 100644 tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml new file mode 100644 index 0000000000..5e572dd2ed --- /dev/null +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml @@ -0,0 +1,73 @@ +name: Windows Ingress Tool Transfer Using Explorer.exe +id: 76753bab-f116-4ea3-8fb9-89b638be58a9 +version: 1 +date: '2022-08-01' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic detects a explorer.exe with possible url link process commandline on it. + Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. + So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application + in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check + which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ingress_tool_transfer_using_explorer_exe_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor +tags: + analytic_story: + - DarkCrystal RAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log + impact: 50 + kill_chain_phases: + - Exploitation + message: a explorer process with url link $process$ in $dest$ + mitre_attack_id: + - T1105 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 25 + security_domain: endpoint diff --git a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml new file mode 100644 index 0000000000..15994d4375 --- /dev/null +++ b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml @@ -0,0 +1,13 @@ +name: Windows Ingress Tool Transfer Using Explorer.exe Unit Test +tests: +- name: Windows Ingress Tool Transfer Using Explorer.exe + file: endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From d8690a438605d2838a14e9ba10a3bab9efc9e531 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 1 Aug 2022 14:18:20 +0200 Subject: [PATCH 09/26] Update windows_ingress_tool_transfer_using_explorer_exe.yml --- .../windows_ingress_tool_transfer_using_explorer_exe.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml index 5e572dd2ed..fd22ac46ff 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml @@ -1,4 +1,4 @@ -name: Windows Ingress Tool Transfer Using Explorer.exe +name: Windows Ingress Tool Transfer Using Explorer id: 76753bab-f116-4ea3-8fb9-89b638be58a9 version: 1 date: '2022-08-01' @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_ingress_tool_transfer_using_explorer_exe_filter`' + | `windows_ingress_tool_transfer_using_explorer_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From 7ef8d1dadf40725b81e950a1a543686309be4883 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 1 Aug 2022 14:18:38 +0200 Subject: [PATCH 10/26] Update windows_ingress_tool_transfer_using_explorer_exe.test.yml --- ...indows_ingress_tool_transfer_using_explorer_exe.test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml index 15994d4375..a88a8dbade 100644 --- a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml +++ b/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml @@ -1,7 +1,7 @@ -name: Windows Ingress Tool Transfer Using Explorer.exe Unit Test +name: Windows Ingress Tool Transfer Using Explorer Unit Test tests: -- name: Windows Ingress Tool Transfer Using Explorer.exe - file: endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml +- name: Windows Ingress Tool Transfer Using Explorer + file: endpoint/windows_ingress_tool_transfer_using_explorer.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From f3f40edf9ea173dbe6aa2e1e9674a5b6ec7f476d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 1 Aug 2022 14:22:03 +0200 Subject: [PATCH 11/26] Update windows_gather_victim_host_information_camera.yml --- .../windows_gather_victim_host_information_camera.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml index 42c18734d4..91b8e08d25 100644 --- a/detections/endpoint/windows_gather_victim_host_information_camera.yml +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -6,7 +6,10 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: UPDATE_DESCRIPTION +description: The following analytic detects a powershell script that enumerate camera mounted to the targeted host. + This technique was seen in DCRat malware, where it runs a powershell command to look for camera information that will be pass on to its + C2 server. This anomaly detection can be a good pivot to check who and why this enumeration is needed and what parent process execute this powershell + script command. search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` From 44517188c19a82a9c86ed9bdb1f95d1780cfe0a0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 1 Aug 2022 14:22:35 +0200 Subject: [PATCH 12/26] Rename windows_ingress_tool_transfer_using_explorer_exe.test.yml to windows_ingress_tool_transfer_using_explorer.test.yml --- ....yml => windows_ingress_tool_transfer_using_explorer.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{windows_ingress_tool_transfer_using_explorer_exe.test.yml => windows_ingress_tool_transfer_using_explorer.test.yml} (100%) diff --git a/tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml b/tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml similarity index 100% rename from tests/endpoint/windows_ingress_tool_transfer_using_explorer_exe.test.yml rename to tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml From 2df3a64798fc0af17c8a602d40ea3202736c9f16 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 1 Aug 2022 14:23:01 +0200 Subject: [PATCH 13/26] Rename windows_ingress_tool_transfer_using_explorer_exe.yml to windows_ingress_tool_transfer_using_explorer.yml --- ...r_exe.yml => windows_ingress_tool_transfer_using_explorer.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/endpoint/{windows_ingress_tool_transfer_using_explorer_exe.yml => windows_ingress_tool_transfer_using_explorer.yml} (100%) diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml similarity index 100% rename from detections/endpoint/windows_ingress_tool_transfer_using_explorer_exe.yml rename to detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml From 0fc18fcbdb2560f1f7fcd59e9483e9d92a63a1be Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 1 Aug 2022 17:34:21 +0200 Subject: [PATCH 14/26] dcrat-analytics3 --- .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index cc5a66a67f..4ef0b987f3 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -32,6 +32,7 @@ tags: - Windows Persistence Techniques - Living Off The Land - Azorult + - DarkCrystal RAT asset_type: Endpoint cis20: - CIS 3 From e189299cf2a0539bba0580dbcac1df533a3b03c6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 2 Aug 2022 12:00:40 +0200 Subject: [PATCH 15/26] dcrat-analytics3 --- .../endpoint/suspicious_scheduled_task_from_public_directory.yml | 1 + .../winevent_windows_task_scheduler_event_action_started.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 2b5dad1423..0e7ba9a82f 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -33,6 +33,7 @@ tags: - Windows Persistence Techniques - Living Off The Land - Azorult + - DarkCrystal RAT confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index a021bdb930..6741d19efd 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -32,6 +32,7 @@ tags: - IcedID - Windows Persistence Techniques - Industroyer2 + - DarkCrystal RAT confidence: 100 context: - Source:Endpoint From da230f6ed6e6bb05b15eea88e4e4ed421dda5d78 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 2 Aug 2022 13:31:49 +0200 Subject: [PATCH 16/26] dcrat-analytics3 --- detections/endpoint/windows_system_logoff_commandline.yml | 2 +- detections/endpoint/windows_system_reboot_commandline.yml | 2 +- detections/endpoint/windows_system_shutdown_commandline.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index f1bd6ed549..49e9cc206b 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to logoff a windows host machine. +description: The following analytic identifies Windows commandline to logoff a windows host machine. This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. This TTP is a good pivot to check why application trigger this commandline which is not so common way to logoff a machine. diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 55ed3995c9..59663bc318 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to reboot a windows host machine. +description: The following analytic identifies Windows commandline to reboot a windows host machine. This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. This TTP is a good pivot to check why application trigger this commandline which is not so common way to reboot a machine. diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 9374e4c8d5..e240068959 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies Windows commandlined to shutdown a windows host machine. +description: The following analytic identifies Windows commandline to shutdown a windows host machine. This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact, interrupt access, aid destruction of the system like wiping disk or inhibit system recovery. This TTP is a good pivot to check why application trigger this commandline which is not so common way to shutdown a machine. From 9cfa2151e7d85fa122a980a93f4f9a4624f92438 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 2 Aug 2022 14:01:38 +0200 Subject: [PATCH 17/26] Update windows_ingress_tool_transfer_using_explorer.yml --- .../endpoint/windows_ingress_tool_transfer_using_explorer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index fd22ac46ff..abe6e5a514 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic detects a explorer.exe with possible url link process commandline on it. +description: The following analytic detects an explorer.exe with a possible url link process command line on it. Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check From 83e57921ad1965de55c213183246fbe61303a556 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 2 Aug 2022 08:35:54 -0600 Subject: [PATCH 18/26] iscsi fix --- .../windows_dll_search_order_hijacking_with_iscsicpl.yml | 2 +- .../windows_dll_search_order_hijacking_with_iscsicpl.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml index 40376d92dd..9f979a5927 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -37,7 +37,7 @@ tags: - Stage:Defense Evasion - Scope:Inbound dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log impact: 80 kill_chain_phases: - Exploitation diff --git a/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml index 5a75853806..01d93d02f7 100644 --- a/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml +++ b/tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: iscsi-windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsi-windows-sysmon.log + - file_name: iscsicpl-windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog update_timestamp: true From 29a61f8cb6b14f5f68bb4f1a3a7d6287d65b0d61 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Tue, 2 Aug 2022 16:23:31 -0400 Subject: [PATCH 19/26] Add detections for Awk, Node, Docker Lotl --- .../linux_awk_privilege_escalation.yml | 68 +++++++++++++++++++ .../linux_docker_privilege_escalation.yml | 68 +++++++++++++++++++ .../linux_node_privilege_escalation.yml | 68 +++++++++++++++++++ .../linux_awk_privilege_escalation.test.yml | 13 ++++ ...linux_docker_privilege_escalation.test.yml | 13 ++++ .../linux_node_privilege_escalation.test.yml | 13 ++++ 6 files changed, 243 insertions(+) create mode 100644 detections/endpoint/linux_awk_privilege_escalation.yml create mode 100644 detections/endpoint/linux_docker_privilege_escalation.yml create mode 100644 detections/endpoint/linux_node_privilege_escalation.yml create mode 100644 tests/endpoint/linux_awk_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_docker_privilege_escalation.test.yml create mode 100644 tests/endpoint/linux_node_privilege_escalation.test.yml diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml new file mode 100644 index 0000000000..a0f226f099 --- /dev/null +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux AWK Privilege Escalation +id: 4510cae0-96a2-4840-9919-91d262db210a +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Awk is mostly used for processing and scanning patterns. + It checks one or more files to determine whether any lines fit the specified patterns, + and if so, it does the appropriate action. If sudo right is given to AWK binary for the user, then the user + can run system commands as root and possibly get a root shell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*" AND Processes.process="*awk*" AND Processes.process="*BEGIN*system*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://www.hacknos.com/awk-privilege-escalation/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml new file mode 100644 index 0000000000..d6743dff13 --- /dev/null +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux Docker Privilege Escalation +id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Docker is an open source containerization platform. It helps programmers to bundle applications into containers, + which are standardized executable parts that include the application source code along with the OS libraries and dependencies needed to run + that code in any setting. The user can add mount the root directory into a container and edit the /etc/password file to add a super user. + This requires the user to be privileged enough to run docker, i.e. being in the docker group or being root. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process IN("*docker*-v*/*:*","*docker*--volume*/*:*") OR Processes.process IN("*docker*exec*sh*","*docker*exec*bash*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/docker/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml new file mode 100644 index 0000000000..8aacf88865 --- /dev/null +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -0,0 +1,68 @@ +name: Linux Node Privilege Escalation +id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce +version: 1 +date: '2022-07-31' +author: Gowthamaraj Rajendran, Splunk +type: Anomaly +datamodel: +- Endpoint +description: Node.js is a back-end JavaScript runtime environment that is open-source, cross-platform, runs on the V8 engine, + and executes JavaScript code outside of a web browser. It was created to help create scalable network applications. + If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, + escalate or maintain privileged access. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*node*" AND Processes.process="*-e*" AND Processes.process="*child_process.spawn*" AND Processes.process="*stdio*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from + Splunkbase. +known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. +references: +- https://gtfobins.github.io/gtfobins/docker/ +tags: + analytic_story: + - Linux Privilege Escalation + - Linux Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A commandline $process$ with process $process_name$ on $dest$ + mitre_attack_id: + - T1548.003 + - T1548 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/tests/endpoint/linux_awk_privilege_escalation.test.yml b/tests/endpoint/linux_awk_privilege_escalation.test.yml new file mode 100644 index 0000000000..584d69461b --- /dev/null +++ b/tests/endpoint/linux_awk_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux AWK Privilege Escalation Unit Test +tests: +- name: Linux AWK Privilege Escalation + file: endpoint/linux_awk_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_docker_privilege_escalation.test.yml b/tests/endpoint/linux_docker_privilege_escalation.test.yml new file mode 100644 index 0000000000..0ad9f72e83 --- /dev/null +++ b/tests/endpoint/linux_docker_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Docker Privilege Escalation Unit Test +tests: +- name: Linux Docker Privilege Escalation + file: endpoint/linux_docker_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true diff --git a/tests/endpoint/linux_node_privilege_escalation.test.yml b/tests/endpoint/linux_node_privilege_escalation.test.yml new file mode 100644 index 0000000000..cf29457dfd --- /dev/null +++ b/tests/endpoint/linux_node_privilege_escalation.test.yml @@ -0,0 +1,13 @@ +name: Linux Node Privilege Escalation Unit Test +tests: +- name: Linux Node Privilege Escalation + file: endpoint/linux_node_privilege_escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux + update_timestamp: true From 544afe862c62ac950d2f9ecc82e346b7febd1cae Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Tue, 2 Aug 2022 16:34:22 -0400 Subject: [PATCH 20/26] edit risk score --- detections/endpoint/linux_docker_privilege_escalation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index d6743dff13..0978880cdf 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -64,5 +64,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - risk_score: 72 + risk_score: 24 security_domain: endpoint From ca11a32aeb5bffa72212cb2a5dc84901d233589c Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 3 Aug 2022 17:53:06 +0200 Subject: [PATCH 21/26] dcrat-analytics3 --- .../windows_command_shell_dcrat_forkbomb_payload.yml | 9 +++++---- .../endpoint/windows_system_logoff_commandline.yml | 9 +++++---- .../endpoint/windows_system_reboot_commandline.yml | 9 +++++---- .../endpoint/windows_system_shutdown_commandline.yml | 9 +++++---- .../windows_system_time_discovery_w32tm_delay.yml | 9 +++++---- 5 files changed, 25 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 0616c2a06c..ce95cfe5c2 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -19,10 +19,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_shell_dcrat_forkbomb_payload_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: unknown references: - https://cert.gov.ua/article/405538 diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index 49e9cc206b..64ebf29e2f 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -17,10 +17,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_logoff_commandline_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Administrator may execute this commandline to trigger shutdown, logoff or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 59663bc318..cec5d5495e 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -18,10 +18,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_reboot_commandline_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index e240068959..8e75acc197 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -17,10 +17,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine. references: - https://attack.mitre.org/techniques/T1529/ diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index bc9a0438ae..6dfc9073d0 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -19,10 +19,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_time_discovery_w32tm_delay_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: unknown references: - https://cert.gov.ua/article/405538 From 939493337df6da685080d54a54f9e56d5d260829 Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 3 Aug 2022 17:34:32 -0400 Subject: [PATCH 22/26] adding research site links --- .../contentctl_core/domain/entities/detection_tags.py | 1 + .../adapter/obj_to_yml_adapter.py | 10 ++++++++-- .../ssa/srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + dist/ssa/srs/ssa___attempt_to_delete_services.yml | 1 + dist/ssa/srs/ssa___attempt_to_disable_services.yml | 1 + ...mpted_credential_dump_from_registry_via_reg_exe.yml | 1 + .../ssa___bcdedit_failure_recovery_modification.yml | 1 + ...ssa___clear_unallocated_sector_using_cipher_app.yml | 1 + dist/ssa/srs/ssa___delete_a_net_user.yml | 1 + .../srs/ssa___deny_permission_using_cacls_utility.yml | 1 + ...detect_prohibited_applications_spawning_cmd_exe.yml | 1 + .../ssa/srs/ssa___detect_rclone_command_line_usage.yml | 1 + dist/ssa/srs/ssa___disable_net_user_account.yml | 1 + .../srs/ssa___dns_exfiltration_using_nslookup_app.yml | 1 + dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 1 + .../srs/ssa___grant_permission_using_cacls_utility.yml | 1 + ...___hiding_files_and_directories_with_attrib_exe.yml | 1 + ...sa___modify_acls_permission_of_files_or_folders.yml | 1 + dist/ssa/srs/ssa___resize_shadowstorage_volume.yml | 1 + dist/ssa/srs/ssa___sdelete_application_execution.yml | 1 + ...system_process_running_from_unexpected_location.yml | 1 + dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 1 + dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml | 1 + dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml | 1 + dist/ssa/srs/ssa___windows_bits_job_persistence.yml | 1 + dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml | 1 + dist/ssa/srs/ssa___windows_certutil_decode_file.yml | 1 + .../srs/ssa___windows_certutil_urlcache_download.yml | 1 + .../srs/ssa___windows_certutil_verifyctl_download.yml | 1 + ...ssa___windows_curl_upload_to_remote_destination.yml | 1 + ...a___windows_defender_tools_in_non_standard_path.yml | 1 + .../srs/ssa___windows_diskshadow_proxy_execution.yml | 1 + ...sa___windows_dotnet_binary_in_non_standard_path.yml | 1 + dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml | 1 + ...sa___windows_lolbin_binary_in_non_standard_path.yml | 1 + dist/ssa/srs/ssa___windows_mshta_child_process.yml | 1 + dist/ssa/srs/ssa___windows_mshta_command_line_url.yml | 1 + .../srs/ssa___windows_mshta_inline_hta_execution.yml | 1 + ...wershell_connect_to_internet_with_hidden_window.yml | 1 + dist/ssa/srs/ssa___windows_powershell_downloadfile.yml | 1 + .../ssa___windows_powershell_start_bitstransfer.yml | 1 + dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml | 1 + .../srs/ssa___windows_rundll32_comsvcs_memory_dump.yml | 1 + .../ssa___windows_rundll32_inline_hta_execution.yml | 1 + .../srs/ssa___windows_script_host_spawn_msbuild.yml | 1 + dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml | 1 + 46 files changed, 53 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 51081a8e89..6b107836ed 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -37,6 +37,7 @@ class DetectionTags(BaseModel): risk_level: str = None observable_str: str = None kill_chain_phases_id: list = None + research_site_url: str = None @validator('cis20') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 52f382511b..bda2fb25d6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -14,6 +14,7 @@ class ObjToYmlAdapter(Adapter): def writeObjectsInPlace(self, objects: list) -> None: for object in objects: + file_path = object['file_path'] object.pop('file_path') object.pop('deprecated') @@ -28,6 +29,11 @@ class ObjToYmlAdapter(Adapter): file_path = os.path.join(output_path, 'complex', file_name) else: file_path = os.path.join(output_path, 'srs', file_name) + + # add research object + RESEARCH_SITE_BASE = 'https://research.splunk.com/' + research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/" + obj.tags.research_site_url = research_site_url body = FindingReportObject.writeFindingReport(obj) @@ -53,7 +59,8 @@ class ObjToYmlAdapter(Adapter): "risk_severity": True, "risk_score": True, "security_domain": True, - "required_fields": True + "required_fields": True, + "research_site_url": True }, "test": { @@ -86,7 +93,6 @@ class ObjToYmlAdapter(Adapter): f.write(data) f.close() - def writeObjectNewContent(self, object: dict, type: SecurityContentType) -> None: if type == SecurityContentType.detections: file_path = os.path.join(self.input_path, 'detections', object['source'], self.convertNameToFileName(object['name'],object['tags']['product'])) diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index f0813ee8ba..6569156817 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -46,6 +46,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index cf50f2edcc..b97e58523b 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -55,6 +55,7 @@ tags: risk_score: 36 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/ test: name: Attempt To Delete Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 2cfaca6e36..91351c5140 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -54,6 +54,7 @@ tags: risk_score: 36 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/ test: name: Attempt To Disable Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 444dc103ae..55124fcc46 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -50,6 +50,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ test: name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 8613482410..a641bac103 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -47,6 +47,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/ test: name: BCDEdit Failure Recovery Modification Unit Test tests: diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 9d6a6d9d0e..723fb37720 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -54,6 +54,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/ test: name: Clear Unallocated Sector Using Cipher - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 7e6dbad662..17c5a937c6 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -53,6 +53,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/ test: name: Delete A Net User Unit Test tests: diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 71f24d112a..4abed4382d 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -50,6 +50,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/ test: name: Deny Permission using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index e2323fffa2..72227dde47 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -52,6 +52,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/ test: name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index 275dd6d3f3..d5a54d0619 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -57,6 +57,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/ test: name: Detect RClone Command-Line Usage Unit Test tests: diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index d2cac833f6..90fcf77928 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -54,6 +54,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/ test: name: Disable Net User Account Unit Test tests: diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 7a4b6a8764..98a1f181e7 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -54,6 +54,7 @@ tags: risk_score: 72 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/ test: name: DNS Exfiltration Using Nslookup App Unit Test tests: diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 7a6cef077e..050c17c188 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -46,6 +46,7 @@ tags: risk_score: 54 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/ test: name: Fsutil Zeroing File Unit Test tests: diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index 1c3841d8e4..d6dc21e7de 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -50,6 +50,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/ test: name: Grant Permission Using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index e0a9b5940e..74d6688ac3 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -47,6 +47,7 @@ tags: risk_score: 72 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/ test: name: Hiding Files And Directories With Attrib exe - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index f065ba01e8..7527d8b6fb 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -54,6 +54,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/ test: name: Modify ACLs Permission Of Files Or Folders Unit Test tests: diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 3e9bdbb058..e865a128fb 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -53,6 +53,7 @@ tags: risk_score: 64 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/ test: name: Resize Shadowstorage Volume Unit Test tests: diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 58c8d956f7..bd10fa95d5 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -63,6 +63,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/ test: name: Sdelete Application Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 380636d2fd..ceaf466082 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -249,6 +249,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/ test: name: System Process Running from Unexpected Location Unit Test tests: diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 12916987b5..6fa1179c6e 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -51,6 +51,7 @@ tags: risk_score: 15 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/ test: name: WBAdmin Delete System Backups Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index ff2f683048..8017f3c543 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -55,6 +55,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/ test: name: WevtUtil Usage To Clear Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index f94fc8ee9c..287252279e 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -51,6 +51,7 @@ tags: risk_score: 63 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/ test: name: Wevtutil Usage To Disable Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 27e0401c36..abee8d7d9f 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -58,6 +58,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/ test: name: Windows Bits Job Persistence Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 63aaef432f..c19ba4c5bf 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -65,6 +65,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/ test: name: Windows Bitsadmin Download File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67ebe38322..c95b23c276 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -59,6 +59,7 @@ tags: risk_score: 40 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/ test: name: Windows CertUtil Decode File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 759614f3db..1b1445dda9 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -56,6 +56,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/ test: name: Windows CertUtil URLCache Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index f7e4f65f4b..a2aa277852 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -57,6 +57,7 @@ tags: risk_score: 90 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/ test: name: Windows CertUtil VerifyCtl Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 5fcfaa9bec..eb828d2278 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -65,6 +65,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/ test: name: Windows Curl Upload to Remote Destination Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index a4455e1b05..9b2b8918ab 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -45,6 +45,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/ test: name: Windows Defender Tools in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index b146bf22e9..e3b3f5e002 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -50,6 +50,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/ test: name: BA Windows Diskshadow Proxy Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index cd5d7489ac..0725a19f4f 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -77,6 +77,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/ test: name: Windows DotNet Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml index 78b17f39a6..2e538f0486 100644 --- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -59,6 +59,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/ test: name: Windows Eventvwr UAC Bypass Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index c722f05199..3c745c91b3 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -88,6 +88,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/ test: name: Windows LOLBin Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 018887b7e8..ad74833f85 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/ test: name: Windows MSHTA Child Process Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 065c2c4c90..cdf152b32b 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -58,6 +58,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/ test: name: Windows MSHTA Command-Line URL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 783f2f883f..902ff24976 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/ test: name: Windows MSHTA Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 9493f8dce5..b26ef34d3c 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -64,6 +64,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/ test: name: Windows Powershell Connect to Internet With Hidden Window Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 1e640f6906..783ee2a239 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -58,6 +58,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/ test: name: Windows Powershell DownloadFile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index dbd60b9417..ac16322b40 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -57,6 +57,7 @@ tags: risk_score: 49 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/ test: name: Windows PowerShell Start-BitsTransfer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 3ad2da43fc..0042ab9b8b 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -57,6 +57,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/ test: name: Windows Rasautou DLL Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index f42b9a9af2..dade0a7c34 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -45,6 +45,7 @@ tags: risk_score: 40 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/ test: name: Windows Rundll32 Comsvcs Memory Dump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 88a090bba3..cb18a878e5 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -59,6 +59,7 @@ tags: risk_score: 56 security_domain: endpoint risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/ test: name: Windows Rundll32 Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 801886f472..07f64c8c90 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -56,6 +56,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/ test: name: Windows Script Host Spawn MSBuild Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index afdfddbbfa..ca34125c3a 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -57,6 +57,7 @@ tags: risk_score: 80 security_domain: endpoint risk_severity: high + research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/ test: name: Windows WMIPrvse Spawn MSBuild Unit Test tests: From 7422fb3edae8a9d75e413eed88dec5dfda5319ab Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 4 Aug 2022 09:44:22 +0200 Subject: [PATCH 23/26] dcrat-analytics3 --- .../windows_ingress_tool_transfer_using_explorer.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index abe6e5a514..7866b9324f 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -18,10 +18,11 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ingress_tool_transfer_using_explorer_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: unknown references: - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor From 97bc95f773653387291a467d80cfb9fcf40e595f Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 4 Aug 2022 14:55:21 +0200 Subject: [PATCH 24/26] bug fix --- .../srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + .../srs/ssa___anomalous_usage_of_archive_tools.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml index d5123ab61a..2098cad653 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -53,6 +53,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml index d5123ab61a..2098cad653 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -53,6 +53,7 @@ tags: risk_score: 42 security_domain: endpoint risk_severity: low + research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ test: name: Anomalous usage of Archive Tools Unit Test tests: From a192bac909d124e0547d88eba1b28130f7571faa Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 11 Aug 2022 11:13:41 -0700 Subject: [PATCH 25/26] Update windows_gather_victim_host_information_camera.yml --- .../endpoint/windows_gather_victim_host_information_camera.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml index 91b8e08d25..6b7741af67 100644 --- a/detections/endpoint/windows_gather_victim_host_information_camera.yml +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -18,7 +18,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" Scri how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: admin may execute this powershell command to get hardware information related to camera. +known_false_positives: Administrators may execute this powershell command to get hardware information related to camera. references: - https://cert.gov.ua/article/405538 - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat From 1952b9773bd476f6b0f9eed9133f6042897f1a1b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 11 Aug 2022 12:10:47 -0700 Subject: [PATCH 26/26] Update aws_credential_access_getpassworddata.yml --- detections/cloud/aws_credential_access_getpassworddata.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml index 4f6c9ea457..f9b35c4601 100644 --- a/detections/cloud/aws_credential_access_getpassworddata.yml +++ b/detections/cloud/aws_credential_access_getpassworddata.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance. -search: '| `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time +search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time | where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment. known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time. @@ -58,4 +58,4 @@ tags: - sourceIPAddress - awsRegion risk_score: 49 - security_domain: threat \ No newline at end of file + security_domain: threat