From e4f3848f2aafe3b6689e2ce0f7ae1dfe943f5a99 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 16 Jun 2023 14:33:38 +0200 Subject: [PATCH 1/6] amadey_remotesigned --- .../windows_powershell_remotesigned_file.yml | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 detections/endpoint/windows_powershell_remotesigned_file.yml diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml new file mode 100644 index 0000000000..8aa54d0d35 --- /dev/null +++ b/detections/endpoint/windows_powershell_remotesigned_file.yml @@ -0,0 +1,61 @@ +name: Windows Powershell RemoteSigned File +id: f7f7456b-470d-4a95-9703-698250645ff4 +version: 1 +date: '2023-06-16' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Powershell 4104 +description: This analytic identifies the use of "remotesigned" execution policy for a file. + This security setting determines whether PowerShell scripts can be executed on a computer. + When the execution policy is set to "remotesigned," it allows locally created scripts to run without any restrictions, + but scripts downloaded from the internet must have a digital signature from a trusted publisher. +search: '`powershell` EventCode=4104 ScriptBlockText = "* remotesigned *" ScriptBlockText = "* -File *" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_remotesigned_file_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: It is possible administrators or scripts may run these commands, + filtering may be required. +references: +- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3 +tags: + analytic_story: + - Amadey + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A PowerShell commandline to remotesigned a powershell script in $dest$, + mitre_attack_id: + - T1059.001 + - T1059 + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - ScriptBlockText + - Computer + - EventCode + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/windows-powershell-xml.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational From a5dd917057b36fe50641e10ef0c889d581b2d044 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 11:27:01 +0200 Subject: [PATCH 2/6] Update windows_powershell_remotesigned_file.yml --- detections/endpoint/windows_powershell_remotesigned_file.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml index 8aa54d0d35..aa3780ff2d 100644 --- a/detections/endpoint/windows_powershell_remotesigned_file.yml +++ b/detections/endpoint/windows_powershell_remotesigned_file.yml @@ -56,6 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/windows-powershell-remote-xml.log source: XmlWinEventLog sourcetype: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational From a82c0fdb49d7be9639f601291afc0f50546e7d09 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 16:04:00 +0200 Subject: [PATCH 3/6] Update windows_powershell_remotesigned_file.yml --- .../windows_powershell_remotesigned_file.yml | 25 ++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml index aa3780ff2d..edcdcf70e7 100644 --- a/detections/endpoint/windows_powershell_remotesigned_file.yml +++ b/detections/endpoint/windows_powershell_remotesigned_file.yml @@ -6,15 +6,17 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly data_source: -- Powershell 4104 +- Sysmon EventCode 1 description: This analytic identifies the use of "remotesigned" execution policy for a file. This security setting determines whether PowerShell scripts can be executed on a computer. When the execution policy is set to "remotesigned," it allows locally created scripts to run without any restrictions, but scripts downloaded from the internet must have a digital signature from a trusted publisher. -search: '`powershell` EventCode=4104 ScriptBlockText = "* remotesigned *" ScriptBlockText = "* -File *" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_powershell` Processes.process="* remotesigned *" Processes.process="* -File *" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `windows_powershell_remotesigned_file_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -49,13 +51,18 @@ tags: risk_score: 25 required_fields: - _time - - ScriptBlockText - - Computer - - EventCode + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.original_file_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/windows-powershell-remote-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon.log source: XmlWinEventLog - sourcetype: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational From 1ad0698308a7452a134749f360783756db7ce01d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 25 Jul 2023 12:29:11 -0700 Subject: [PATCH 4/6] Source and sourcetype in attack_data were swapped. Fixed them. --- detections/endpoint/windows_powershell_remotesigned_file.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml index edcdcf70e7..459784176d 100644 --- a/detections/endpoint/windows_powershell_remotesigned_file.yml +++ b/detections/endpoint/windows_powershell_remotesigned_file.yml @@ -64,5 +64,5 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 109c440492a851eb087152df300fe084bbc99f5c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Aug 2023 23:36:38 +0000 Subject: [PATCH 5/6] Bump gitpython from 3.1.31 to 3.1.32 Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.31 to 3.1.32. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.31...3.1.32) --- updated-dependencies: - dependency-name: gitpython dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 26da9fca96..07713bd3e4 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,6 +1,6 @@ attackcti==0.3.9 docker==6.1.3 -GitPython==3.1.31 +GitPython==3.1.32 Jinja2==3.1.2 jsonschema==4.17.3 mock==4.0.3 From 991da7331c8d90c1ed4b815bb0b02d4524ef362f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Aug 2023 23:36:47 +0000 Subject: [PATCH 6/6] Bump splunk-sdk from 1.7.3 to 1.7.4 Bumps [splunk-sdk](https://github.com/splunk/splunk-sdk-python) from 1.7.3 to 1.7.4. - [Release notes](https://github.com/splunk/splunk-sdk-python/releases) - [Changelog](https://github.com/splunk/splunk-sdk-python/blob/master/CHANGELOG.md) - [Commits](https://github.com/splunk/splunk-sdk-python/compare/1.7.3...1.7.4) --- updated-dependencies: - dependency-name: splunk-sdk dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 26da9fca96..7f87a159db 100644 --- a/requirements.txt +++ b/requirements.txt @@ -14,7 +14,7 @@ PyYAML>=5.4.1 questionary==1.10.0 requests==2.31.0 six==1.16.0 -splunk-sdk==1.7.3 +splunk-sdk==1.7.4 wrapt-timeout-decorator==1.3.12.2 xmltodict==0.13.0