Branch was auto-updated.

detections/endpoint/windows_indirect_command_execution_via_forfiles.yml

@@ -0,0 +1,74 @@
+name: Windows Indirect Command Execution Via forfiles
+id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787
+version: 1
+date: '2022-04-05'
+author: Eric McGinnis, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic detects programs that have been started by forfiles.exe.
+  According to Microsoft, the 'The forfiles command lets you run a command on or pass 
+  arguments to multiple files'. While this tool can be used to start legitimate programs,
+  usually within the context of a batch script, it has been observed being used to evade 
+  protections on command line execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *"  
+    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_indirect_command_execution_via_forfiles_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the full process path in the process field of CIM's Process data model.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where  forfiles.exe may be used.
+known_false_positives: Some legacy applications may be run using pcalua.exe.  
+  Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
+references:
+  - https://twitter.com/KyleHanslovan/status/912659279806640128
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
+tags:
+  analytic_story:
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1202
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id 
+  - Processes.process_path
+  security_domain: endpoint
+  impact: 50
+  confidence: 50 
+  # (impact * confidence)/100
+  risk_score: 25
+  context: 
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
+  observable:
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 8
+  - CIS 10 
+  asset_type: Endpoint

detections/endpoint/windows_indirect_command_execution_via_pcalua.yml

@@ -0,0 +1,72 @@
+name: Windows Indirect Command Execution Via pcalua
+id: 3428ac18-a410-4823-816c-ce697d26f7a8
+version: 1
+date: '2022-04-05'
+author: Eric McGinnis, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic detects programs that have been started by pcalua.exe.  
+  pcalua.exe is the Microsoft Windows Program Compatability Assistant.  While this tool 
+  can be used to start legitimate programs, it has been observed being used to evade 
+  protections on command line execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*"  
+    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_indirect_command_execution_via_pcalua_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the full process path in the process field of CIM's Process data model.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where pcalua.exe may be used.
+known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.  
+references:
+  - https://twitter.com/KyleHanslovan/status/912659279806640128
+  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
+tags:
+  analytic_story:
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1202
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id 
+  - Processes.process_path
+  security_domain: endpoint
+  impact: 50
+  confidence: 50 
+  # (impact * confidence)/100
+  risk_score: 25
+  context: 
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
+  observable:
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 8
+  - CIS 10 
+  asset_type: Endpoint

tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml

@@ -0,0 +1,12 @@
+name: Windows Indirect Command Execution via forfiles Unit Test
+tests:
+- name: Windows Indirect Command Excecution via forfiles
+  file: endpoint/windows_indirect_command_execution_via_forfiles.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml

@@ -0,0 +1,12 @@
+name: Windows Indirect Command Execution Via pcalua Unit Test
+tests:
+- name: Windows Indirect Command Excecution via pcalua
+  file: endpoint/windows_indirect_command_execution_via_pcalua.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog