Stashing

2026-06-08 17:32:49 +00:00 · 2022-12-07 10:14:58 -06:00
parent 66d01342cb
commit 6a98507b88
1 changed files with 134 additions and 0 deletions
@@ -0,0 +1,134 @@
+name: Attempted Credential Dump From Registry via Reg exe
+id: 14038953-e5f2-4daf-acff-5452062baf03
+version: 2
+description: The following analytic identifies the use of `reg.exe` attempting to
+  export Windows registry keys that contain hashed credentials. Adversaries will utilize
+  this technique to capture and perform offline password cracking.
+search: ' | from read_ba_enriched_events()
+| eval timestamp=ucast(map_get(input_event,"time"), "long", null)
+| eval process_map=ucast(map_get(input_event, "process"), "map<string, any>", null),
+    file_map=ucast(map_get(process_map, "file"), "map<string, any>", null),
+    process_name=lower(ucast(map_get(file_map, "name"), "string", null)),
+    process_cmd=ucast(map_get(process_map, "cmd_line"), "string", null),
+    actor_process_map=ucast(map_get(input_event, "actor_process"), "map<string, any>", null),
+    file_map=ucast(map_get(actor_process_map, "file"), "map<string, any>", null),
+    parent_process_name=ucast(map_get(file_map, "name"), "string", null),
+    metadata_map=ucast(map_get(input_event, "metadata"), "map<string, any>", null),
+    metadata_uid=ucast(map_get(metadata_map, "uid"), "string", null)
+| where process_name="cmd.exe"
+    OR process_name="reg.exe"
+| where  process_cmd != null 
+    AND match_regex(process_cmd, /(?i)save\s+/)=true
+    AND ( match_regex(process_cmd, /(?i)HKLM\\Security/)=true
+         OR match_regex(process_cmd, /(?i)HKLM\\SAM/)=true
+         OR match_regex(process_cmd, /(?i)HKLM\\System/)=true
+         OR match_regex(process_cmd, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true
+         OR match_regex(process_cmd, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
+         OR match_regex(process_cmd, /(?i)HKEY_LOCAL_MACHINE\\System/)=true )
+| eval origin_map=ucast(map_get(input_event, "origin"), "map<string, any>", null),
+    dest_device=ucast(map_get(origin_map, "device"), "map<string, any>", null),
+    dest_user=ucast(map_get(input_event, "user"), "map<string, any>", null),
+    dest_device_name=ucast( map_get( dest_device , "name"), "string", null),
+    dest_user_name=ucast( map_get( dest_user , "name"), "string", null),
+    message=concat("An attempt to save registry keys storing credentials has been performed on ", dest_device_name, " by ", dest_user_name, " via process ", process_name, ".")
+| eval body=create_map(
+    "category_uid", 101,
+    "class_uid", 101000,
+    "detection_start_time", timestamp,
+    "detection_end_time", timestamp,
+    "device_entities",[create_map("uid", ucast( map_get( dest_device , "ref_uid"), "string", null), "type_id", 0)],
+    "disposition_id", 1,
+    "end_time", timestamp,
+    "event_uid", 10100001,
+    "event_time", strftime(timestamp, "%Y-%m-%dT%H:%M:%S.%6QZ", "%Z"),
+    "finding", create_map(
+         "confidence", 90,
+         "confidence_id", 3,
+         "context_ids", [10, 46],
+         "impact", 70, "impact_id", 4,
+         "kill_chain_phase", "Actions on Objectives",
+         "kill_chain_phase_id", 7,
+         "risk_level", "High",
+         "risk_level_id", 3,
+         "risk_score", 63,
+         "type_id", 1,
+         "ref_event_uid", metadata_uid
+    ),
+    "message", message,
+    "metadata", create_map(
+         "log_name", "Endpoint_Processes",
+         "version", "1.0.0"
+    ),
+    "observables", [
+         create_map(
+              "name", "parent_process_name",
+              "role_ids", [5],
+              "type_id", 15,
+              "value", parent_process_name
+         )
+         , create_map(
+              "name", "process_name",
+              "role_ids", [6],
+              "type_id", 15,
+              "value", process_name
+         )
+         , create_map(
+              "name", "process",
+              "role_ids", [6],
+              "type_id", 15,
+              "value", process_cmd
+         )
+    ],
+    "origin", create_map(
+         "product", create_map("name", "Splunk Behavioral Analytics")
+    ),
+    "rule", create_map("name", "Attempted Credential Dump From Registry via Reg exe"),
+    "start_time", timestamp,
+    "time", timestamp,
+    "user_entities", [create_map("uid", ucast(map_get(dest_user, "ref_uid"),"string", null))]
+ )
+| into write_ssa_finding_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: None identified.
+references:
+- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
+tags:
+  analytic_story:
+  - Credential Dumping
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1003
+  - T1003.002
+  nist:
+  - DE.CM
+  required_fields:
+  - process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 63
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/
+  event_schema: ocsf
+test:
+  name: Attempted Credential Dump From Registry via Reg exe Unit Test
+  tests:
+  - name: Attempted Credential Dump From Registry via Reg exe
+    file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
+      source: WinEventLog:Security