Branch was auto-updated.

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -35,6 +35,7 @@ tags:
   - CISA AA22-257A
   - CISA AA22-264A
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: Windows
   confidence: 80
   impact: 80

detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml

@@ -41,6 +41,8 @@ tags:
   - Malicious PowerShell
   - CISA AA22-264A
   - CISA AA22-320A
+  - Sandworm Tools
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 90

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -39,6 +39,7 @@ tags:
   - DarkSide Ransomware
   - Active Directory Lateral Movement
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/detect_renamed_psexec.yml

@@ -37,6 +37,7 @@ tags:
   - DarkSide Ransomware
   - Active Directory Lateral Movement
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 90
   impact: 30

detections/endpoint/icacls_deny_command.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - XMRig
   - Azorult
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 80
   impact: 90

detections/endpoint/linux_iptables_firewall_modification.yml

@@ -1,10 +1,12 @@
 name: Linux Iptables Firewall Modification
 id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7
 version: 3
-date: '2022-06-03'
+date: '2023-04-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
+datamodel:
+- Endpoint
 description: This analytic looks for suspicious commandline that modify the iptables
   firewall setting of a linux machine. This technique was seen in cyclopsblink malware
   where it modifies the firewall setting of the compromised machine to allow traffic
@@ -35,6 +37,7 @@ references:
 - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
 tags:
   analytic_story:
+  - Sandworm Tools
   - CyclopsBLink
   asset_type: Endpoint
   confidence: 50

detections/endpoint/linux_kworker_process_in_writable_process_path.yml

@@ -1,10 +1,12 @@
 name: Linux Kworker Process In Writable Process Path
 id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed
 version: 2
-date: '2022-04-30'
+date: '2023-04-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
+datamodel:
+- Endpoint
 description: This analytic looks for suspicious process kworker commandline in a linux
   machine. kworker process name or thread are common names of kernel threads in linux
   process. This hunting detections can lead to investigate process contains process
@@ -32,6 +34,7 @@ references:
 - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
 tags:
   analytic_story:
+  - Sandworm Tools
   - CyclopsBLink
   asset_type: Endpoint
   confidence: 60

detections/endpoint/local_account_discovery_with_net.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 50
   impact: 30

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -48,6 +48,8 @@ tags:
   - DarkCrystal RAT
   - Qakbot
   - CISA AA22-320A
+  - Sandworm Tools
+  - Data Destruction
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Active Directory Kerberos Attacks
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: endpoint
   confidence: 60
   impact: 60

detections/endpoint/permission_modification_using_takeown_app.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -38,6 +38,7 @@ tags:
   - AgentTesla
   - Trickbot
   - AsyncRAT
+  - Sandworm Tools
   - Living Off The Land
   - CISA AA22-257A
   - DHS Report TA18-074A

detections/endpoint/suspicious_copy_on_system32.yml

@@ -34,6 +34,7 @@ tags:
   - Qakbot
   - IcedID
   - AsyncRAT
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 90
   impact: 70

detections/endpoint/windows_dns_gather_network_info.yml

@@ -0,0 +1,63 @@
+name: Windows DNS Gather Network Info
+id: 347e0892-e8f3-4512-afda-dc0e3fa996f3
+version: 1
+date: '2023-04-05'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+status: production
+data_source:
+- Sysmon Event ID 1
+description: The following analytic identifies a process command line used to enumerate DNS records. Adversaries, threat actors, or red teamers may employ this technique to gather information about a victim's DNS, which can be utilized during targeting. This method was also observed as part of a tool used by the Sandworm APT group in a geopolitical cyber warfare attack. By using the dnscmd.exe Windows application, an attacker can enumerate DNS records for specific domains within the targeted network, potentially aiding in further attacks. This anomaly detection can serve as a valuable starting point for identifying users and hostnames that may be compromised or targeted by adversaries seeking to collect data information.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *"
+  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_dns_gather_network_info_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process 
+  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
+  datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and 
+  the latest TA for the endpoint product.
+known_false_positives: network administrator can execute this command to enumerate DNS record. Filter or add other paths to the exclusion as needed.
+references:
+- https://cert.gov.ua/article/3718487
+tags:
+  analytic_story:
+  - Sandworm Tools
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A process commandline $process$ to enumerate dns record in $dest$
+  mitre_attack_id:
+  - T1590.002
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_mimikatz_binary_execution.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 100
   impact: 100

detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Windows Certificate Services
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 70
   impact: 40

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -35,6 +35,7 @@ tags:
   - Prestige Ransomware
   - DarkCrystal RAT
   - AsyncRAT
+  - Winter Vivern
   - IcedID
   - CISA AA22-257A
   - Industroyer2

stories/sandworm_tools.yml

@@ -0,0 +1,21 @@
+name: Sandworm Tools
+id: 54146850-9d26-4877-a611-2db33231e63e
+version: 1
+date: '2022-04-05'
+author: Teoderick Contreras, Splunk
+description: This analytic story features detections that enable security analysts to identify and investigate unusual activities potentially related to the destructive malware and tools employed by the "Sandworm" group. This analytic story focuses on monitoring suspicious process executions, command-line activities, Master Boot Record (MBR) wiping, data destruction, and other related indicators.
+narrative: The Sandworm group's tools are part of destructive malware operations designed to disrupt or attack Ukraine's National Information Agencies. This operation campaign consists of several malware components, including scripts, native Windows executables (LOLBINs), data wiper malware that overwrites or destroys the Master Boot Record (MBR), and file wiping using sdelete.exe on targeted hosts.
+references:
+- https://cert.gov.ua/article/3718487
+- https://attack.mitre.org/groups/G0034/
+tags:
+  analytic_story: Sandworm Tools
+  category:
+  - Data Destruction
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection