diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 1a11381d42..f7eb47d242 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -35,6 +35,7 @@ tags: - CISA AA22-257A - CISA AA22-264A - CISA AA22-320A + - Sandworm Tools asset_type: Windows confidence: 80 impact: 80 diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index d99c5e6e98..4b84d4ca6b 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -41,6 +41,8 @@ tags: - Malicious PowerShell - CISA AA22-264A - CISA AA22-320A + - Sandworm Tools + - Data Destruction asset_type: Endpoint confidence: 100 impact: 90 diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 4ac24473cb..b1d8c8ee72 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -39,6 +39,7 @@ tags: - DarkSide Ransomware - Active Directory Lateral Movement - CISA AA22-320A + - Sandworm Tools asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 4ebf1c919a..a7c8026c79 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -37,6 +37,7 @@ tags: - DarkSide Ransomware - Active Directory Lateral Movement - CISA AA22-320A + - Sandworm Tools asset_type: Endpoint confidence: 90 impact: 30 diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 465b1f1c83..2439435092 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -30,6 +30,7 @@ tags: analytic_story: - XMRig - Azorult + - Sandworm Tools asset_type: Endpoint confidence: 80 impact: 90 diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 290285b4c6..0d654cad50 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,10 +1,12 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 version: 3 -date: '2022-06-03' +date: '2023-04-12' author: Teoderick Contreras, Splunk status: production type: Anomaly +datamodel: +- Endpoint description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic @@ -35,6 +37,7 @@ references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: + - Sandworm Tools - CyclopsBLink asset_type: Endpoint confidence: 50 diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index 83b5f59103..f67bcaf44f 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -1,10 +1,12 @@ name: Linux Kworker Process In Writable Process Path id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed version: 2 -date: '2022-04-30' +date: '2023-04-12' author: Teoderick Contreras, Splunk status: production type: Hunting +datamodel: +- Endpoint description: This analytic looks for suspicious process kworker commandline in a linux machine. kworker process name or thread are common names of kernel threads in linux process. This hunting detections can lead to investigate process contains process @@ -32,6 +34,7 @@ references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: + - Sandworm Tools - CyclopsBLink asset_type: Endpoint confidence: 60 diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index 58673ed36f..3c8c5f122a 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Sandworm Tools asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 0ab3982069..bed1a5e098 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -48,6 +48,8 @@ tags: - DarkCrystal RAT - Qakbot - CISA AA22-320A + - Sandworm Tools + - Data Destruction asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index 3a2cb66c65..fea008f71d 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks - CISA AA22-320A + - Sandworm Tools asset_type: endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index e7a117ef9d..60cd6a95aa 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Ransomware + - Sandworm Tools asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index a6b629765a..52deb76332 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -38,6 +38,7 @@ tags: - AgentTesla - Trickbot - AsyncRAT + - Sandworm Tools - Living Off The Land - CISA AA22-257A - DHS Report TA18-074A diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 04e4941818..bfb596e6aa 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -34,6 +34,7 @@ tags: - Qakbot - IcedID - AsyncRAT + - Sandworm Tools asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml new file mode 100644 index 0000000000..330b426154 --- /dev/null +++ b/detections/endpoint/windows_dns_gather_network_info.yml @@ -0,0 +1,63 @@ +name: Windows DNS Gather Network Info +id: 347e0892-e8f3-4512-afda-dc0e3fa996f3 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +type: Anomaly +status: production +data_source: +- Sysmon Event ID 1 +description: The following analytic identifies a process command line used to enumerate DNS records. Adversaries, threat actors, or red teamers may employ this technique to gather information about a victim's DNS, which can be utilized during targeting. This method was also observed as part of a tool used by the Sandworm APT group in a geopolitical cyber warfare attack. By using the dnscmd.exe Windows application, an attacker can enumerate DNS records for specific domains within the targeted network, potentially aiding in further attacks. This anomaly detection can serve as a valuable starting point for identifying users and hostnames that may be compromised or targeted by adversaries seeking to collect data information. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *" + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dns_gather_network_info_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process + that include the name of the process responsible for the changes from your endpoints into the `Endpoint` + datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and + the latest TA for the endpoint product. +known_false_positives: network administrator can execute this command to enumerate DNS record. Filter or add other paths to the exclusion as needed. +references: +- https://cert.gov.ua/article/3718487 +tags: + analytic_story: + - Sandworm Tools + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A process commandline $process$ to enumerate dns record in $dest$ + mitre_attack_id: + - T1590.002 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index b4d1635022..47093447ac 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Credential Dumping - CISA AA22-320A + - Sandworm Tools asset_type: Endpoint confidence: 100 impact: 100 diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 9ebbc9ceac..9e51040d93 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Windows Certificate Services + - Sandworm Tools asset_type: Endpoint confidence: 70 impact: 40 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index d34328ff6b..e7ec3f00bd 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -35,6 +35,7 @@ tags: - Prestige Ransomware - DarkCrystal RAT - AsyncRAT + - Winter Vivern - IcedID - CISA AA22-257A - Industroyer2 diff --git a/stories/sandworm_tools.yml b/stories/sandworm_tools.yml new file mode 100644 index 0000000000..13824dd9a4 --- /dev/null +++ b/stories/sandworm_tools.yml @@ -0,0 +1,21 @@ +name: Sandworm Tools +id: 54146850-9d26-4877-a611-2db33231e63e +version: 1 +date: '2022-04-05' +author: Teoderick Contreras, Splunk +description: This analytic story features detections that enable security analysts to identify and investigate unusual activities potentially related to the destructive malware and tools employed by the "Sandworm" group. This analytic story focuses on monitoring suspicious process executions, command-line activities, Master Boot Record (MBR) wiping, data destruction, and other related indicators. +narrative: The Sandworm group's tools are part of destructive malware operations designed to disrupt or attack Ukraine's National Information Agencies. This operation campaign consists of several malware components, including scripts, native Windows executables (LOLBINs), data wiper malware that overwrites or destroys the Master Boot Record (MBR), and file wiping using sdelete.exe on targeted hosts. +references: +- https://cert.gov.ua/article/3718487 +- https://attack.mitre.org/groups/G0034/ +tags: + analytic_story: Sandworm Tools + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection