From e0b697ab6e02a9c63e36d0d852f28b6d15c5efcd Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 12 Apr 2023 12:17:43 +0200 Subject: [PATCH 1/9] sandworm_data_destruction --- .../detect_mimikatz_using_loaded_images.yml | 1 + ...z_with_powershell_script_block_logging.yml | 1 + .../detect_psexec_with_accepteula_flag.yml | 1 + detections/endpoint/detect_renamed_psexec.yml | 1 + detections/endpoint/icacls_deny_command.yml | 1 + .../linux_iptables_firewall_modification.yml | 39 +++++----- ...orker_process_in_writable_process_path.yml | 31 ++++---- .../local_account_discovery_with_net.yml | 1 + ...s_powershell_process___encoded_command.yml | 1 + ...z_passtheticket_commandline_parameters.yml | 1 + ...mission_modification_using_takeown_app.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/suspicious_copy_on_system32.yml | 1 + .../windows_dns_gather_network_info.yml | 73 +++++++++++++++++++ .../windows_mimikatz_binary_execution.yml | 1 + ...mimikatz_crypto_export_file_extensions.yml | 1 + ...ws_task_scheduler_event_action_started.yml | 2 + stories/sandworm_tools.yml | 25 +++++++ .../windows_dns_gather_network_info.test.yml | 13 ++++ 19 files changed, 163 insertions(+), 33 deletions(-) create mode 100644 detections/endpoint/windows_dns_gather_network_info.yml create mode 100644 stories/sandworm_tools.yml create mode 100644 tests/endpoint/windows_dns_gather_network_info.test.yml diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index e401eb8ea1..5de8b6a383 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -33,6 +33,7 @@ tags: - CISA AA22-257A - CISA AA22-264A - CISA AA22-320A + - Sandworm Tools asset_type: Windows cis20: - CIS 6 diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 8d89982b17..3550b06dc1 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -39,6 +39,7 @@ tags: - Malicious PowerShell - CISA AA22-264A - CISA AA22-320A + - Sandworm Tools confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 38acfe95f8..104f847322 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -38,6 +38,7 @@ tags: - DarkSide Ransomware - Active Directory Lateral Movement - CISA AA22-320A + - Sandworm Tools asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 9022453ca4..133e90f7ba 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -35,6 +35,7 @@ tags: - DarkSide Ransomware - Active Directory Lateral Movement - CISA AA22-320A + - Sandworm Tools confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 8cca9b176b..64b876d14f 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -29,6 +29,7 @@ tags: analytic_story: - XMRig - Azorult + - Sandworm Tools confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index d5ee4e0533..06e4d0b6ce 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,37 +1,40 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 version: 3 -date: '2022-06-03' +date: '2023-04-12' author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. - This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow - traffic to its tcp port that will be used to communicate with its C2 server. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" - AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s - Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path - | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count - by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `linux_iptables_firewall_modification_filter`' +description: This analytic looks for suspicious commandline that modify the iptables + firewall setting of a linux machine. This technique was seen in cyclopsblink malware + where it modifies the firewall setting of the compromised machine to allow traffic + to its tcp port that will be used to communicate with its C2 server. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables + *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND + Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND + NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name Processes.parent_process_path + Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) + as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name + Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user + Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: administrator may do this commandline for auditing and testing purposes. - In this scenario filter is needed. +known_false_positives: administrator may do this commandline for auditing and testing + purposes. In this scenario filter is needed. references: - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: + - Sandworm Tools - CyclopsBLink asset_type: Endpoint cis20: diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index 0d82dbfbdc..8acae93f49 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -1,25 +1,25 @@ name: Linux Kworker Process In Writable Process Path id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed version: 2 -date: '2022-04-30' +date: '2023-04-12' author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic looks for suspicious process kworker commandline in a linux machine. - kworker process name or thread are common names of kernel threads in linux process. - This hunting detections can lead to investigate process contains process path in - writable directory in linux like /home/, /var/log and /tmp/. This technique was seen - in cyclopsblink malware to blend its core and other of its child process as normal - kworker on the compromised machine. This detection might be a good pivot to look for - other IOC related to cyclopsblink malware or attacks. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_path - Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic looks for suspicious process kworker commandline in a linux + machine. kworker process name or thread are common names of kernel threads in linux + process. This hunting detections can lead to investigate process contains process + path in writable directory in linux like /home/, /var/log and /tmp/. This technique + was seen in cyclopsblink malware to blend its core and other of its child process + as normal kworker on the compromised machine. This detection might be a good pivot + to look for other IOC related to cyclopsblink malware or attacks. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = + "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") + Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_path Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_in_writable_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -31,6 +31,7 @@ references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html tags: analytic_story: + - Sandworm Tools - CyclopsBLink asset_type: Endpoint cis20: diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index 6adef0d862..40fd08ef13 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Sandworm Tools confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index c819549881..8718a8bcd5 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -47,6 +47,7 @@ tags: - DarkCrystal RAT - Qakbot - CISA AA22-320A + - Sandworm Tools asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index b4b427b0db..c05480196f 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Active Directory Kerberos Attacks - CISA AA22-320A + - Sandworm Tools asset_type: endpoint confidence: 60 context: diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index d46e1139cc..10e280bf0a 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Ransomware + - Sandworm Tools confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 86658c58f1..594548f494 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -40,6 +40,7 @@ tags: - Trickbot - Prestige Ransomware - AsyncRAT + - Sandworm Tools asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 27c4affdff..38d9735a91 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -33,6 +33,7 @@ tags: - Qakbot - IcedID - AsyncRAT + - Sandworm Tools confidence: 90 context: - Stage:Execution diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml new file mode 100644 index 0000000000..ce12af0f96 --- /dev/null +++ b/detections/endpoint/windows_dns_gather_network_info.yml @@ -0,0 +1,73 @@ +name: 'Windows DNS Gather Network Info' +id: 347e0892-e8f3-4512-afda-dc0e3fa996f3 +version: 1 +date: '2023-04-05' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a process commandline to enumerate DNS records. + Adversaries, threat actor or red teamer may use this to gather information about the victim's DNS that can be used during targeting. + This technique was also seen in as part of tool used by sandworm APT group in a geo-potical cyber warfare attack.By using dnscmd.exe Windows application + attacker can enumerate dns record of specific domain of targeted network to be used in further attacks. This Anomaly detection can be a good pivot to look for + users and hostname that might be compromised or targeted by an adversaries to collect data information. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *" + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dns_gather_network_info_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process + that include the name of the process responsible for the changes from your endpoints into the `Endpoint` + datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and + the latest TA for the endpoint product. +known_false_positives: network administrator can execute this command to enumerate DNS record. Filter or add other paths to the exclusion as needed. +references: +- https://cert.gov.ua/article/3718487 +tags: + analytic_story: + - Sandworm Tools + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Reconnaissance + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log + impact: 50 + kill_chain_phases: + - Reconnaissance + message: a process commandline $process$ to enumerate dns record in $dest$ + mitre_attack_id: + - T1590.002 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index df0139fe41..7d9a3a1fc9 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -26,6 +26,7 @@ tags: analytic_story: - Credential Dumping - CISA AA22-320A + - Sandworm Tools asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index dd85b2f0b0..45d0026ef9 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -16,6 +16,7 @@ references: tags: analytic_story: - Windows Certificate Services + - Sandworm Tools asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index f07564c58f..796119fdfb 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -37,6 +37,8 @@ tags: - Qakbot - Prestige Ransomware - AsyncRAT + - Winter Vivern + - Sandworm Tools confidence: 100 context: - Source:Endpoint diff --git a/stories/sandworm_tools.yml b/stories/sandworm_tools.yml new file mode 100644 index 0000000000..96a41f7211 --- /dev/null +++ b/stories/sandworm_tools.yml @@ -0,0 +1,25 @@ +name: Sandworm Tools +id: 54146850-9d26-4877-a611-2db33231e63e +version: 1 +date: '2022-04-05' +author: Teoderick Contreras, Splunk +description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities + that might relate to the destructive malware and tools used by "Sandworm" group. This analytic + story looks for suspicious process execution, command-line activity, wiping of MBR, data destruction and more. +narrative: Sandworm tools are destructive malware operations to disrupt or attack National Information Agencies of ukraine. + This operation campaign consist of several malware component like scripts, native windows executable (LOLBIN), data wiper malware that + overwrite or destroy master boot record (MBR) and wipes files using sdelete.exe of the targeted host. +references: +- https://cert.gov.ua/article/3718487 +- https://attack.mitre.org/groups/G0034/ +tags: + analytic_story: Sandworm Tools + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/windows_dns_gather_network_info.test.yml b/tests/endpoint/windows_dns_gather_network_info.test.yml new file mode 100644 index 0000000000..55d4409048 --- /dev/null +++ b/tests/endpoint/windows_dns_gather_network_info.test.yml @@ -0,0 +1,13 @@ +name: Windows DNS Gather Network Info Unit Test +tests: +- name: 'Windows DNS Gather Network Info ' + file: endpoint/windows_dns_gather_network_info.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From e9dfbaef485ba8710188bffa6d886c14e0abb9d1 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 12 Apr 2023 12:29:08 +0200 Subject: [PATCH 2/9] Update windows_dns_gather_network_info.yml --- detections/endpoint/windows_dns_gather_network_info.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml index ce12af0f96..f38bef970f 100644 --- a/detections/endpoint/windows_dns_gather_network_info.yml +++ b/detections/endpoint/windows_dns_gather_network_info.yml @@ -36,7 +36,7 @@ tags: confidence: 50 context: - Source:Endpoint - - Stage:Reconnaissance + - Stage:Recon dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log impact: 50 From eebbe77081ba996e7bd1d8ebf21435ecb76ccba7 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 Apr 2023 12:13:39 -0600 Subject: [PATCH 3/9] Update windows_dns_gather_network_info.yml --- detections/endpoint/windows_dns_gather_network_info.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml index f38bef970f..2f3c04199c 100644 --- a/detections/endpoint/windows_dns_gather_network_info.yml +++ b/detections/endpoint/windows_dns_gather_network_info.yml @@ -6,11 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies a process commandline to enumerate DNS records. - Adversaries, threat actor or red teamer may use this to gather information about the victim's DNS that can be used during targeting. - This technique was also seen in as part of tool used by sandworm APT group in a geo-potical cyber warfare attack.By using dnscmd.exe Windows application - attacker can enumerate dns record of specific domain of targeted network to be used in further attacks. This Anomaly detection can be a good pivot to look for - users and hostname that might be compromised or targeted by an adversaries to collect data information. +description: The following analytic identifies a process command line used to enumerate DNS records. Adversaries, threat actors, or red teamers may employ this technique to gather information about a victim's DNS, which can be utilized during targeting. This method was also observed as part of a tool used by the Sandworm APT group in a geopolitical cyber warfare attack. By using the dnscmd.exe Windows application, an attacker can enumerate DNS records for specific domains within the targeted network, potentially aiding in further attacks. This anomaly detection can serve as a valuable starting point for identifying users and hostnames that may be compromised or targeted by adversaries seeking to collect data information. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest From 95a776160ff6f156f55b5a06796c623f255710eb Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 Apr 2023 12:15:47 -0600 Subject: [PATCH 4/9] Update sandworm_tools.yml --- stories/sandworm_tools.yml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/stories/sandworm_tools.yml b/stories/sandworm_tools.yml index 96a41f7211..13824dd9a4 100644 --- a/stories/sandworm_tools.yml +++ b/stories/sandworm_tools.yml @@ -3,12 +3,8 @@ id: 54146850-9d26-4877-a611-2db33231e63e version: 1 date: '2022-04-05' author: Teoderick Contreras, Splunk -description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities - that might relate to the destructive malware and tools used by "Sandworm" group. This analytic - story looks for suspicious process execution, command-line activity, wiping of MBR, data destruction and more. -narrative: Sandworm tools are destructive malware operations to disrupt or attack National Information Agencies of ukraine. - This operation campaign consist of several malware component like scripts, native windows executable (LOLBIN), data wiper malware that - overwrite or destroy master boot record (MBR) and wipes files using sdelete.exe of the targeted host. +description: This analytic story features detections that enable security analysts to identify and investigate unusual activities potentially related to the destructive malware and tools employed by the "Sandworm" group. This analytic story focuses on monitoring suspicious process executions, command-line activities, Master Boot Record (MBR) wiping, data destruction, and other related indicators. +narrative: The Sandworm group's tools are part of destructive malware operations designed to disrupt or attack Ukraine's National Information Agencies. This operation campaign consists of several malware components, including scripts, native Windows executables (LOLBINs), data wiper malware that overwrites or destroys the Master Boot Record (MBR), and file wiping using sdelete.exe on targeted hosts. references: - https://cert.gov.ua/article/3718487 - https://attack.mitre.org/groups/G0034/ @@ -22,4 +18,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection From 61d4414f2f8d912889a7b4d4561106dff66fd467 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 13 Apr 2023 11:30:14 -0700 Subject: [PATCH 5/9] fix up with 4.0 --- .../windows_dns_gather_network_info.yml | 30 ++++++++----------- 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml index 2f3c04199c..330b426154 100644 --- a/detections/endpoint/windows_dns_gather_network_info.yml +++ b/detections/endpoint/windows_dns_gather_network_info.yml @@ -1,11 +1,12 @@ -name: 'Windows DNS Gather Network Info' +name: Windows DNS Gather Network Info id: 347e0892-e8f3-4512-afda-dc0e3fa996f3 version: 1 date: '2023-04-05' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +status: production +data_source: +- Sysmon Event ID 1 description: The following analytic identifies a process command line used to enumerate DNS records. Adversaries, threat actors, or red teamers may employ this technique to gather information about a victim's DNS, which can be utilized during targeting. This method was also observed as part of a tool used by the Sandworm APT group in a geopolitical cyber warfare attack. By using the dnscmd.exe Windows application, an attacker can enumerate DNS records for specific domains within the targeted network, potentially aiding in further attacks. This anomaly detection can serve as a valuable starting point for identifying users and hostnames that may be compromised or targeted by adversaries seeking to collect data information. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *" @@ -25,26 +26,13 @@ tags: analytic_story: - Sandworm Tools asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 50 - context: - - Source:Endpoint - - Stage:Recon - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log impact: 50 - kill_chain_phases: - - Reconnaissance - message: a process commandline $process$ to enumerate dns record in $dest$ + message: A process commandline $process$ to enumerate dns record in $dest$ mitre_attack_id: - T1590.002 - nist: - - DE.CM observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -67,3 +55,9 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From ecf8ff90d485a4dd29c94b1996406e0a3adbed92 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:40:15 +0200 Subject: [PATCH 6/9] Update detect_mimikatz_with_powershell_script_block_logging.yml --- .../detect_mimikatz_with_powershell_script_block_logging.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 1419c6b543..4b84d4ca6b 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -42,6 +42,7 @@ tags: - CISA AA22-264A - CISA AA22-320A - Sandworm Tools + - Data Destruction asset_type: Endpoint confidence: 100 impact: 90 From 5311028ec7a4fc7f31f564f3b5f451a6bc60ec9c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:42:16 +0200 Subject: [PATCH 7/9] Update malicious_powershell_process___encoded_command.yml --- .../endpoint/malicious_powershell_process___encoded_command.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index e359030d46..bed1a5e098 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -49,6 +49,7 @@ tags: - Qakbot - CISA AA22-320A - Sandworm Tools + - Data Destruction asset_type: Endpoint confidence: 50 impact: 70 From 68e61ae4cd9aa51b6e4e839a19d940861957e461 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:44:14 +0200 Subject: [PATCH 8/9] Update winevent_windows_task_scheduler_event_action_started.yml --- .../winevent_windows_task_scheduler_event_action_started.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index b8332100ba..930a55ba6c 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -39,6 +39,7 @@ tags: - AsyncRAT - Winter Vivern - Sandworm Tools + - Data Destruction asset_type: Endpoint confidence: 100 impact: 80 From 59443bd27eb30366e968433e243aa941f0712c7a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 17 Apr 2023 16:19:43 -0700 Subject: [PATCH 9/9] remove tests --- .../windows_dns_gather_network_info.test.yml | 13 ------------- 1 file changed, 13 deletions(-) delete mode 100644 tests/endpoint/windows_dns_gather_network_info.test.yml diff --git a/tests/endpoint/windows_dns_gather_network_info.test.yml b/tests/endpoint/windows_dns_gather_network_info.test.yml deleted file mode 100644 index 55d4409048..0000000000 --- a/tests/endpoint/windows_dns_gather_network_info.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows DNS Gather Network Info Unit Test -tests: -- name: 'Windows DNS Gather Network Info ' - file: endpoint/windows_dns_gather_network_info.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true