admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'remcos_evasion' of https://github.com/splunk/security_content into remcos_evasion

Browse Source
This commit is contained in:
Detection Testing Service
2021-11-25 12:13:52 +00:00
parent 1b28033819 724101f8ed
commit 6d8151d915
2 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/add_or_set_windows_defender_exclusion.yml
+14 -14
View File
@@ -6,19 +6,19 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic will detect a suspicious process commandline related to windows defender exclusion feature.
This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product
by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code.
This is a good indicator for defense evasion and to look further for events after this behavior.
description: This analytic will detect a suspicious process commandline related to
windows defender exclusion feature. This command is abused by adversaries, malware
author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder
path, file path, process, extensions and etc. from its real time or schedule scan
to execute their malicious code. This is a good indicator for defense evasion and
to look further for events after this behavior.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference *" OR Processes.process = "*Set-MpPreference *")
AND Processes.process="*-exclusion*"
by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `add_or_set_windows_defender_exclusion_filter`'
as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference
*" OR Processes.process = "*Set-MpPreference *") AND Processes.process="*-exclusion*"
by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
Processes.process_name Processes.original_file_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `add_or_set_windows_defender_exclusion_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -58,7 +58,6 @@ tags:
security_domain: endpoint
impact: 80
confidence: 80
# (impact * confidence)/100
risk_score: 64
context:
- Source:Endpoint
@@ -72,4 +71,5 @@ tags:
- name: dest
type: Hostname
role:
- Victim
- Victim
automated_detection_testing: passed
detections/endpoint/windows_defender_exclusion_registry_entry.yml
+11 -11
View File
@@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic will detect a suspicious process that modify a registry related to windows defender exclusion feature.
This registry is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product
by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code.
This is a good indicator for a defense evasion and to look further for events after this behavior.
description: This analytic will detect a suspicious process that modify a registry
related to windows defender exclusion feature. This registry is abused by adversaries,
malware author and red teams to bypassed Windows Defender Anti-Virus product by
excluding folder path, file path, process, extensions and etc. from its real time
or schedule scan to execute their malicious code. This is a good indicator for a
defense evasion and to look further for events after this behavior.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*"
by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `windows_defender_exclusion_registry_entry_filter`'
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender\\Exclusions\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `windows_defender_exclusion_registry_entry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -50,7 +51,6 @@ tags:
security_domain: endpoint
impact: 80
confidence: 80
# (impact * confidence)/100
risk_score: 64
context:
- Source:Endpoint
@@ -65,4 +65,4 @@ tags:
type: Hostname
role:
- Victim
automated_detection_testing: passed