From 20b1db48dec020599bc59d54174ab16f4a030a5f Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 12 Apr 2023 07:18:22 -0400 Subject: [PATCH 1/4] Add files via upload Upload for generic webshell detection. --- .../detect_webshell_exploit_behavior.yml | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 detections/endpoint/detect_webshell_exploit_behavior.yml diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml new file mode 100644 index 0000000000..be8694f751 --- /dev/null +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -0,0 +1,82 @@ +name: Detect Webshell Exploit Behavior +id: 22597426-6dbd-49bd-bcdc-4ec19857192f +version: 1 +date: '2023-04-04' +author: Steven Dick +type: TTP +datamodel: +- Endpoint +description: This search is used to detect the abuse of web applications by adversaries. +Adversaries may install a backdoor or script onto web servers by exploiting known +vulnerabilities or misconfigruations. Web shells are used to establish persistent access +to systems and provide a set of executable functions or a command-line interface on the +system hosting the Web server. +search: '| tstats `summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Endpoint.Processes +where (Processes.process_name IN ("arp.exe","at.exe","bash.exe","bitsadmin.exe","certutil.exe","cmd.exe","cscript.exe", +"dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","ksh.exe","nbstat.exe", +"net.exe","net1.exe","netdom.exe","netsh.exe","netstat.exe","nltest.exe","nslookup.exe","ntdsutil.exe","pathping.exe", +"ping.exe","powershell.exe","pwsh.exe","qprocess.exe","query.exe","qwinsta.exe","reg.exe","rundll32.exe","sc.exe", +"scrcons.exe","schtasks.exe","sh.exe","systeminfo.exe","tasklist.exe","tracert.exe","ver.exe","vssadmin.exe", +"wevtutil.exe","whoami.exe","wmic.exe","wscript.exe","wusa.exe","zsh.exe") +AND Processes.parent_process_name IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe","tomcat*.exe")) +by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_process_name,Processes.process,Processes.process_name +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_webshell_exploit_behavior`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that includes the full command line of the process being launched on + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Legitimate OS funcations called by vendor applications, baseline the enviroment and filter before enabling. +Recommend throttle by dest/process_name +references: +- https://attack.mitre.org/techniques/T1505/003/ +- https://github.com/nsacyber/Mitigating-Web-Shells +- https://www.hackingarticles.in/multiple-ways-to-exploit-tomcat-manager/ +tags: + analytic_story: + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log + impact: 100 + kill_chain_phases: + - Persistence + message: Webshell Exploit Behavior - $parent_process_name$ spawned $process_name$ on $dest$. + mitre_attack_id: + - T1505 + - T1505.003 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process + - Processes.process_name + risk_score: 80 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon + asset_type: Endpoint \ No newline at end of file From 5667c3790c46cb552b118a6b583a7a5bb5bb3c5e Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 26 Apr 2023 14:10:54 -0400 Subject: [PATCH 2/4] Update detect_webshell_exploit_behavior.yml Updated for 4.x shema --- .../detect_webshell_exploit_behavior.yml | 28 +++++++++++-------- 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml index be8694f751..ea4502ef21 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -1,16 +1,16 @@ name: Detect Webshell Exploit Behavior id: 22597426-6dbd-49bd-bcdc-4ec19857192f -version: 1 -date: '2023-04-04' +version: 2 +date: '2023-04-26' author: Steven Dick type: TTP -datamodel: -- Endpoint description: This search is used to detect the abuse of web applications by adversaries. Adversaries may install a backdoor or script onto web servers by exploiting known vulnerabilities or misconfigruations. Web shells are used to establish persistent access to systems and provide a set of executable functions or a command-line interface on the system hosting the Web server. +data_source: +- Sysmon 1 search: '| tstats `summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("arp.exe","at.exe","bash.exe","bitsadmin.exe","certutil.exe","cmd.exe","cscript.exe", "dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","ksh.exe","nbstat.exe", @@ -37,15 +37,14 @@ references: - https://www.hackingarticles.in/multiple-ways-to-exploit-tomcat-manager/ tags: analytic_story: + - ProxyShell + - ProxyNotShell + - HAFNIUM Group + - CISA AA22-257A + - CISA AA22-264A + asset_type: Endpoint confidence: 80 - context: - - Source:Endpoint - - Stage:Persistence - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log impact: 100 - kill_chain_phases: - - Persistence message: Webshell Exploit Behavior - $parent_process_name$ spawned $process_name$ on $dest$. mitre_attack_id: - T1505 @@ -79,4 +78,9 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon - asset_type: Endpoint \ No newline at end of file +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 9faf0af7ab3390d29fa25a34378fb79cdae988dc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Jun 2023 16:31:11 -0700 Subject: [PATCH 3/4] Update detect_webshell_exploit_behavior.yml added status key, fixing a typo and running validation scripts --- .../endpoint/detect_webshell_exploit_behavior.yml | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml index ea4502ef21..8c9b5115fa 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -3,14 +3,11 @@ id: 22597426-6dbd-49bd-bcdc-4ec19857192f version: 2 date: '2023-04-26' author: Steven Dick +status: production type: TTP -description: This search is used to detect the abuse of web applications by adversaries. -Adversaries may install a backdoor or script onto web servers by exploiting known -vulnerabilities or misconfigruations. Web shells are used to establish persistent access -to systems and provide a set of executable functions or a command-line interface on the -system hosting the Web server. +description: This search is used to detect the abuse of web applications by adversaries. Adversaries may install a backdoor or script onto web servers by exploiting known vulnerabilities or misconfigruations. Web shells are used to establish persistent access to systems and provide a set of executable functions or a command-line interface on the system hosting the Web server. data_source: -- Sysmon 1 +- Sysmon Event ID 1 search: '| tstats `summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("arp.exe","at.exe","bash.exe","bitsadmin.exe","certutil.exe","cmd.exe","cscript.exe", "dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","ksh.exe","nbstat.exe", @@ -29,8 +26,7 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Legitimate OS funcations called by vendor applications, baseline the enviroment and filter before enabling. -Recommend throttle by dest/process_name +known_false_positives: Legitimate OS functions called by vendor applications, baseline the environment and filter before enabling. Recommend throttle by dest/process_name references: - https://attack.mitre.org/techniques/T1505/003/ - https://github.com/nsacyber/Mitigating-Web-Shells From 71178f3c3a96e475a7be4ebfafc6228ca741ee05 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Jun 2023 17:17:39 -0700 Subject: [PATCH 4/4] Update detect_webshell_exploit_behavior.yml Updated `security_content_summariesonly` and adding filter macro --- detections/endpoint/detect_webshell_exploit_behavior.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml index 8c9b5115fa..dc463f27d0 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -8,7 +8,7 @@ type: TTP description: This search is used to detect the abuse of web applications by adversaries. Adversaries may install a backdoor or script onto web servers by exploiting known vulnerabilities or misconfigruations. Web shells are used to establish persistent access to systems and provide a set of executable functions or a command-line interface on the system hosting the Web server. data_source: - Sysmon Event ID 1 -search: '| tstats `summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("arp.exe","at.exe","bash.exe","bitsadmin.exe","certutil.exe","cmd.exe","cscript.exe", "dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","ksh.exe","nbstat.exe", "net.exe","net1.exe","netdom.exe","netsh.exe","netstat.exe","nltest.exe","nslookup.exe","ntdsutil.exe","pathping.exe", @@ -20,7 +20,7 @@ by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_proce | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `detect_webshell_exploit_behavior`' +| `detect_webshell_exploit_behavior_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that includes the full command line of the process being launched on your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,