From cfd765ce7bf31e995d83294e23ece4c3c516cd5f Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 10 Dec 2024 09:49:34 -0800 Subject: [PATCH 1/7] updating mitre id --- detections/endpoint/windows_lateral_tool_transfer_remcom.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml index 19a7cc815e..6f701e6fd5 100644 --- a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml +++ b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml @@ -33,7 +33,7 @@ tags: impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally. mitre_attack_id: - - T1570 + - T1569.002 observable: - name: user type: User From 9c7ecd13641907bae6bb515b86939ed5d4a7676d Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 10 Dec 2024 10:08:07 -0800 Subject: [PATCH 2/7] deprecated --- .../windows_lateral_tool_transfer_remcom.yml | 6 +- .../windows_service_execution_remcom.yml | 78 +++++++++++++++++++ 2 files changed, 81 insertions(+), 3 deletions(-) rename detections/{endpoint => deprecated}/windows_lateral_tool_transfer_remcom.yml (84%) create mode 100644 detections/endpoint/windows_service_execution_remcom.yml diff --git a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml similarity index 84% rename from detections/endpoint/windows_lateral_tool_transfer_remcom.yml rename to detections/deprecated/windows_lateral_tool_transfer_remcom.yml index 6f701e6fd5..9f7c73424b 100644 --- a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml +++ b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml @@ -4,12 +4,12 @@ version: 4 date: '2024-09-30' author: Michael Haag, Splunk type: TTP -status: production +status: deprecated data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -description: The following analytic identifies the execution of RemCom.exe, an open-source alternative to PsExec, used for lateral movement and remote command execution. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, original file names, and command-line arguments. This activity is significant as it indicates potential lateral movement within the network. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to further compromise and control over additional systems within the network. +description: NOTE - This search is deprecated in favor of `Windows Service Execution RemCom` as the latter is a more accurate name for the detection. The following analytic identifies the execution of RemCom.exe, an open-source alternative to PsExec, used for lateral movement and remote command execution. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, original file names, and command-line arguments. This activity is significant as it indicates potential lateral movement within the network. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to further compromise and control over additional systems within the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process IN ("*/user:*", "*/pwd:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lateral_tool_transfer_remcom_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: False positives may be present based on Administrative use. Filter as needed. @@ -33,7 +33,7 @@ tags: impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally. mitre_attack_id: - - T1569.002 + - T1570 observable: - name: user type: User diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml new file mode 100644 index 0000000000..206a1fab2f --- /dev/null +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -0,0 +1,78 @@ +name: Windows Service Execution RemCom +id: e373xx40-5bdc-47ef-b2fd-9cc7xxf387f0 +version: 1 +date: '2024-09-30' +author: Michael Haag, Splunk +type: TTP +status: production +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +description: The following analytic identifies the execution of RemCom.exe, an open-source alternative to PsExec, used for lateral movement and remote command execution. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, original file names, and command-line arguments. This activity is significant as it indicates potential lateral movement within the network. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to further compromise and control over additional systems within the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process IN ("*/user:*", "*/pwd:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_execution_remcom_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: False positives may be present based on Administrative use. Filter as needed. +references: +- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ +- https://github.com/kavika13/RemCom +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 50 + impact: 80 + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally. + mitre_attack_id: + - T1569.002 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Attacker + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/remcom/remcom_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog From 15e09c8d459fe493c1cd20784e9091adaab53f9b Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 10 Dec 2024 10:14:22 -0800 Subject: [PATCH 3/7] updating uuid --- detections/endpoint/windows_service_execution_remcom.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index 206a1fab2f..bd72d6e364 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -1,5 +1,5 @@ name: Windows Service Execution RemCom -id: e373xx40-5bdc-47ef-b2fd-9cc7xxf387f0 +id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 version: 1 date: '2024-09-30' author: Michael Haag, Splunk From 7f90a9b0546ec53a0389f7f06ae09c2b52cc668a Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 10 Dec 2024 10:27:11 -0800 Subject: [PATCH 4/7] dates --- .../deprecated/windows_lateral_tool_transfer_remcom.yml | 4 ++-- detections/endpoint/windows_service_execution_remcom.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml index 9f7c73424b..167e76f761 100644 --- a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml +++ b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml @@ -1,7 +1,7 @@ name: Windows Lateral Tool Transfer RemCom id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0 -version: 4 -date: '2024-09-30' +version: 5 +date: '2024-12-10' author: Michael Haag, Splunk type: TTP status: deprecated diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index bd72d6e364..522fb40335 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -1,7 +1,7 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 version: 1 -date: '2024-09-30' +date: '2024-12-10' author: Michael Haag, Splunk type: TTP status: production From 5f5431b93baf34a317c2dfd91395277327076536 Mon Sep 17 00:00:00 2001 From: research-bot Date: Thu, 12 Dec 2024 15:12:56 -0800 Subject: [PATCH 5/7] updating net search-slack usergroup --- .../create_or_delete_windows_shares_using_net_exe.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 7f37a0fc6b..b7c2d5d2de 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -1,7 +1,7 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c -version: 9 -date: '2024-09-30' +version: 10 +date: '2024-12-12' author: Bhavin Patel, Splunk status: production type: TTP @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter`' +search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search process IN ("*share* /delete*", "*share* /REMARK:*", "*share* /CACHE:*") | `create_or_delete_windows_shares_using_net_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate. references: From e5267374a0a2a8697208bb5d17e0c9a75cf5e438 Mon Sep 17 00:00:00 2001 From: research-bot Date: Thu, 12 Dec 2024 15:19:08 -0800 Subject: [PATCH 6/7] updating local admin search --- detections/endpoint/detect_new_local_admin_account.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 4aa7e2f628..f941f502fc 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -9,7 +9,13 @@ description: The following analytic detects the creation of new accounts elevate data_source: - Windows Event Log Security 4732 - Windows Event Log Security 4720 -search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) | transaction src_user connected=false maxspan=180m | rename src_user as user | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`' +search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) +| transaction user dest connected=false maxspan=180m +| stats count min(_time) as firstTime max(_time) as lastTime dc(EventCode) as distinct_eventcodes by src_user user dest +| where distinct_eventcodes>1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_new_local_admin_account_filter`' how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives references: [] From 88a2b67ddcfc50bc8a5a91657981a8aedf3a0084 Mon Sep 17 00:00:00 2001 From: research-bot Date: Thu, 12 Dec 2024 15:23:44 -0800 Subject: [PATCH 7/7] version bump --- detections/endpoint/detect_new_local_admin_account.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index f941f502fc..d15216ca68 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -1,7 +1,7 @@ name: Detect New Local Admin account id: b25f6f62-0712-43c1-b203-083231ffd97d -version: 5 -date: '2024-09-30' +version: 6 +date: '2024-12-12' author: David Dorsey, Splunk status: production type: TTP