diff --git a/.github/labeler.yml b/.github/labeler.yml index 98a5d03fc0..81eac35c58 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -2,7 +2,6 @@ Detections: - changed-files: - any-glob-to-any-file: - detections/** - - dev/** Stories: - changed-files: diff --git a/dev/endpoint/7zip_commandline_to_smb_share_path.yml b/dev/endpoint/7zip_commandline_to_smb_share_path.yml deleted file mode 100644 index 1029be3c83..0000000000 --- a/dev/endpoint/7zip_commandline_to_smb_share_path.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: 7zip CommandLine To SMB Share Path -id: 01d29b48-ff6f-11eb-b81e-acde48001122 -version: 1 -date: '2021-08-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This search is to detect a suspicious 7z process with commandline pointing - to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z - to archive a sensitive files and place it in network share tmp folder. This search - is a good hunting query that may give analyst a hint why specific user try to archive - a file pointing to SMB user which is un usual. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: 7z.exe - selection2: - Image|endswith: - - 7z.exe - - 7za.exe - selection3: - OriginalFileName: 7za.exe - selection4: - CommandLine: - - '*\\C$\\*' - - '*\\Admin$\\*' - - '*\\IPC$\\*' - condition: (selection1 or selection2 or selection3) and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used. -known_false_positives: unknown -references: -- https://threadreaderapp.com/thread/1423361119926816776.html -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: archive process $process_name$ with suspicious cmdline $process$ in host - $dest$ - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: SourceImage - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/active_setup_registry_autostart.yml b/dev/endpoint/active_setup_registry_autostart.yml deleted file mode 100644 index c7d6b9943a..0000000000 --- a/dev/endpoint/active_setup_registry_autostart.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Active Setup Registry Autostart -id: f64579c0-203f-11ec-abcc-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious modification of the active setup - registry for persistence and privilege escalation. This technique was seen in several - malware (poisonIvy), adware and APT to gain persistence to the compromised machine - upon boot up. This TTP is a good indicator to further check the process id that - do the modification since modification of this registry is not commonly done. check - the legitimacy of the file and process involve in this rules to check if it is a - valid setup installer that creating or modifying this registry. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*' - Registry.registry_value_name: StubPath - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: Active setup installer may add or modify this registry. -references: -- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FPoisonivy.E -- https://attack.mitre.org/techniques/T1547/014/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 80 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1547.014 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/add_defaultuser_and_password_in_registry.yml b/dev/endpoint/add_defaultuser_and_password_in_registry.yml deleted file mode 100644 index 11ddff6a47..0000000000 --- a/dev/endpoint/add_defaultuser_and_password_in_registry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Add DefaultUser And Password In Registry -id: d4a3eb62-0f1e-11ec-a971-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: this search is to detect a suspicious registry modification to implement - auto admin logon to a host. This technique was seen in BlackMatter ransomware to - automatically logon to the compromise host after triggering a safemode boot to - continue encrypting the whole network. This behavior is not a common practice and - really a suspicious TTP or alert need to be consider if found within then network - premise. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - DefaultPassword - - DefaultUserName - TargetObject: '*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ - to prepare autoadminlogon - mitre_attack_id: - - T1552.002 - - T1552 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/add_or_set_windows_defender_exclusion.yml b/dev/endpoint/add_or_set_windows_defender_exclusion.yml deleted file mode 100644 index 59c0466560..0000000000 --- a/dev/endpoint/add_or_set_windows_defender_exclusion.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Add or Set Windows Defender Exclusion -id: 773b66fe-4dd9-11ec-8289-acde48001122 -version: 1 -date: '2021-11-25' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic will identify a suspicious process command-line related - to Windows Defender exclusion feature. This command is abused by adversaries, malware - authors and red teams to bypass Windows Defender Antivirus products by excluding - folder path, file path, process and extensions. From its real time or schedule scan - to execute their malicious code. This is a good indicator for defense evasion and - to look further for events after this behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-exclusion*' - selection2: - CommandLine: - - '*Add-MpPreference *' - - '*Set-MpPreference *' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Admin or user may choose to use this windows features. Filter - as needed. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Remcos - - Windows Defense Evasion Tactics - - WhisperGate - - CISA AA22-320A - - AgentTesla - asset_type: Endpoint - confidence: 80 - impact: 80 - message: exclusion command $process$ executed on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/dev/endpoint/allow_file_and_printing_sharing_in_firewall.yml deleted file mode 100644 index 7ec19ecfed..0000000000 --- a/dev/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Allow File And Printing Sharing In Firewall -id: ce27646e-d411-11eb-8a00-acde48001122 -version: 2 -date: '2021-06-23' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of firewall to allow - file and printer sharing. This technique was seen in ransomware to be able to discover - more machine connected to the compromised host to encrypt more files -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: '*firewall*' - selection4: - CommandLine: '*group=' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: network admin may modify this firewall feature that may cause - this rule to be triggered. -references: -- https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469 -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: '' - mitre_attack_id: - - T1562.007 - - T1562 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/dev/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml deleted file mode 100644 index ce9b69f5b1..0000000000 --- a/dev/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Allow Inbound Traffic By Firewall Rule Registry -id: 0a46537c-be02-11eb-92ca-acde48001122 -version: 3 -date: '2022-07-19' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic detects a potential suspicious modification of firewall - rule registry allowing inbound traffic in specific port with public profile. This - technique was identified when an adversary wants to grant remote access to a machine - by allowing the traffic in a firewall rule. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '*|Action=' - TargetObject: '*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*' - selection2: - Details: '*|Dir=' - selection3: - Details: '*|LPort=' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network admin may add/remove/modify public inbound firewall - rule that may cause this rule to be triggered. -references: -- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps -tags: - analytic_story: - - Prohibited Traffic Allowed or Protocol Mismatch - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Suspicious firewall allow rule modifications were detected via the registry - on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_network_discovery_in_firewall.yml b/dev/endpoint/allow_network_discovery_in_firewall.yml deleted file mode 100644 index 31f2980d05..0000000000 --- a/dev/endpoint/allow_network_discovery_in_firewall.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Allow Network Discovery In Firewall -id: ccd6a38c-d40b-11eb-85a5-acde48001122 -version: 2 -date: '2021-06-23' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification to the firewall to - allow network discovery on a machine. This technique was seen in couple of ransomware - (revil, reddot) to discover other machine connected to the compromised host to encrypt - more files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: '*firewall*' - selection4: - CommandLine: '*group=' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: network admin may modify this firewall feature that may cause - this rule to be triggered. -references: -- https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469 -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - - Revil Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: '' - mitre_attack_id: - - T1562.007 - - T1562 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/allow_operation_with_consent_admin.yml b/dev/endpoint/allow_operation_with_consent_admin.yml deleted file mode 100644 index 90ab546a89..0000000000 --- a/dev/endpoint/allow_operation_with_consent_admin.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Allow Operation with Consent Admin -id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies a potential privilege escalation attempt to - perform malicious task. This registry modification is designed to allow the `Consent - Admin` to perform an operation that requires elevation without consent or credentials. - We also found this in some attacker to gain privilege escalation to the compromise - machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ConsentPromptBehaviorAdmin - TargetObject: '*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4 -- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Suspicious registry modification was performed on endpoint $dest$ by user - $user$. This behavior is indicative of privilege escalation. - mitre_attack_id: - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/anomalous_usage_of_7zip.yml b/dev/endpoint/anomalous_usage_of_7zip.yml deleted file mode 100644 index a3752c2383..0000000000 --- a/dev/endpoint/anomalous_usage_of_7zip.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Anomalous usage of 7zip -id: 9364ee8e-a39a-11eb-8f1d-acde48001122 -version: 1 -date: '2021-04-22' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following detection identifies a 7z.exe spawned from `Rundll32.exe` - or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. - It has been observed where an adversary will rename `7z.exe`. Additional coverage - may be required to identify the behavior of renamed instances of `7z.exe`. During - triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture - any files written to disk and analyze as needed. Review parallel processes for additional - behaviors. Typically, archiving files will result in exfiltration. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: '7z.exe' - ParentImage: - - rundll32.exe - - dllhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives should be limited as this behavior is not normal - for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip. -references: -- https://attack.mitre.org/techniques/T1560/001/ -- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ -- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/ -tags: - analytic_story: - - Cobalt Strike - - NOBELIUM Group - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading - of 7zip. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/any_powershell_downloadfile.yml b/dev/endpoint/any_powershell_downloadfile.yml deleted file mode 100644 index 40d82cb52d..0000000000 --- a/dev/endpoint/any_powershell_downloadfile.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Any Powershell DownloadFile -id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadFile` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*DownloadFile*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - - DarkCrystal RAT - asset_type: Endpoint - confidence: 70 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile - within PowerShell. - mitre_attack_id: - - T1059 - - T1059.001 - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/any_powershell_downloadstring.yml b/dev/endpoint/any_powershell_downloadstring.yml deleted file mode 100644 index 783192506b..0000000000 --- a/dev/endpoint/any_powershell_downloadstring.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: Any Powershell DownloadString -id: 4d015ef2-7adf-11eb-95da-acde48001122 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadString` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*.DownloadString*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - HAFNIUM Group - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 70 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString - within PowerShell. - mitre_attack_id: - - T1059 - - T1059.001 - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/attacker_tools_on_endpoint.yml b/dev/endpoint/attacker_tools_on_endpoint.yml deleted file mode 100644 index 6390a7eac3..0000000000 --- a/dev/endpoint/attacker_tools_on_endpoint.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Attacker Tools On Endpoint -id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 2 -date: '2021-11-04' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: This search looks for execution of commonly used attacker tools on an - endpoint. -data_source: -- Sysmon Event ID 1 -search: - selection1: - User: unknown - Computer: unknown - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is usually generated via logs that report process tracking - in your Windows audit settings. -known_false_positives: Some administrator activity can be potentially triggered, please - add those users to the filter macro. -references: [] -tags: - analytic_story: - - Monitor for Unauthorized Software - - XMRig - - SamSam Ransomware - - Unusual Processes - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An attacker tool $process_name$,listed in attacker_tools.csv is executed - on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ - mitre_attack_id: - - T1036.005 - - T1036 - - T1003 - - T1595 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/dev/endpoint/attempt_to_add_certificate_to_untrusted_store.yml deleted file mode 100644 index f042cefc78..0000000000 --- a/dev/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Attempt To Add Certificate To Untrusted Store -id: 6bc5243e-ef36-45dc-9b12-f4a6be131159 -version: 7 -date: '2021-09-16' -author: Patrick Bareiss, Rico Valdez, Splunk -status: production -type: TTP -description: Attempt To Add Certificate To Untrusted Store -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*-addstore*' - condition: (selection1 or selection2) and selection3 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: There may be legitimate reasons for administrators to add a - certificate to the untrusted certificate store. In such cases, this will typically - be done on a large number of systems. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md -tags: - analytic_story: - - Disabling Security Tools - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to add a certificate to the store on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1553.004 - - T1553 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml deleted file mode 100644 index 485f8a8e55..0000000000 --- a/dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Attempted Credential Dump From Registry via Reg exe -id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 7 -date: '2022-11-15' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Monitor for execution of reg.exe with parameters specifying an export - of keys that contain hashed credentials that attackers may try to crack offline. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine|contains: 'save' - Image|endswith: - - cmd.exe - - reg.exe - selection2: - CommandLine: - - '*HKLM\\SAM*' - - '*HKLM\\System*' - - '*HKLM\\Security*' - - '*HKEY_LOCAL_MACHINE\\System*' - - '*HKEY_LOCAL_MACHINE\\SAM*' - - '*HKEY_LOCAL_MACHINE\\Security*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: None identified. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets -tags: - analytic_story: - - Credential Dumping - - DarkSide Ransomware - - Windows Registry Abuse - - Industroyer2 - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to export the registry keys. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/auto_admin_logon_registry_entry.yml b/dev/endpoint/auto_admin_logon_registry_entry.yml deleted file mode 100644 index 201032e6bf..0000000000 --- a/dev/endpoint/auto_admin_logon_registry_entry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Auto Admin Logon Registry Entry -id: 1379d2b8-0f18-11ec-8ca3-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to detect a suspicious registry modification to implement - auto admin logon to a host. This technique was seen in BlackMatter ransomware to - automatically logon to the compromise host after triggering a safemode boot to - continue encrypting the whole network. This behavior is not a common practice and - really a suspicious TTP or alert need to be consider if found within then network - premise. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: AutoAdminLogon - TargetObject: '*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*' - Details: '1' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ - to prepare autoadminlogon - mitre_attack_id: - - T1552.002 - - T1552 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/batch_file_write_to_system32.yml b/dev/endpoint/batch_file_write_to_system32.yml deleted file mode 100644 index 9fd1af3233..0000000000 --- a/dev/endpoint/batch_file_write_to_system32.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Batch File Write to System32 -id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -version: 3 -date: '2022-12-21' -author: Steven Dick, Michael Haag, Rico Valdez, Splunk -status: production -type: TTP -description: The search looks for a batch file (.bat) written to the Windows system - directory tree. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: '*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible for this search to generate a notable event - for a batch file write to a path that includes the string "system32", but is not - the actual Windows system directory. As such, you should confirm the path of the - batch file identified by the search. In addition, a false positive may be generated - by an administrator copying a legitimate batch file in this directory tree. You - should confirm that the activity is legitimate and modify the search to add exclusions, - as necessary. -references: [] -tags: - analytic_story: - - SamSam Ransomware - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ - by user $user$. - mitre_attack_id: - - T1204 - - T1204.002 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/dev/endpoint/bcdedit_command_back_to_normal_mode_boot.yml deleted file mode 100644 index 8642799fca..0000000000 --- a/dev/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Bcdedit Command Back To Normal Mode Boot -id: dc7a8004-0f18-11ec-8c54-acde48001122 -version: 1 -date: '2021-09-06' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious bcdedit commandline to configure - the host from safe mode back to normal boot configuration. This technique was seen - in blackMatter ransomware where it force the compromised host to boot in safe mode - to continue its encryption and bring back to normal boot using bcdedit deletevalue - command. This TTP can be a good alert for host that booted from safe mode forcefully - since it need to modify the boot configuration to bring it back to normal. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/deletevalue*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '*{current}*' - selection3: - CommandLine: '*safeboot*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - asset_type: Endpoint - confidence: 70 - impact: 50 - message: bcdedit process with commandline $process$ to bring back to normal boot - configuration the $dest$ - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/bcdedit_failure_recovery_modification.yml b/dev/endpoint/bcdedit_failure_recovery_modification.yml deleted file mode 100644 index d3faaf5ab1..0000000000 --- a/dev/endpoint/bcdedit_failure_recovery_modification.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: BCDEdit Failure Recovery Modification -id: 809b31d2-5462-11eb-ae93-0242ac130002 -version: 1 -date: '2020-12-21' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for flags passed to bcdedit.exe modifications to the - built-in Windows error recovery boot configurations. This is typically used by ransomware - to prevent recovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*recoveryenabled*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '* no*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. Tune based on parent process names. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 100 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting disable the ability to recover the - endpoint. - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/bits_job_persistence.yml b/dev/endpoint/bits_job_persistence.yml deleted file mode 100644 index 9203b6e706..0000000000 --- a/dev/endpoint/bits_job_persistence.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: BITS Job Persistence -id: e97a5ffe-90bf-11eb-928a-acde48001122 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. - The query identifies the parameters used to create, resume or add a file to a BITS - job. Typically seen combined in a oneliner or ran in sequence. If identified, review - the BITS job created and capture any files written to disk. It is possible for BITS - to be used to upload files and this may require further network data analysis to - identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: bitsadmin.exe - selection2: - Image|endswith: bitsadmin.exe - selection3: - CommandLine: [] - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives will be present. Typically, applications - will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments - (legitimate applications) or parent process. -references: -- https://attack.mitre.org/techniques/T1197/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute -- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ -tags: - analytic_story: - - BITS Jobs - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to persist using BITS. - mitre_attack_id: - - T1197 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/bitsadmin_download_file.yml b/dev/endpoint/bitsadmin_download_file.yml deleted file mode 100644 index b6ad41c1cb..0000000000 --- a/dev/endpoint/bitsadmin_download_file.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: BITSAdmin Download File -id: 80630ff4-8e4c-11eb-aab5-acde48001122 -version: 3 -date: '2022-11-29' -author: Michael Haag, Sittikorn S -status: production -type: TTP -description: The following query identifies Microsoft Background Intelligent Transfer - Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote - object. In addition, look for `download` or `upload` on the command-line, the switches - are not required to perform a transfer. Capture any files downloaded. Review the - reputation of the IP or domain used. Typically once executed, a follow on command - will be used to execute the dropped file. Note that the network connection or file - modification events related will not spawn or create from `bitsadmin.exe`, but the - artifacts will appear in a parallel process of `svchost.exe` with a command-line - similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel - and child processes to capture any behaviors and artifacts. In some suspicious and - malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` - to list out the jobs during investigation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: bitsadmin.exe - selection2: - Image|endswith: bitsadmin.exe - selection3: - CommandLine: - - '*transfer*' - - '*addfile*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives, however it may be required to filter - based on parent process name or network connection. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download -- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md -- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -tags: - analytic_story: - - Ingress Tool Transfer - - BITS Jobs - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a file. - mitre_attack_id: - - T1197 - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/dev/endpoint/certutil_download_with_urlcache_and_split_arguments.yml deleted file mode 100644 index 080c4d0410..0000000000 --- a/dev/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: CertUtil Download With URLCache and Split Arguments -id: 415b4306-8bfb-11eb-85c4-acde48001122 -version: 3 -date: '2022-02-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: Certutil.exe may download a file from a remote destination using `-urlcache`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - However, it is uncommon for `certutil.exe` to write files to world writeable paths. - - During triage, capture any files on disk and review. Review the reputation of the - remote IP or domain in question. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*split*' - selection4: - CommandLine: '*urlcache*' - selection5: - CommandLine: '*urlcache*' - condition: (selection1 or selection2) and selection3 and selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -- https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - - ProxyNotShell - - CISA AA22-277A - - Forest Blizzard - - Flax Typhoon - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a file. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/dev/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml deleted file mode 100644 index 7e21422a16..0000000000 --- a/dev/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: CertUtil Download With VerifyCtl and Split Arguments -id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -version: 3 -date: '2022-02-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. - This behavior does require a URL to be passed on the command-line. In addition, - `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will - be used. It is not entirely common for `certutil.exe` to contact public IP space. - \ During triage, capture any files on disk and review. Review the reputation of - the remote IP or domain in question. Using `-VerifyCtl`, the file will either be - written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*split*' - selection4: - CommandLine: '*verifyctl*' - selection5: - CommandLine: '*verifyctl*' - condition: (selection1 or selection2) and selection3 and selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives in most environments, however tune - as needed based on parent-child relationship or network connection. -references: -- https://attack.mitre.org/techniques/T1105/ -- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl -- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats -tags: - analytic_story: - - Ingress Tool Transfer - - DarkSide Ransomware - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a file. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/certutil_exe_certificate_extraction.yml b/dev/endpoint/certutil_exe_certificate_extraction.yml deleted file mode 100644 index 45a748bdc1..0000000000 --- a/dev/endpoint/certutil_exe_certificate_extraction.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Certutil exe certificate extraction -id: 337a46be-600f-11eb-ae93-0242ac130002 -version: 2 -date: '2022-07-15' -author: Rod Soto, Splunk -status: production -type: TTP -description: This search looks for arguments to certutil.exe indicating the manipulation - or extraction of Certificate. This certificate can then be used to sign new authentication - tokens specially inside Federated environments such as Windows ADFS. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-exportPFX*' - Image|endswith: certutil.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unless there are specific use cases, manipulating or exporting - certificates using certutil is uncommon. Extraction of certificate has been observed - during attacks such as Golden SAML and other campaigns targeting Federated services. -references: -- https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack -- https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html -tags: - analytic_story: - - Windows Persistence Techniques - - Cloud Federated Credential Abuse - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting export a certificate. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/certutil_with_decode_argument.yml b/dev/endpoint/certutil_with_decode_argument.yml deleted file mode 100644 index 20b2c1e0ed..0000000000 --- a/dev/endpoint/certutil_with_decode_argument.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: CertUtil With Decode Argument -id: bfe94226-8c10-11eb-a4b3-acde48001122 -version: 2 -date: '2021-03-23' -author: Michael Haag, Splunk -status: production -type: TTP -description: CertUtil.exe may be used to `encode` and `decode` a file, including PE - and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` - and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded - file that was downloaded. Once decoded, it will be loaded by a parallel process. - Note that there are two additional command switches that may be used - `encodehex` - and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for - further execution. During triage, identify the source of the file being decoded. - Review its contents or execution behavior for further analysis. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CertUtil.exe - selection2: - Image|endswith: certutil.exe - selection3: - CommandLine: '*decode*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Typically seen used to `encode` files, but it is possible to - see legitimate use of `decode`. Filter based on parent-child relationship, file - paths, endpoint or user. -references: -- https://attack.mitre.org/techniques/T1140/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil -- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ -tags: - analytic_story: - - Deobfuscate-Decode Files or Information - - Living Off The Land - - Forest Blizzard - asset_type: Endpoint - confidence: 80 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to decode a file. - mitre_attack_id: - - T1140 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/change_default_file_association.yml b/dev/endpoint/change_default_file_association.yml deleted file mode 100644 index a1191c7eed..0000000000 --- a/dev/endpoint/change_default_file_association.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Change Default File Association -id: 462d17d8-1f71-11ec-ad07-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is developed to detect suspicious registry modification - to change the default file association of windows to malicious payload. This technique - was seen in some APT where it modify the default process to run file association, - like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other - payload that will load malicious commands to the compromised host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*HKCR\\*' - selection2: - TargetObject: '*\\shell\\open\\command\\*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - - Prestige Ransomware - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1546.001 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/change_to_safe_mode_with_network_config.yml b/dev/endpoint/change_to_safe_mode_with_network_config.yml deleted file mode 100644 index 46fa7ce7f0..0000000000 --- a/dev/endpoint/change_to_safe_mode_with_network_config.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Change To Safe Mode With Network Config -id: 81f1dce0-0f18-11ec-a5d7-acde48001122 -version: 1 -date: '2021-09-06' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious bcdedit commandline to configure - the host to boot in safe mode with network config. This technique was seen in blackMatter - ransomware where it force the compromised host to boot in safe mode to continue - its encryption and bring back to normal boot using bcdedit deletevalue command. - This TTP can be a good alert for host that booted from safe mode forcefully since - it need to modify the boot configuration to bring it back to normal. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/set*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '*{current}*' - selection3: - CommandLine: '*safeboot*' - selection4: - CommandLine: '*network*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ -tags: - analytic_story: - - BlackMatter Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: bcdedit process with commandline $process$ to force safemode boot the $dest$ - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/chcp_command_execution.yml b/dev/endpoint/chcp_command_execution.yml deleted file mode 100644 index fb9193c680..0000000000 --- a/dev/endpoint/chcp_command_execution.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: CHCP Command Execution -id: 21d236ec-eec1-11eb-b23e-acde48001122 -version: 1 -date: '2021-07-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect execution of chcp.exe application. this utility - is used to change the active code page of the console. This technique was seen in - icedid malware to know the locale region/language/country of the compromise host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: cmd.exe - Image|endswith: chcp.com - ParentCommandLine: '*/c*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. -known_false_positives: other tools or script may used this to change code page to - UTF-* or others -references: -- https://ss64.com/nt/chcp.html -- https://twitter.com/tccontre18/status/1419941156633329665?s=20 -tags: - analytic_story: - - IcedID - - Azorult - asset_type: Endpoint - confidence: 30 - impact: 30 - message: parent process $parent_process_name$ spawning chcp process $process_name$ - with parent command line $parent_process$ - mitre_attack_id: - - T1059 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/check_elevated_cmd_using_whoami.yml b/dev/endpoint/check_elevated_cmd_using_whoami.yml deleted file mode 100644 index 555c7e77a2..0000000000 --- a/dev/endpoint/check_elevated_cmd_using_whoami.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Check Elevated CMD using whoami -id: a9079b18-1633-11ec-859c-acde48001122 -version: 1 -date: '2021-09-15' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious whoami execution to check if the - cmd or shell instance process is with elevated privileges. This technique was seen - in FIN7 js implant where it execute this as part of its data collection to the infected - machine to check if the running shell cmd process is elevated or not. This TTP is - really a good alert for known attacker that recon on the targetted host. This command - is not so commonly executed by a normal user or even an admin to check if a process - is elevated. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/group*' - selection2: - CommandLine: '*whoami*' - selection3: - CommandLine: '* find *' - selection4: - CommandLine: '*12288*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: [] -tags: - analytic_story: - - FIN7 - asset_type: Endpoint - confidence: 80 - impact: 70 - message: Process name $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/child_processes_of_spoolsv_exe.yml b/dev/endpoint/child_processes_of_spoolsv_exe.yml deleted file mode 100644 index b475a2feed..0000000000 --- a/dev/endpoint/child_processes_of_spoolsv_exe.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Child Processes of Spoolsv exe -id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -version: 3 -date: '2020-03-16' -author: Rico Valdez, Splunk -status: experimental -type: TTP -description: This search looks for child processes of spoolsv.exe. This activity is - associated with a POC privilege-escalation exploit associated with CVE-2018-8440. - Spoolsv.exe is the process associated with the Print Spooler service in Windows - and typically runs as SYSTEM. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: regsvr32.exe - ParentImage: spoolsv.exe - condition: selection1 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro - to filter out legitimate child processes spawned by spoolsv.exe. -known_false_positives: Some legitimate printer-related processes may show up as children - of spoolsv.exe. You should confirm that any activity as legitimate and may be added - as exclusions in the search. -references: [] -tags: - analytic_story: - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2018-8440 - impact: 50 - message: tbd - mitre_attack_id: - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/clear_unallocated_sector_using_cipher_app.yml b/dev/endpoint/clear_unallocated_sector_using_cipher_app.yml deleted file mode 100644 index da2642da0d..0000000000 --- a/dev/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Clear Unallocated Sector Using Cipher App -id: cd80a6ac-c9d9-11eb-8839-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to detect execution of `cipher.exe` to clear the unallocated - sectors of a specific disk. This technique was seen in some ransomware to make it - impossible to forensically recover deleted files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/w:*' - Image|endswith: cipher.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: administrator may execute this app to manage disk -references: -- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ -- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 100 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors - of a specific disk. - mitre_attack_id: - - T1070.004 - - T1070 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/cmd_carry_out_string_command_parameter.yml b/dev/endpoint/cmd_carry_out_string_command_parameter.yml deleted file mode 100644 index 0c9ac0cdfe..0000000000 --- a/dev/endpoint/cmd_carry_out_string_command_parameter.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: CMD Carry Out String Command Parameter -id: 54a6ed00-3256-11ec-b031-acde48001122 -version: 3 -date: '2022-01-18' -author: Teoderick Contreras, Bhavin Patel, Splunk -status: production -type: Hunting -description: The following analytic identifies command-line arguments where `cmd.exe - /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and - terminate after command or process completion. This technique is commonly seen in - adversaries and malware to execute batch command using different shell like PowerShell - or different process other than `cmd.exe`. This is a good hunting query for suspicious - command-line made by a script or relative process execute it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '* /c *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be high based on legitimate scripted code - in any environment. Filter as needed. -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Data Destruction - - IcedID - - Log4Shell CVE-2021-44228 - - WhisperGate - - Hermetic Wiper - - Living Off The Land - - Azorult - - DarkCrystal RAT - - ProxyNotShell - - Qakbot - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-44228 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting spawn a new process. - mitre_attack_id: - - T1059.003 - - T1059 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/cmd_echo_pipe___escalation.yml b/dev/endpoint/cmd_echo_pipe___escalation.yml deleted file mode 100644 index 9bea5fb4b6..0000000000 --- a/dev/endpoint/cmd_echo_pipe___escalation.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: CMD Echo Pipe - Escalation -id: eb277ba0-b96b-11eb-b00e-acde48001122 -version: 2 -date: '2021-05-20' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies a common behavior by Cobalt Strike and other - frameworks where the adversary will escalate privileges, either via `jump` (Cobalt - Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will - look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '*%comspec%*' - selection4: - CommandLine: '*pipe*' - selection5: - CommandLine: '*echo*' - condition: (selection1 or selection2) or selection3 or selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Unknown. It is possible filtering may be required to ensure - fidelity. -references: -- https://redcanary.com/threat-detection-report/threats/cobalt-strike/ -- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ potentially performing privilege escalation - using named pipes related to Cobalt Strike and other frameworks. - mitre_attack_id: - - T1059 - - T1059.003 - - T1543.003 - - T1543 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/dev/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml deleted file mode 100644 index 035520c1c2..0000000000 --- a/dev/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Cmdline Tool Not Executed In CMD Shell -id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -version: 2 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a non-standard parent process (not - matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. - This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also - typically seen when an adversary is injected into another process performing different - discovery techniques. This event stands out as a TTP since these tools are commonly - executed with a shell application or Explorer parent, and not by another application. - This TTP is a good indicator for an adversary gathering host information, but one - possible false positive might be an automated tool used by a system administator. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - ipconfig.exe - - systeminfo.exe - - net.exe - - net1.exe - - arp.exe - - nslookup.exe - - route.exe - - netstat.exe - - whoami.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives. Filter as - needed. -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -tags: - analytic_story: - - FIN7 - - Qakbot - - CISA AA22-277A - - Qakbot - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A non-standard parent process $parent_process_name$ spawned child process - $process_name$ to execute command-line tool on $dest$. - mitre_attack_id: - - T1059 - - T1059.007 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/conti_common_exec_parameter.yml b/dev/endpoint/conti_common_exec_parameter.yml deleted file mode 100644 index 6330662933..0000000000 --- a/dev/endpoint/conti_common_exec_parameter.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Conti Common Exec parameter -id: 624919bc-c382-11eb-adcc-acde48001122 -version: 1 -date: '2021-06-02' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search detects the suspicious commandline argument of revil ransomware - to encrypt specific or all local drive and network shares of the compromised machine - or host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-m local*' - - '*-m net*' - - '*-m all*' - - '*-nomutex*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: 3rd party tool may have commandline parameter that can trigger - this detection. -references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ executing specific Conti Ransomware related - parameters. - mitre_attack_id: - - T1204 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/control_loading_from_world_writable_directory.yml b/dev/endpoint/control_loading_from_world_writable_directory.yml deleted file mode 100644 index 4f83c5d740..0000000000 --- a/dev/endpoint/control_loading_from_world_writable_directory.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Control Loading from World Writable Directory -id: 10423ac4-10c9-11ec-8dc4-acde48001122 -version: 1 -date: '2021-09-08' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies control.exe loading either a .cpl - or .inf from a writable directory. This is related to CVE-2021-40444. During triage, - review parallel processes, parent and child, for further suspicious behaviors. In - addition, capture file modifications and analyze. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: CONTROL.EXE - selection2: - Image|endswith: control.exe - selection3: - CommandLine: - - '*\\appdata\\*' - - '*\\windows\\temp\\*' - - '*\\programdata\\*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives will be present as control.exe does - not natively load from writable paths as defined. One may add .cpl or .inf to the - command-line if there is any false positives. Tune as needed. -references: -- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml -tags: - analytic_story: - - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - - Living Off The Land - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-40444 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. - mitre_attack_id: - - T1218 - - T1218.002 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/create_local_admin_accounts_using_net_exe.yml b/dev/endpoint/create_local_admin_accounts_using_net_exe.yml deleted file mode 100644 index e6248c60f3..0000000000 --- a/dev/endpoint/create_local_admin_accounts_using_net_exe.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Create local admin accounts using net exe -id: b89919ed-fe5f-492c-b139-151bb162040e -version: 6 -date: '2021-09-08' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: This search looks for the creation of local administrator accounts using - net.exe . -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/add*' - Image|endswith: - - net1.exe - - net.exe - selection2: - CommandLine: - - '*administratorer*' - - '*amministratori*' - - '*administrador*' - - '*administrateurs*' - - '*administratoren*' - - '*administrators*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Administrators often leverage net.exe to create admin accounts. -references: [] -tags: - analytic_story: - - DHS Report TA18-074A - - Azorult - - CISA AA22-257A - asset_type: Endpoint - confidence: 60 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators - group. - mitre_attack_id: - - T1136.001 - - T1136 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/dev/endpoint/create_or_delete_windows_shares_using_net_exe.yml deleted file mode 100644 index eb61bf41e1..0000000000 --- a/dev/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Create or delete windows shares using net exe -id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c -version: 6 -date: '2020-09-16' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: This search looks for the creation or deletion of hidden shares using - net.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Administrators often leverage net.exe to create or delete network - shares. You should verify that the activity was intentional and is legitimate. -references: -- https://attack.mitre.org/techniques/T1070/005/ -tags: - analytic_story: - - Hidden Cobra Malware - - CISA AA22-277A - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ enumerating Windows file shares. - mitre_attack_id: - - T1070 - - T1070.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/creation_of_shadow_copy.yml b/dev/endpoint/creation_of_shadow_copy.yml deleted file mode 100644 index 5ee4f553c2..0000000000 --- a/dev/endpoint/creation_of_shadow_copy.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Creation of Shadow Copy -id: eb120f5f-b879-4a63-97c1-93352b5df844 -version: 1 -date: '2019-12-10' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow - copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*create*' - Image|endswith: vssadmin.exe - selection2: - CommandLine: '*shadow*' - selection3: - CommandLine: '*shadowcopy*' - Image|endswith: wmic.exe - selection4: - CommandLine: '*create*' - condition: (selection1 and selection2) or selection3 or selection4 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints, to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create - false positives. -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform - offline password cracking. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/dev/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml deleted file mode 100644 index 7da206ee40..0000000000 --- a/dev/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Creation of Shadow Copy with wmic and powershell -id: 2ed8b538-d284-449a-be1d-82ad1dbd186b -version: 3 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: This search detects the use of wmic and Powershell to create a shadow - copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - OriginalFileName: wmic.exe - selection4: - Image|endswith: wmic.exe - selection5: - CommandLine: '*shadowcopy*' - selection6: - CommandLine: '*create*' - condition: (selection1 or selection2) or selection3 or selection4 or selection5 - or selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Legtimate administrator usage of wmic to create a shadow copy. -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Credential Dumping - - Living Off The Land - - Volt Typhoon - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform - offline password cracking. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/dev/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml deleted file mode 100644 index 41d9b85fc0..0000000000 --- a/dev/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Credential Dumping via Copy Command from Shadow Copy -id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b -version: 2 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: This search detects credential dumping using copy command from a shadow - copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: - - '*\\system32\\config\\sam*' - - '*\\system32\\config\\security*' - - '*\\system32\\config\\system*' - - '*\\windows\\ntds\\ntds.dit*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline - password cracking. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/dev/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml deleted file mode 100644 index 536ef93905..0000000000 --- a/dev/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Credential Dumping via Symlink to Shadow Copy -id: c5eac648-fae0-4263-91a6-773df1f4c903 -version: 2 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: This search detects the creation of a symlink to a shadow copy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '*mklink*' - selection4: - CommandLine: '*HarddiskVolumeShadowCopy*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy - to grab credentials. - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/csc_net_on_the_fly_compilation.yml b/dev/endpoint/csc_net_on_the_fly_compilation.yml deleted file mode 100644 index 5400bbd19d..0000000000 --- a/dev/endpoint/csc_net_on_the_fly_compilation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: CSC Net On The Fly Compilation -id: ea73128a-43ab-11ec-9753-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: this analytic is to detect a suspicious compile before delivery approach - of .net compiler csc.exe. This technique was seen in several adversaries, malware - and even in red teams to take advantage the csc.exe .net compiler tool to compile - on the fly a malicious .net code to evade detection from security product. This - is a good hunting query to check further the file or process created after this - event and check the file path that passed to csc.exe which is the .net code. Aside - from that, powershell is capable of using this compiler in executing .net code in - a powershell script so filter on that case is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: csc.exe - selection2: - Image|endswith: csc.exe - selection3: - CommandLine: '*/noconfig*' - selection4: - CommandLine: '*/fullpaths*' - selection5: - CommandLine: '*@*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated powershell script taht execute .net code that may generate false positive. - filter is needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 50 - impact: 50 - message: csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ - mitre_attack_id: - - T1027.004 - - T1027 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/curl_download_and_bash_execution.yml b/dev/endpoint/curl_download_and_bash_execution.yml deleted file mode 100644 index ca56a403dc..0000000000 --- a/dev/endpoint/curl_download_and_bash_execution.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Curl Download and Bash Execution -id: 900bc324-59f3-11ec-9fb4-acde48001122 -version: 1 -date: '2021-12-10' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of curl on Linux or MacOS attempting - to download a file from a remote source and pipe it to bash. This is typically found - with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-s *' - Image|endswith: curl - selection2: - CommandLine: '*bash*' - selection3: - CommandLine: '*|*' - condition: (selection1) or selection2 or selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. If the EDR is not parsing the pipe bash in the command-line, - modifying the analytic will be required. Add parent process name (Processes.parent_process_name) - as needed to filter. -known_false_positives: False positives should be limited, however filtering may be - required. -references: -- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 -tags: - analytic_story: - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - - Linux Living Off The Land - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ attempting - to download a remote file and run it with bash. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/deleting_shadow_copies.yml b/dev/endpoint/deleting_shadow_copies.yml deleted file mode 100644 index e1e7be3c21..0000000000 --- a/dev/endpoint/deleting_shadow_copies.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Deleting Shadow Copies -id: b89919ed-ee5f-492c-b139-95dbb162039e -version: 4 -date: '2020-11-09' -author: David Dorsey, Splunk -status: production -type: TTP -description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy - Service. Wmic is an interface to the Windows Management Instrumentation. This - search looks for either of these tools being used to delete shadow copies. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*delete*' - Image|endswith: - - wmic.exe - - vssadmin.exe - selection2: - CommandLine: '*shadow*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped - with modern versions of windows. They may be used by administrators to legitimately - delete old backup copies, although this is typically rare. -references: [] -tags: - analytic_story: - - Windows Log Manipulation - - SamSam Ransomware - - Ransomware - - Clop Ransomware - - CISA AA22-264A - - Prestige Ransomware - asset_type: Endpoint - confidence: 90 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to delete shadow copies. - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_azurehound_command_line_arguments.yml b/dev/endpoint/detect_azurehound_command_line_arguments.yml deleted file mode 100644 index 0880949b56..0000000000 --- a/dev/endpoint/detect_azurehound_command_line_arguments.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Detect AzureHound Command-Line Arguments -id: 26f02e96-c300-11eb-b611-acde48001122 -version: 1 -date: '2021-06-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the common command-line argument used - by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may - be modified, but these changes are dependent upon the operator. In most instances - the defaults are used. This analytic works to identify the common command-line attributes - used. It does not cover the entirety of every argument in order to avoid false positives. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*invoke-azurehound*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. -references: -- https://attack.mitre.org/software/S0521/ -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 -- https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1 -tags: - analytic_story: - - Discovery Techniques - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_azurehound_file_modifications.yml b/dev/endpoint/detect_azurehound_file_modifications.yml deleted file mode 100644 index 8ad871806e..0000000000 --- a/dev/endpoint/detect_azurehound_file_modifications.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Detect AzureHound File Modifications -id: 1c34549e-c31b-11eb-996b-acde48001122 -version: 1 -date: '2021-06-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic is similar to SharpHound file modifications, but - this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound - equivilent but for Azure. It's possible this may never be seen in an environment - as most attackers may execute this tool remotely. Once execution is complete, a - zip file with a similar name will drop `20210601090751-azurecollection.zip`. In - addition to the zip, multiple .json files will be written to disk, which are in - the zip. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: - - '*-azurecollection.zip' - - '*-azprivroleadminrights.json' - - '*-azglobaladminrights.json' - - '*-azcloudappadmins.json' - - '*-azapplicationadmins.json' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on file modifications that include the name of the process, and file, responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` - node. -known_false_positives: False positives should be limited as the analytic is specific - to a filename with extension .zip. Filter as needed. -references: -- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 -- https://github.com/BloodHoundAD/Legacy-AzureHound.ps1/blob/master/AzureHound.ps1 -tags: - analytic_story: - - Discovery Techniques - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A file - $file_name$ was written to disk that is related to AzureHound, - a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_exchange_web_shell.yml b/dev/endpoint/detect_exchange_web_shell.yml deleted file mode 100644 index 2bb368883b..0000000000 --- a/dev/endpoint/detect_exchange_web_shell.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: Detect Exchange Web Shell -id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a -version: 4 -date: '2022-09-30' -author: Michael Haag, Shannon Davis, David Dorsey, Splunk -status: production -type: TTP -description: 'The following query identifies suspicious .aspx created in 3 paths identified - by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM - group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths - include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. - Upon triage, the suspicious .aspx file will likely look obvious on the surface. - inspect the contents for script code inside. Identify additional log sources, IIS - included, to review source and other potential exploitation. It is often the case - that a particular threat is only applicable to a specific subset of systems in your - environment. Typically analytics to detect those threats are written without the - benefit of being able to only target those systems as well. Writing analytics against - all systems when those behaviors are limited to identifiable subsets of those systems - is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange - Servers. With asset information, a hunter can limit their analytics to systems that - have been identified as Exchange servers. A hunter may start with the theory that - the exchange server is communicating with new systems that it has not previously. - If this theory is run against all publicly facing systems, the amount of noise it - will generate will likely render this theory untenable. However, using the asset - information to limit this analytic to just the Exchange servers will reduce the - noise allowing the hunter to focus only on the systems where this behavioral change - is relevant.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: System - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -references: -- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://www.youtube.com/watch?v=FC6iHw258RI -- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do -tags: - analytic_story: - - HAFNIUM Group - - ProxyShell - - CISA AA22-257A - - ProxyNotShell - asset_type: Endpoint - confidence: 90 - impact: 90 - message: A file - $file_name$ was written to disk that is related to IIS exploitation - previously performed by HAFNIUM. Review further file modifications on endpoint - $dest$ by user $user$. - mitre_attack_id: - - T1505 - - T1505.003 - - T1190 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_renamed.yml b/dev/endpoint/detect_html_help_renamed.yml deleted file mode 100644 index 6d6b43960e..0000000000 --- a/dev/endpoint/detect_html_help_renamed.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Detect HTML Help Renamed -id: 62fed254-513b-460e-953d-79771493a9f3 -version: 4 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies a renamed instance of hh.exe (HTML - Help) executing a Compiled HTML Help (CHM). This particular technique will load - Windows script code from a compiled help file. CHM files may contain nearly any - file type embedded, but only execute html/htm. Upon a successful execution, the - following script engines may be used for execution - JScript, VBScript, VBScript.Encode, - JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll - loading into hh.exe upon execution. The "htm" and "html" file extensions were the - only extensions observed to be supported for the execution of Shortcut commands - or WSH script code. During investigation, identify script content origination. Validate - it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively - found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - Image|endswith: hh.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely a renamed instance of hh.exe will be used - legitimately, filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_spawn_child_process.yml b/dev/endpoint/detect_html_help_spawn_child_process.yml deleted file mode 100644 index d03e875e79..0000000000 --- a/dev/endpoint/detect_html_help_spawn_child_process.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Detect HTML Help Spawn Child Process -id: 723716de-ee55-4cd4-9759-c44e7e55ba4b -version: 1 -date: '2021-02-11' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) that spawns a child process. This particular technique will load - Windows script code from a compiled help file. CHM files may contain nearly any - file type embedded, but only execute html/htm. Upon a successful execution, the - following script engines may be used for execution - JScript, VBScript, VBScript.Encode, - JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll - loading into hh.exe upon execution. The "htm" and "html" file extensions were the - only extensions observed to be supported for the execution of Shortcut commands - or WSH script code. During investigation, identify script content origination. Review - child process events and investigate further. hh.exe is natively found in C:\Windows\system32 - and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: hh.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) - may spawn a child process. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - - AgentTesla - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ spawning a child process, typically not normal - behavior. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_url_in_command_line.yml b/dev/endpoint/detect_html_help_url_in_command_line.yml deleted file mode 100644 index be013293f6..0000000000 --- a/dev/endpoint/detect_html_help_url_in_command_line.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Detect HTML Help URL in Command Line -id: 8c5835b9-39d9-438b-817c-95f14c69a31e -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file from a remote url. This particular technique will load Windows - script code from a compiled help file. CHM files may contain nearly any file type - embedded, but only execute html/htm. Upon a successful execution, the following - script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, - JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe - upon execution. The "htm" and "html" file extensions were the only extensions observed - to be supported for the execution of Shortcut commands or WSH script code. During - investigation, identify script content origination. Review reputation of remote - IP and domain. Some instances, it is worth decompiling the .chm file to review its - original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - selection2: - Image|endswith: hh.exe - selection3: - CommandLine: '*http*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may retrieve - a CHM remotely, filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://blog.sevagas.com/?Hacking-around-HTA-files -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_proces_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ contacting a remote destination to potentally - download a malicious payload. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/dev/endpoint/detect_html_help_using_infotech_storage_handlers.yml deleted file mode 100644 index 1232a942dc..0000000000 --- a/dev/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Detect HTML Help Using InfoTech Storage Handlers -id: 0b2eefa5-5508-450d-b970-3dd2fb761aec -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled - HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique - will load Windows script code from a compiled help file, using InfoTech Storage - Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are - supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm - file from within a CHM file. CHM files may contain nearly any file type embedded. - Upon a successful execution, the following script engines may be used for execution - - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may - identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" - and "html" file extensions were the only extensions observed to be supported for - the execution of Shortcut commands or WSH script code. During investigation, identify - script content origination. hh.exe is natively found in C:\Windows\system32 and - C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - selection2: - Image|endswith: hh.exe - selection3: - CommandLine: - - '*its:*' - - '*mk:@MSITStore:*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is rare to see instances of InfoTech Storage Handlers being - used, but it does happen in some legitimate instances. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://www.kb.cert.org/vuls/id/851869 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 -- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 80 - message: $process_name$ has been identified using Infotech Storage Handlers to load - a specific file within a CHM on $dest$ under user $user$. - mitre_attack_id: - - T1218 - - T1218.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_mshta_inline_hta_execution.yml b/dev/endpoint/detect_mshta_inline_hta_execution.yml deleted file mode 100644 index acda7a6efa..0000000000 --- a/dev/endpoint/detect_mshta_inline_hta_execution.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Detect mshta inline hta execution -id: a0873b32-5b68-11eb-ae93-0242ac130002 -version: 6 -date: '2021-09-16' -author: Bhavin Patel, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies "mshta.exe" execution with inline protocol - handlers. "JavaScript", "VBScript", and "About" are the only supported options when - invoking HTA content directly on the command-line. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "mshta.exe" and its parent process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSHTA.EXE - selection2: - Image|endswith: mshta.exe - selection3: - CommandLine: - - '*vbscript*' - - '*javascript*' - - '*about*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 90 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense - evasion. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_mshta_renamed.yml b/dev/endpoint/detect_mshta_renamed.yml deleted file mode 100644 index 99c5eb03d7..0000000000 --- a/dev/endpoint/detect_mshta_renamed.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Detect mshta renamed -id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed instances of mshta.exe executing. - Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This - analytic utilizes the internal name of the PE to identify if is the legitimate mshta - binary. Further analysis should be performed to review the executed content and - validation it is the real mshta. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSHTA.EXE - Image|endswith: mshta.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of mshta.exe, but never renamed, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_mshta_url_in_command_line.yml b/dev/endpoint/detect_mshta_url_in_command_line.yml deleted file mode 100644 index 4e5fb6b784..0000000000 --- a/dev/endpoint/detect_mshta_url_in_command_line.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Detect MSHTA Url in Command Line -id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) - utility is used to make remote http connections. Adversaries may use mshta.exe to - proxy the download and execution of remote .hta files. The analytic identifies command - line arguments of http and https being used. This technique is commonly used by - malicious software to bypass preventative controls. The search will return the first - time and last time these command-line arguments were used for these executions, - as well as the target system, the user, process "rundll32.exe" and its parent process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSHTA.EXE - selection2: - Image|endswith: mshta.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible legitimate applications may perform this behavior - and will need to be filtered. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $est$ by user $user$ attempting to access a remote destination to - download an additional payload. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/dev/endpoint/detect_outlook_exe_writing_a_zip_file.yml deleted file mode 100644 index d349ea95d9..0000000000 --- a/dev/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Detect Outlook exe writing a zip file -id: a51bfe1a-94f0-4822-b1e4-16ae10145893 -version: 3 -date: '2020-07-21' -author: Bhavin Patel, Splunk -status: experimental -type: TTP -description: This search looks for execution of process `outlook.exe` where the process - is writing a `.zip` file to the disk. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - outlook.exe - - explorer.exe - condition: selection1 -how_to_implement: You must be ingesting data that records filesystem and process activity - from your hosts to populate the Endpoint data model. This is typically populated - via endpoint detection-and-response product, such as Carbon Black, or endpoint data - sources, such as Sysmon. -known_false_positives: It is not uncommon for outlook to write legitimate zip files - to the disk. -references: [] -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: network diff --git a/dev/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/dev/endpoint/detect_path_interception_by_creation_of_program_exe.yml deleted file mode 100644 index e01cc6c7e5..0000000000 --- a/dev/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Detect Path Interception By Creation Of program exe -id: cbef820c-e1ff-407f-887f-0a9240a2d477 -version: 3 -date: '2020-07-03' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: 'The detection Detect Path Interception By Creation Of program exe is - detecting the abuse of unquoted service paths, which is a popular technique for - privilege escalation. ' -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: services.exe - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: unknown -references: -- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae -tags: - analytic_story: - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to perform privilege escalation by - using unquoted service paths. - mitre_attack_id: - - T1574.009 - - T1574 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/dev/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml deleted file mode 100644 index c621437ac1..0000000000 --- a/dev/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Detect Prohibited Applications Spawning cmd exe -id: dcfd6b40-42f9-469d-a433-2e53f7486664 -version: 6 -date: '2020-11-10' -author: Bhavin Patel, Splunk -status: production -type: Hunting -description: This search looks for executions of cmd.exe spawned by a process that - is often abused by attackers and that does not typically launch cmd.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - condition: (selection1 or selection2) -how_to_implement: You must be ingesting data that records process activity from your - hosts and populates the Endpoint data model with the resultant dataset. This search - includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list - of processes that should not be spawning cmd.exe. You can modify this lookup to - better suit your environment. To successfully implement this search you need to - be ingesting information on process that include the name of the process responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` - node. In addition, confirm the latest CIM App 4.20 or higher is installed and the - latest TA for the endpoint product. -known_false_positives: There are circumstances where an application may legitimately - execute and interact with the Windows command-line interface. Investigate and modify - the lookup file, as appropriate. -references: [] -tags: - analytic_story: - - Suspicious Command-Line Executions - - Suspicious MSHTA Activity - - Suspicious Zoom Child Processes - - NOBELIUM Group - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ running prohibited applications. - mitre_attack_id: - - T1059 - - T1059.003 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_rclone_command_line_usage.yml b/dev/endpoint/detect_rclone_command_line_usage.yml deleted file mode 100644 index b69ec28be1..0000000000 --- a/dev/endpoint/detect_rclone_command_line_usage.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: Detect RClone Command-Line Usage -id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: 2 -date: '2021-11-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies commonly used command-line arguments used by - `rclone.exe` to initiate a file transfer. Some arguments were negated as they are - specific to the configuration used by adversaries. In particular, an adversary may - list the files or directories of the remote file share using `ls` or `lsd`, which - is not indicative of malicious behavior. During triage, at this stage of a ransomware - event, exfiltration is about to occur or has already. Isolate the endpoint and continue - investigating by review file modifications and parallel processes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: rclone.exe - selection2: - OriginalFileName: rclone.exe - selection3: - CommandLine: - - '*copy*' - - '*mega*' - - '*pcloud*' - - '*ftp*' - - '*--config*' - - '*--progress*' - - '*--no-check-certificate*' - - '*--ignore-existing*' - - '*--auto-confirm*' - - '*--transfers*' - - '*--multi-thread-streams*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this is restricted to - the Rclone process name. Filter or tune the analytic as needed. -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ -tags: - analytic_story: - - DarkSide Ransomware - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service - to move files or folders. - mitre_attack_id: - - T1020 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regasm_spawning_a_process.yml b/dev/endpoint/detect_regasm_spawning_a_process.yml deleted file mode 100644 index 8f50892de3..0000000000 --- a/dev/endpoint/detect_regasm_spawning_a_process.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Detect Regasm Spawning a Process -id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f -version: 1 -date: '2021-02-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regasm.exe spawning a process. This - particular technique has been used in the wild to bypass application control products. - Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process - is rare from either process and should be investigated further. During investigation, - identify and retrieve the content being loaded. Review parallel processes for additional - suspicious behavior. Gather any other file modifications and review accordingly. - regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe - and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: regasm.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe - may cause a false positive. Filter based endpoint usage, command line arguments, - or process lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ spawning a child process, typically not normal - behavior for $parent_process_name$. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regasm_with_no_command_line_arguments.yml b/dev/endpoint/detect_regasm_with_no_command_line_arguments.yml deleted file mode 100644 index 80ab542f8f..0000000000 --- a/dev/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Detect Regasm with no Command Line Arguments -id: c3bc1430-04e7-4178-835f-047d8e6e97df -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regasm.exe with no command line arguments. - This particular behavior occurs when another process injects into regasm.exe, no - command line arguments will be present. During investigation, identify any network - connections and parallel processes. Identify any suspicious module loads related - to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` - and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: RegAsm.exe - selection2: - Image|endswith: regasm.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, limited instances of regasm.exe or may cause - a false positive. Filter based endpoint usage, command line arguments, or process - lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The process $process_name$ was spawned by $parent_process_name$ without - any command-line arguments on $dest$ by $user$. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regsvcs_spawning_a_process.yml b/dev/endpoint/detect_regsvcs_spawning_a_process.yml deleted file mode 100644 index 0611d734fe..0000000000 --- a/dev/endpoint/detect_regsvcs_spawning_a_process.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Detect Regsvcs Spawning a Process -id: bc477b57-5c21-4ab6-9c33-668772e7f114 -version: 1 -date: '2021-02-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regsvcs.exe spawning a process. This - particular technique has been used in the wild to bypass application control products. - Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process - is rare from either process and should be investigated further. During investigation, - identify and retrieve the content being loaded. Review parallel processes for additional - suspicious behavior. Gather any other file modifications and review accordingly. - regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe - and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: regsvcs.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe - may cause a false positive. Filter based endpoint usage, command line arguments, - or process lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ typically not normal for this process. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/dev/endpoint/detect_regsvcs_with_no_command_line_arguments.yml deleted file mode 100644 index 7b95ed41d5..0000000000 --- a/dev/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Detect Regsvcs with No Command Line Arguments -id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies regsvcs.exe with no command line arguments. - This particular behavior occurs when another process injects into regsvcs.exe, no - command line arguments will be present. During investigation, identify any network - connections and parallel processes. Identify any suspicious module loads related - to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe - and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: RegSvcs.exe - selection2: - Image|endswith: regsvcs.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause - a false positive. Filter based endpoint usage, command line arguments, or process - lineage. -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -tags: - analytic_story: - - Suspicious Regsvcs Regasm Activity - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The process $process_name$ was spawned by $parent_process_name$ without - any command-line arguments on $dest$ by $user$. - mitre_attack_id: - - T1218 - - T1218.009 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_7_zip.yml b/dev/endpoint/detect_renamed_7_zip.yml deleted file mode 100644 index 0ac2487150..0000000000 --- a/dev/endpoint/detect_renamed_7_zip.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Detect Renamed 7-Zip -id: 4057291a-b8cf-11eb-95fe-acde48001122 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed 7-Zip usage using Sysmon. At - this stage of an attack, review parallel processes and file modifications for data - that is staged or potentially have been exfiltrated. This analytic utilizes the - OriginalFileName to capture the renamed process. During triage, validate this is - the legitimate version of `7zip` by reviewing the PE metadata. In addition, review - parallel processes for further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: 7z*.exe - OriginalFileName: 7z*.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives, however this analytic will need to - be modified for each environment if Sysmon is not used. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md -tags: - analytic_story: - - Collection and Staging - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_psexec.yml b/dev/endpoint/detect_renamed_psexec.yml deleted file mode 100644 index 1d2bd0b47f..0000000000 --- a/dev/endpoint/detect_renamed_psexec.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Detect Renamed PSExec -id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 4 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed instances of `PsExec.exe` being - utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` - or other SysInternal utility usage with the command-line argument of `-accepteula`. - During triage, validate this is the legitimate version of `PsExec` by reviewing - the PE metadata. In addition, review parallel processes for further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: psexec.c - Image|endswith: - - psexec64.exe - - psexec.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present. It is possible some - third party applications may use older versions of PsExec, filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml -- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ -tags: - analytic_story: - - SamSam Ransomware - - DHS Report TA18-074A - - HAFNIUM Group - - DarkSide Ransomware - - Active Directory Lateral Movement - - CISA AA22-320A - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1569 - - T1569.002 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_rclone.yml b/dev/endpoint/detect_renamed_rclone.yml deleted file mode 100644 index 7bcada4dcd..0000000000 --- a/dev/endpoint/detect_renamed_rclone.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Detect Renamed RClone -id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: 2 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies the usage of `rclone.exe`, renamed, - being used to exfiltrate data to a remote destination. RClone has been used by multiple - ransomware groups to exfiltrate data. In many instances, it will be downloaded from - the legitimate site and executed accordingly. During triage, isolate the endpoint - and begin to review parallel processes for additional behavior. At this stage, the - adversary may have staged data to be exfiltrated. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: rclone.exe - OriginalFileName: rclone.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this analytic identifies - renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business - use case. -references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -tags: - analytic_story: - - DarkSide Ransomware - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1020 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_renamed_winrar.yml b/dev/endpoint/detect_renamed_winrar.yml deleted file mode 100644 index 5b07e8c18b..0000000000 --- a/dev/endpoint/detect_renamed_winrar.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Detect Renamed WinRAR -id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 3 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analtyic identifies renamed instances of `WinRAR.exe`. - In most cases, it is not common for WinRAR to be used renamed, however it is common - to be installed by a third party application and executed from a non-standard path. - During triage, validate additional metadata from the binary that this is `WinRAR`. - Review parallel processes and file modifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - winrar.exe - - rar.exe - OriginalFileName: WinRAR.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Unknown. It is possible third party applications use renamed - instances of WinRAR. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md -tags: - analytic_story: - - Collection and Staging - - CISA AA22-277A - asset_type: Endpoint - confidence: 90 - impact: 30 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$ on $dest$ by $user$. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 27 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_sharphound_command_line_arguments.yml b/dev/endpoint/detect_sharphound_command_line_arguments.yml deleted file mode 100644 index c7a5be1d5a..0000000000 --- a/dev/endpoint/detect_sharphound_command_line_arguments.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Detect SharpHound Command-Line Arguments -id: a0bdd2f6-c2ff-11eb-b918-acde48001122 -version: 1 -date: '2021-06-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies common command-line arguments used - by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, - function names may be modified, but these changes are dependent upon the operator. - In most instances the defaults are used. This analytic works to identify the common - command-line attributes used. It does not cover the entirety of every argument in - order to avoid false positives. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-collectionMethod*' - - '*invoke-bloodhound*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives should be limited as the arguments used are - specific to SharpHound. Filter as needed or add more command-line arguments as needed. -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk -tags: - analytic_story: - - Discovery Techniques - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Possible SharpHound command-Line arguments identified on $dest$ - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_sharphound_file_modifications.yml b/dev/endpoint/detect_sharphound_file_modifications.yml deleted file mode 100644 index 7e61958485..0000000000 --- a/dev/endpoint/detect_sharphound_file_modifications.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Detect SharpHound File Modifications -id: 42b4b438-beed-11eb-ba1d-acde48001122 -version: 2 -date: '2022-10-09' -author: Michael Haag, Splunk -status: production -type: TTP -description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. - SharpHound will query the domain controller and begin gathering all the data related - to the domain and trusts. For output, it will drop a .zip file upon completion following - a typical pattern that is often not changed. This analytic focuses on the default - file name scheme. Note that this may be evaded with different parameters within - SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` - are two examples. In addition, executing SharpHound via .exe or .ps1 without any - command-line arguments will still perform activity and dump output to the default - filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates - multiple temp files following the same pattern `20210601182121_computers.json`, - `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, - or remove these json's entirely if it is too noisy. During traige, review parallel - processes for further suspicious behavior. Typically, the process executing the - `.ps1` ingestor will be PowerShell. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: - - '*bloodhound.zip' - - '*_computers.json' - - '*_gpos.json' - - '*_domains.json' - - '*_users.json' - - '*_groups.json' - - '*_ous.json' - - '*_containers.json' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on file modifications that include the name of the process, and file, responsible - for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` - node. -known_false_positives: False positives should be limited as the analytic is specific - to a filename with extension .zip. Filter as needed. -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk -tags: - analytic_story: - - Discovery Techniques - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Potential SharpHound file modifications identified on $dest$ - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_sharphound_usage.yml b/dev/endpoint/detect_sharphound_usage.yml deleted file mode 100644 index 6ca204779a..0000000000 --- a/dev/endpoint/detect_sharphound_usage.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Detect SharpHound Usage -id: dd04b29a-beed-11eb-87bc-acde48001122 -version: 2 -date: '2021-05-27' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies SharpHound binary usage by using the - original filena,e. In addition to renaming the PE, other coverage is available to - detect command-line arguments. This particular analytic looks for the original_file_name - of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe - have different original filenames. Dependent upon the operator, the code may be - re-compiled and the attributes removed or changed to anything else. During triage, - review the metadata of the binary in question. Review parallel processes for suspicious - behavior. Identify the source of this binary. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: SharpHound.exe - selection2: - Image|endswith: sharphound.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this is specific to a - file attribute not used by anything else. Filter as needed. -references: -- https://attack.mitre.org/software/S0521/ -- https://thedfirreport.com/?s=bloodhound -- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors -- https://github.com/BloodHoundAD/SharpHound3 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk -tags: - analytic_story: - - Discovery Techniques - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Potential SharpHound binary identified on $dest$ - mitre_attack_id: - - T1087.002 - - T1069.001 - - T1482 - - T1087.001 - - T1087 - - T1069.002 - - T1069 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/dev/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml deleted file mode 100644 index e642fe8a28..0000000000 --- a/dev/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Detect Use of cmd exe to Launch Script Interpreters -id: b89919ed-fe5f-492c-b139-95dbb162039e -version: 4 -date: '2020-07-21' -author: Bhavin Patel, Mauricio Velazco, Splunk -status: production -type: TTP -description: This search looks for the execution of the cscript.exe or wscript.exe - processes, with a parent of cmd.exe. The search will return the count, the first - and last time this execution was seen on a machine, the user, and the destination - of the machine -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - wscript.exe - - cscript.exe - ParentImage: cmd.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. If you are using Sysmon, you must have at least version 6.0.4 - of the Sysmon TA. -known_false_positives: Some legitimate applications may exhibit this behavior. -references: [] -tags: - analytic_story: - - 'Emotet Malware DHS Report TA18-201A ' - - Suspicious Command-Line Executions - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 70 - message: cmd.exe launching script interpreters on $dest$ - mitre_attack_id: - - T1059 - - T1059.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/detection_of_tools_built_by_nirsoft.yml b/dev/endpoint/detection_of_tools_built_by_nirsoft.yml deleted file mode 100644 index 5b8bef6042..0000000000 --- a/dev/endpoint/detection_of_tools_built_by_nirsoft.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Detection of tools built by NirSoft -id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 3 -date: '2020-07-21' -author: Bhavin Patel, Splunk -status: experimental -type: TTP -description: This search looks for specific command-line arguments that may indicate - the execution of tools made by Nirsoft, which are legitimate, but may be abused - by attackers. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '* /stext *' - - '* /scomma *' - condition: (selection1) -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You - should verfiy that the tool was used for a legitimate purpose. -references: [] -tags: - analytic_story: - - 'Emotet Malware DHS Report TA18-201A ' - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1072 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/disable_amsi_through_registry.yml b/dev/endpoint/disable_amsi_through_registry.yml deleted file mode 100644 index bd320621f0..0000000000 --- a/dev/endpoint/disable_amsi_through_registry.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Disable AMSI Through Registry -id: 9c27ec42-d338-11eb-9044-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify modification in registry to disable AMSI windows - feature to evade detections. This technique was seen in several ransomware, RAT - and even APT to impaire defenses of the compromise machine and to be able to execute - payload with minimal alert as much as possible. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network operator may disable this feature of windows but not - so common. -references: -- https://blog.f-secure.com/hunting-for-amsi-bypasses/ -- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9 -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Disable AMSI Through Registry - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_blockatfirstseen_feature.yml b/dev/endpoint/disable_defender_blockatfirstseen_feature.yml deleted file mode 100644 index 9820309477..0000000000 --- a/dev/endpoint/disable_defender_blockatfirstseen_feature.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender BlockAtFirstSeen Feature -id: 2dd719ac-3021-11ec-97b4-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of the - Windows registry to disable a Windows Defender feature. This technique is intended - to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen - feature where it blocks suspicious files the first time seen on the host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: DisableBlockAtFirstSeen - TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_enhanced_notification.yml b/dev/endpoint/disable_defender_enhanced_notification.yml deleted file mode 100644 index 1227045c83..0000000000 --- a/dev/endpoint/disable_defender_enhanced_notification.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender Enhanced Notification -id: dc65678c-301f-11ec-8e30-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of registry - to disable windows defender features. This technique attempts to bypass or evade - detection from Windows Defender AV, specifically the Enhanced Notification feature - where a user or admin would receive alerts. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: DisableEnhancedNotifications - TargetObject: '*Microsoft\\Windows Defender\\Reporting*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data executions - from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 - of the Sysmon TA. -known_false_positives: user may choose to disable windows defender AV -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_mpengine_registry.yml b/dev/endpoint/disable_defender_mpengine_registry.yml deleted file mode 100644 index e11baba919..0000000000 --- a/dev/endpoint/disable_defender_mpengine_registry.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender MpEngine Registry -id: cc391750-3024-11ec-955a-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This particular behavior is typically executed when an adversary or malware - gains access to an endpoint and begins to perform execution and to evade detections. - Usually, a batch (.bat) file will be executed and multiple registry and scheduled - task modifications will occur. During triage, review parallel processes and identify - any further file modifications. Endpoint should be isolated. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: MpEnablePus - TargetObject: '*\\Policies\\Microsoft\\Windows Defender\\MpEngine*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_spynet_reporting.yml b/dev/endpoint/disable_defender_spynet_reporting.yml deleted file mode 100644 index 95f067dec7..0000000000 --- a/dev/endpoint/disable_defender_spynet_reporting.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Disable Defender Spynet Reporting -id: 898debf4-3021-11ec-ba7c-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of registry - to disable Windows Defender feature. This technique is intended to bypass or evade - detection from Windows Defender AV product, specifically the spynet reporting for - Defender telemetry. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: SpynetReporting - TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_defender_submit_samples_consent_feature.yml b/dev/endpoint/disable_defender_submit_samples_consent_feature.yml deleted file mode 100644 index d97e6d790e..0000000000 --- a/dev/endpoint/disable_defender_submit_samples_consent_feature.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Disable Defender Submit Samples Consent Feature -id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is intended to detect a suspicious modification of the - Windows registry to disable a Windows Defender feature. This technique is intended - to bypass or evade detection from Windows Defender AV, specifically the feature - that submits samples for further analysis. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: SubmitSamplesConsent - TargetObject: '*\\Microsoft\\Windows Defender\\SpyNet*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_etw_through_registry.yml b/dev/endpoint/disable_etw_through_registry.yml deleted file mode 100644 index bc8d097596..0000000000 --- a/dev/endpoint/disable_etw_through_registry.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Disable ETW Through Registry -id: f0eacfa4-d33f-11eb-8f9d-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify modification in registry to disable ETW windows - feature to evade detections. This technique was seen in several ransomware, RAT - and even APT to impaire defenses of the compromise machine and to be able to execute - payload with minimal alert as much as possible. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network operator may disable this feature of windows but not - so common. -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Disable ETW Through Registry - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_logs_using_wevtutil.yml b/dev/endpoint/disable_logs_using_wevtutil.yml deleted file mode 100644 index 73234ddbff..0000000000 --- a/dev/endpoint/disable_logs_using_wevtutil.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Disable Logs Using WevtUtil -id: 236e7c8e-c9d9-11eb-a824-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect execution of wevtutil.exe to disable logs. This - technique was seen in several ransomware to disable the event logs to evade alerts - and detections. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*sl*' - Image|endswith: wevtutil.exe - selection2: - CommandLine: '*/e:false*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: network operator may disable audit event logs for debugging - purposes. -references: -- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 30 - message: WevtUtil.exe used to disable Event Logging on $dest - mitre_attack_id: - - T1070 - - T1070.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_registry_tool.yml b/dev/endpoint/disable_registry_tool.yml deleted file mode 100644 index 4382f1c345..0000000000 --- a/dev/endpoint/disable_registry_tool.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Disable Registry Tool -id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search identifies modification of registry to disable the regedit - or registry tools of the windows operating system. Since registry tool is a swiss - knife in analyzing registry, malware such as RAT or trojan Spy disable this application - to prevent the removal of their registry entry such as persistence, file less components - and defense evasion. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Disabled Registry Tools on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_schedule_task.yml b/dev/endpoint/disable_schedule_task.yml deleted file mode 100644 index 4c1d6ead21..0000000000 --- a/dev/endpoint/disable_schedule_task.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Disable Schedule Task -id: db596056-3019-11ec-a9ff-acde48001122 -version: 1 -date: '2021-10-18' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious commandline to disable existing - schedule task. This technique is used by adversaries or commodity malware like IcedID - to disable security application (AV products) in the targetted host to evade detections. - This TTP is a good pivot to check further why and what other process run before - and after this detection. check which process execute the commandline and what task - is disabled. parent child process is quite valuable in this scenario too. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/change*' - Image|endswith: schtasks.exe - selection2: - CommandLine: '*/disable*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin may disable problematic schedule task -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: schtask process with commandline $process$ to disable schedule task in - $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_security_logs_using_minint_registry.yml b/dev/endpoint/disable_security_logs_using_minint_registry.yml deleted file mode 100644 index 4c2b74b3f7..0000000000 --- a/dev/endpoint/disable_security_logs_using_minint_registry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Disable Security Logs Using MiniNt Registry -id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious registry modification to disable - security audit logs. This technique was shared by a researcher to disable Security - logs of windows by adding this registry. The Windows will think it is WinPE and - will not log any event to the Security Log -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Control\\MiniNt\\*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: Unknown. -references: -- https://twitter.com/0gtweet/status/1182516740955226112 -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_show_hidden_files.yml b/dev/endpoint/disable_show_hidden_files.yml deleted file mode 100644 index 1b852a02ef..0000000000 --- a/dev/endpoint/disable_show_hidden_files.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Disable Show Hidden Files -id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic is to identify a modification in the Windows registry - to prevent users from seeing all the files with hidden attributes. This event or - techniques are known on some worm and trojan spy malware that will drop hidden files - on the infected machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden' - selection2: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden' - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Disabled 'Show Hidden Files' on $dest$ - mitre_attack_id: - - T1564.001 - - T1562.001 - - T1564 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_uac_remote_restriction.yml b/dev/endpoint/disable_uac_remote_restriction.yml deleted file mode 100644 index 3300a6b17c..0000000000 --- a/dev/endpoint/disable_uac_remote_restriction.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Disable UAC Remote Restriction -id: 9928b732-210e-11ec-b65e-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious modification of registry to disable - UAC remote restriction. This technique was well documented in Microsoft page where - attacker may modify this registry value to bypassed UAC feature of windows host. - This is a good indicator that some tries to bypassed UAC to suspicious process or - gain privilege escalation. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: LocalAccountTokenFilterPolicy - TargetObject: '*\\CurrentVersion\\Policies\\System*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: admin may set this policy for non-critical machine. -references: -- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Suspicious Windows Registry Activities - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_windows_app_hotkeys.yml b/dev/endpoint/disable_windows_app_hotkeys.yml deleted file mode 100644 index 6aa869654d..0000000000 --- a/dev/endpoint/disable_windows_app_hotkeys.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Disable Windows App Hotkeys -id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic detects a suspicious registry modification to disable Windows - hotkey (shortcut keys) for native Windows applications. This technique is commonly - used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. - This technique is used to impair the analyst in analyzing and removing the attacker - implant in compromised systems. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: HotKey Disabled - TargetObject: '*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*' - Registry.registry_value_name: Debugger - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Disabled 'Windows App Hotkeys' on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_windows_behavior_monitoring.yml b/dev/endpoint/disable_windows_behavior_monitoring.yml deleted file mode 100644 index 3dffd94849..0000000000 --- a/dev/endpoint/disable_windows_behavior_monitoring.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Disable Windows Behavior Monitoring -id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identifies a modification in registry to disable the - windows denfender real time behavior monitoring. This event or technique is commonly - seen in RAT, bot, or Trojan to disable AV to evade detections. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: - - '*\\Real-Time Protection\\DisableScriptScanning' - - '*\\Real-Time Protection\\DisableIOAVProtection' - - '*\\Real-Time Protection\\DisableIntrusionPreventionSystem' - - '*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to disable this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Ransomware - - Revil Ransomware - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 100 - impact: 40 - message: Windows Defender real time behavior monitoring disabled on $dest - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disable_windows_smartscreen_protection.yml b/dev/endpoint/disable_windows_smartscreen_protection.yml deleted file mode 100644 index 324f4b8316..0000000000 --- a/dev/endpoint/disable_windows_smartscreen_protection.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Disable Windows SmartScreen Protection -id: 664f0fd0-91ff-11eb-a56f-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following search identifies a modification of registry to disable - the smartscreen protection of windows machine. This is windows feature provide an - early warning system against website that might engage in phishing attack or malware - distribution. This modification are seen in RAT malware to cover their tracks upon - downloading other of its component or other payload. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: 'Off' - TargetObject: '*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to disable this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Smartscreen was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_cmd_application.yml b/dev/endpoint/disabling_cmd_application.yml deleted file mode 100644 index 617ba77ac0..0000000000 --- a/dev/endpoint/disabling_cmd_application.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Disabling CMD Application -id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify modification in registry to disable cmd prompt - application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging - or deleting there samples through cmd application which is one of the tool of analyst - to traverse on directory and files. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows command prompt was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_controlpanel.yml b/dev/endpoint/disabling_controlpanel.yml deleted file mode 100644 index a0afa2d1ba..0000000000 --- a/dev/endpoint/disabling_controlpanel.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Disabling ControlPanel -id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 2 -date: '2022-01-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to identify registry modification to disable control panel - window. This technique is commonly seen in malware to prevent their artifacts , - persistence removed on the infected machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Control Panel was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_defender_services.yml b/dev/endpoint/disabling_defender_services.yml deleted file mode 100644 index 693bbabfce..0000000000 --- a/dev/endpoint/disabling_defender_services.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Disabling Defender Services -id: 911eacdc-317f-11ec-ad30-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This particular behavior is typically executed when an adversaries or - malware gains access to an endpoint and beings to perform execution and to evade - detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled - task modifications will occur. During triage, review parallel processes and identify - any further file modifications. Endpoint should be isolated. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*WdBoot*' - - '*WdFilter*' - - '*WdNisDrv*' - - '*WdNisSvc*' - - '*WinDefend*' - - '*SecurityHealthService*' - selection2: - TargetObject: '*\\System\\CurrentControlSet\\Services\\*' - selection3: - Details: '0x00000004' - Registry.registry_value_name: Start - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: admin or user may choose to disable windows defender product -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: modified/added/deleted registry entry $registry_path$ in $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_firewall_with_netsh.yml b/dev/endpoint/disabling_firewall_with_netsh.yml deleted file mode 100644 index 08eb5e12cc..0000000000 --- a/dev/endpoint/disabling_firewall_with_netsh.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Disabling Firewall with Netsh -id: 6860a62c-9203-11eb-9e05-acde48001122 -version: 2 -date: '2021-03-31' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This search is to identifies suspicious firewall disabling using netsh - application. this technique is commonly seen in malware that tries to communicate - or download its component or other payload to its C2 server. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: '*firewall*' - selection4: - CommandLine: - - '*off*' - - '*disable*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: admin may disable firewall during testing or fixing network - problem. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Firewall was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_folderoptions_windows_feature.yml b/dev/endpoint/disabling_folderoptions_windows_feature.yml deleted file mode 100644 index a39ee229d8..0000000000 --- a/dev/endpoint/disabling_folderoptions_windows_feature.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Disabling FolderOptions Windows Feature -id: 83776de4-921a-11eb-868a-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identify registry modification to disable folder options - feature of windows to show hidden files, file extension and etc. This technique - used by malware in combination if disabling show hidden files feature to hide their - files and also to hide the file extension to lure the user base on file icons or - fake file extensions. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_norun_windows_app.yml b/dev/endpoint/disabling_norun_windows_app.yml deleted file mode 100644 index 77286fb93b..0000000000 --- a/dev/endpoint/disabling_norun_windows_app.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Disabling NoRun Windows App -id: de81bc46-9213-11eb-adc9-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identify modification of registry to disable run application - in window start menu. this application is known to be a helpful shortcut to windows - OS user to run known application and also to execute some reg or batch script. This - technique is used malware to make cleaning of its infection more harder by preventing - known application run easily through run shortcut. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.malwarebytes.com/detections/pum-optional-norun/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Windows registry was modified to disable run application in window - start menu on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_remote_user_account_control.yml b/dev/endpoint/disabling_remote_user_account_control.yml deleted file mode 100644 index 5cf644101d..0000000000 --- a/dev/endpoint/disabling_remote_user_account_control.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Disabling Remote User Account Control -id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c -version: 4 -date: '2020-11-18' -author: David Dorsey, Patrick Bareiss, Splunk -status: production -type: TTP -description: The search looks for modifications to registry keys that control the - enforcement of Windows User Account Control (UAC). -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. - The data used for this search is typically generated via logs that report registry - modifications. -known_false_positives: This registry key may be modified via administrators to implement - a change in system policy. This type of change should be a very rare occurrence. -references: [] -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Suspicious Windows Registry Activities - - Remcos - - Windows Registry Abuse - - Azorult - - AgentTesla - asset_type: Endpoint - confidence: 60 - impact: 70 - message: The Windows registry keys that control the enforcement of Windows User - Account Control (UAC) were modified on $dest$ by $user$. - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_systemrestore_in_registry.yml b/dev/endpoint/disabling_systemrestore_in_registry.yml deleted file mode 100644 index 7062e948b6..0000000000 --- a/dev/endpoint/disabling_systemrestore_in_registry.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Disabling SystemRestore In Registry -id: f4f837e2-91fb-11eb-8bf6-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following search identifies the modification of registry related - in disabling the system restore of a machine. This event or behavior are seen in - some RAT malware to make the restore of the infected machine difficult and keep - their infection on the box. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig' - - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR' - - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig' - - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: in some cases admin can disable systemrestore on a machine. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The Windows registry was modified to disable system restore on $dest$ by - $user$. - mitre_attack_id: - - T1490 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/disabling_task_manager.yml b/dev/endpoint/disabling_task_manager.yml deleted file mode 100644 index b50db388bf..0000000000 --- a/dev/endpoint/disabling_task_manager.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Disabling Task Manager -id: dac279bc-9202-11eb-b7fb-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to identifies modification of registry to disable the - task manager of windows operating system. this event or technique are commonly seen - in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate - their process. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin may disable this application for non technical user. -references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 60 - impact: 70 - message: The Windows Task Manager was disabled on $dest$ by $user$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - update_timestamp: true - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/dev/endpoint/dllhost_with_no_command_line_arguments_with_network.yml deleted file mode 100644 index 007d5d6d1a..0000000000 --- a/dev/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: DLLHost with no Command Line Arguments with Network -id: f1c07594-a141-11eb-8407-acde48001122 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies DLLHost.exe with no command line arguments - with a network connection. It is unusual for DLLHost.exe to execute with no command - line arguments present. This particular behavior is common with malicious software, - including Cobalt Strike. During investigation, triage any network connections and - parallel processes. Identify any suspicious module loads related to credential dumping - or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: dllhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. -known_false_positives: Although unlikely, some legitimate third party applications - may use a moved copy of dllhost, triggering a false positive. -references: -- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The process $process_name$ was spawned by $parent_image$ without any command-line - arguments on $dest$ by $user$. - mitre_attack_id: - - T1055 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_image - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_account_discovery_with_dsquery.yml b/dev/endpoint/domain_account_discovery_with_dsquery.yml deleted file mode 100644 index 99901e72aa..0000000000 --- a/dev/endpoint/domain_account_discovery_with_dsquery.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Domain Account Discovery with Dsquery -id: b1a8ce04-04c2-11ec-bea7-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `dsquery.exe` with command-line - arguments utilized to discover domain users. The `user` argument returns a list - of all users registered in the domain. Red Teams and adversaries alike engage in - remote system discovery for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*user*' - Image|endswith: dsquery.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm -- https://attack.mitre.org/techniques/T1087/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_account_discovery_with_net_app.yml b/dev/endpoint/domain_account_discovery_with_net_app.yml deleted file mode 100644 index 1ef527e8a7..0000000000 --- a/dev/endpoint/domain_account_discovery_with_net_app.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Domain Account Discovery With Net App -id: 98f6a534-04c2-11ec-96b2-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to query for domain users. Red Teams and adversaries - alike may use net.exe to enumerate domain users for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - selection5: - CommandLine: '* user*' - selection6: - CommandLine: '*/do*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance -- https://attack.mitre.org/techniques/T1087/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_account_discovery_with_wmic.yml b/dev/endpoint/domain_account_discovery_with_wmic.yml deleted file mode 100644 index c50d678f94..0000000000 --- a/dev/endpoint/domain_account_discovery_with_wmic.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Domain Account Discovery with Wmic -id: 383572e0-04c5-11ec-bdcc-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for domain users. Red Teams and adversaries alike use - wmic.exe to enumerate domain users for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - Image|endswith: wmic.exe - selection2: - CommandLine: '*ds_user*' - selection3: - CommandLine: '*GET*' - selection4: - CommandLine: '*ds_samaccountname*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_controller_discovery_with_nltest.yml b/dev/endpoint/domain_controller_discovery_with_nltest.yml deleted file mode 100644 index f70577d982..0000000000 --- a/dev/endpoint/domain_controller_discovery_with_nltest.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Domain Controller Discovery with Nltest -id: 41243735-89a7-4c83-bcdd-570aa78f00a1 -version: 1 -date: '2021-08-30' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `nltest.exe` with command-line - arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', - can be used to return a list of all domain controllers. Red Teams and adversaries - alike may use nltest.exe to identify domain controllers in a Windows Domain for - situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/dsgetdc:*' - - '*/dclist:*' - Image|endswith: nltest.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Domain controller discovery on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_controller_discovery_with_wmic.yml b/dev/endpoint/domain_controller_discovery_with_wmic.yml deleted file mode 100644 index b6c5872965..0000000000 --- a/dev/endpoint/domain_controller_discovery_with_wmic.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Domain Controller Discovery with Wmic -id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc -version: 1 -date: '2021-09-01' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to discover remote systems. The arguments utilized in this command - line return a list of all domain controllers in a Windows domain. Red Teams and - adversaries alike use *.exe to identify remote systems for situational awareness - and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*DomainControllerAddress*' - - '' - Image|endswith: wmic.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Domain controller discovery on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_group_discovery_with_dsquery.yml b/dev/endpoint/domain_group_discovery_with_dsquery.yml deleted file mode 100644 index bb01483967..0000000000 --- a/dev/endpoint/domain_group_discovery_with_dsquery.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Domain Group Discovery With Dsquery -id: f0c9d62f-a232-4edd-b17e-bc409fb133d4 -version: 1 -date: '2021-09-01' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `dsquery.exe` with command-line - arguments utilized to query for domain groups. The argument `group`, returns a list - of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe - to enumerate domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*group*' - Image|endswith: dsquery.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_group_discovery_with_net.yml b/dev/endpoint/domain_group_discovery_with_net.yml deleted file mode 100644 index 6c7d0322e0..0000000000 --- a/dev/endpoint/domain_group_discovery_with_net.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Domain Group Discovery With Net -id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` with command-line - arguments utilized to query for domain groups. The argument `group /domain`, returns - a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate - domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - net.exe - - net1.exe - selection2: - CommandLine: '*/do*' - selection3: - CommandLine: '*group*' - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -tags: - analytic_story: - - Active Directory Discovery - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/domain_group_discovery_with_wmic.yml b/dev/endpoint/domain_group_discovery_with_wmic.yml deleted file mode 100644 index fe01b35f47..0000000000 --- a/dev/endpoint/domain_group_discovery_with_wmic.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Domain Group Discovery With Wmic -id: a87736a6-95cd-4728-8689-3c64d5026b3e -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for domain groups. The arguments utilized in this command - return a list of all domain groups. Red Teams and adversaries alike use wmic.exe - to enumerate domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: wmic.exe - selection2: - CommandLine: '*ds_group*' - selection3: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - selection4: - CommandLine: '*GET ds_samaccountname*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/dsquery_domain_discovery.yml b/dev/endpoint/dsquery_domain_discovery.yml deleted file mode 100644 index da70e42e4d..0000000000 --- a/dev/endpoint/dsquery_domain_discovery.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: DSQuery Domain Discovery -id: cc316032-924a-11eb-91a2-acde48001122 -version: 1 -date: '2021-03-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies "dsquery.exe" execution with arguments - looking for `TrustedDomain` query directly on the command-line. This is typically - indicative of an Administrator or adversary perform domain trust discovery. Note - that this query does not identify any other variations of "Dsquery.exe" usage. - - Within this detection, it is assumed `dsquery.exe` is not moved or renamed. - - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, process - "dsquery.exe" and its parent process. - - DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` - and only on Server operating system. - - The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found - loaded by another process, it is possible dsquery is running within that process - context in memory. - - In addition to trust discovery, review parallel processes for additional behaviors - performed. Identify the parent process and capture any files (batch files, for example) - being used.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*trustedDomain*' - Image|endswith: dsquery.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives. If there is a true false positive, - filter based on command-line or parent process. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md -- https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) -tags: - analytic_story: - - Domain Trust Discovery - - Active Directory Discovery - asset_type: Endpoint - confidence: 90 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - performing domain discovery on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1482 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/dump_lsass_via_procdump.yml b/dev/endpoint/dump_lsass_via_procdump.yml deleted file mode 100644 index 8a8ea725a9..0000000000 --- a/dev/endpoint/dump_lsass_via_procdump.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Dump LSASS via procdump -id: 3742ebfe-64c2-11eb-ae93-0242ac130002 -version: 3 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Detect procdump.exe dumping the lsass process. This query looks for - both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump - file with all process memory. Both are highly suspect and should be reviewed. This - query does not monitor for the internal name (original_file_name=procdump) of the - PE or look for procdump64.exe. Modify the query as needed. - - During triage, confirm this is procdump.exe executing. If it is the first time a - Sysinternals utility has been ran, it is possible there will be a -accepteula on - the command line. Review other endpoint data sources for cross process (injection) - into lsass.exe.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: procdump - selection2: - Image|endswith: - - procdump.exe - - procdump64.exe - selection3: - CommandLine: - - '*-ma*' - - '*-mm*' - selection4: - CommandLine: '*lsass*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: None identified. -references: -- https://attack.mitre.org/techniques/T1003/001/ -- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump -- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - - CISA AA22-257A - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to dump lsass.exe on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1003.001 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor diff --git a/dev/endpoint/elevated_group_discovery_with_net.yml b/dev/endpoint/elevated_group_discovery_with_net.yml deleted file mode 100644 index ea78b2ed44..0000000000 --- a/dev/endpoint/elevated_group_discovery_with_net.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Elevated Group Discovery With Net -id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to query for specific elevated domain groups. Red - Teams and adversaries alike use net.exe to enumerate elevated domain groups for - situational awareness and Active Directory Discovery to identify high privileged - users. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - net.exe - - net1.exe - selection2: - CommandLine: '*/do*' - selection3: - CommandLine: '*group*' - selection4: - CommandLine: - - '*Domain Admins*' - - '*Enterprise Admins*' - - '*Schema Admins*' - - '*Account Operators*' - - '*Server Operators*' - - '*Protected Users*' - - '*Dns Admins*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://adsecurity.org/?p=3658 -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Active Directory Discovery - - Volt Typhoon - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Elevated domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/elevated_group_discovery_with_wmic.yml b/dev/endpoint/elevated_group_discovery_with_wmic.yml deleted file mode 100644 index ede53fd985..0000000000 --- a/dev/endpoint/elevated_group_discovery_with_wmic.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Elevated Group Discovery With Wmic -id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for specific domain groups. Red Teams and adversaries - alike use net.exe to enumerate elevated domain groups for situational awareness - and Active Directory Discovery to identify high privileged users. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - Image|endswith: wmic.exe - selection2: - CommandLine: - - '*Dns Admins*' - - '*Protected Users*' - - '*Server Operators*' - - '*Account Operators*' - - '*Schema Admins*' - - '*Enterprise Admins*' - - '*Domain Admins*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://adsecurity.org/?p=3658 -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Elevated domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/enable_rdp_in_other_port_number.yml b/dev/endpoint/enable_rdp_in_other_port_number.yml deleted file mode 100644 index b5560c4403..0000000000 --- a/dev/endpoint/enable_rdp_in_other_port_number.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Enable RDP In Other Port Number -id: 99495452-b899-11eb-96dc-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a modification to registry to enable rdp to - a machine with different port number. This technique was seen in some atttacker - tries to do lateral movement and remote access to a compromised machine to gain - control of it. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: PortNumber - TargetObject: '*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ -tags: - analytic_story: - - Prohibited Traffic Allowed or Protocol Mismatch - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: RDP was moved to a non-standard port on $dest$ by $user$. - mitre_attack_id: - - T1021 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/enable_wdigest_uselogoncredential_registry.yml b/dev/endpoint/enable_wdigest_uselogoncredential_registry.yml deleted file mode 100644 index 92bae0fab5..0000000000 --- a/dev/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Enable WDigest UseLogonCredential Registry -id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious registry modification to enable - plain text credential feature of windows. This technique was used by several malware - and also by mimikatz to be able to dumpe the a plain text credential to the compromised - or target host. This TTP is really a good indicator that someone wants to dump the - crendential of the host so it must be a good pivot for credential dumping techniques. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: UseLogonCredential - TargetObject: '*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html -tags: - analytic_story: - - Credential Dumping - - Windows Registry Abuse - - CISA AA22-320A - asset_type: Endpoint - confidence: 100 - impact: 80 - message: wdigest registry $registry_path$ was modified in $dest$ - mitre_attack_id: - - T1112 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/esentutl_sam_copy.yml b/dev/endpoint/esentutl_sam_copy.yml deleted file mode 100644 index 48806a2bdd..0000000000 --- a/dev/endpoint/esentutl_sam_copy.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Esentutl SAM Copy -id: d372f928-ce4f-11eb-a762-acde48001122 -version: 1 -date: '2021-08-18' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies the process - `esentutl.exe` - being - used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, - review parallel processes and determine if legitimate activity. Upon determination - of illegitimate activity, take further action to isolate and contain the threat. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: esentutl.exe - selection2: - Image|endswith: esentutl.exe - selection3: - CommandLine: - - '*ntds*' - - '*SAM*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md -- https://attack.mitre.org/software/S0404/ -tags: - analytic_story: - - Credential Dumping - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user user$ attempting to capture credentials for offline - cracking or observability. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/etw_registry_disabled.yml b/dev/endpoint/etw_registry_disabled.yml deleted file mode 100644 index b774afe62c..0000000000 --- a/dev/endpoint/etw_registry_disabled.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: ETW Registry Disabled -id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a registry modification to disable ETW feature - of windows. This technique is to evade EDR appliance to evade detections and hide - its execution from audit logs. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ETWEnabled - TargetObject: '*\\SOFTWARE\\Microsoft\\.NETFramework*' - Details: '0x00000000' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 90 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1562.006 - - T1127 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/eventvwr_uac_bypass.yml b/dev/endpoint/eventvwr_uac_bypass.yml deleted file mode 100644 index 0742bcc6c6..0000000000 --- a/dev/endpoint/eventvwr_uac_bypass.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Eventvwr UAC Bypass -id: 9cf8fe08-7ad8-11eb-9819-acde48001122 -version: 2 -date: '2022-01-28' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following search identifies Eventvwr bypass by identifying the registry - modification into a specific path that eventvwr.msc looks to (but is not valid) - upon execution. A successful attack will include a suspicious command to be executed - upon eventvwr.msc loading. Upon triage, review the parallel processes that have - executed. Identify any additional registry modifications on the endpoint that may - look suspicious. Remediate as necessary. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*mscfile\\shell\\open\\command\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: Some false positives may be present and will need to be filtered. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://attack.mitre.org/techniques/T1548/002/ -- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - IcedID - - Living Off The Land - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 80 - message: Registry values were modified to bypass UAC using Event Viewer on $dest$ - by $user$. - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/excel_spawning_powershell.yml b/dev/endpoint/excel_spawning_powershell.yml deleted file mode 100644 index c249bc98ac..0000000000 --- a/dev/endpoint/excel_spawning_powershell.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Excel Spawning PowerShell -id: 42d40a22-9be3-11eb-8f08-acde48001122 -version: 1 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Excel spawning PowerShell. - Typically, this is not common behavior and not default with Excel.exe. Excel.exe - will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` - (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing - attachment and is actively used. Albeit, the command executed will most likely be - encoded and captured via another detection. During triage, review parallel processes - and identify any files that may have been written. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: excel.exe - selection2: - OriginalFileName: pwsh.dll - selection3: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection4: - OriginalFileName: PowerShell.EXE - selection5: - OriginalFileName: powershell_ise.EXE - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://redcanary.com/threat-detection-report/techniques/powershell/ -- https://attack.mitre.org/techniques/T1566/001/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/excel_spawning_windows_script_host.yml b/dev/endpoint/excel_spawning_windows_script_host.yml deleted file mode 100644 index eaf5885306..0000000000 --- a/dev/endpoint/excel_spawning_windows_script_host.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Excel Spawning Windows Script Host -id: 57fe880a-9be3-11eb-9bf3-acde48001122 -version: 1 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Excel spawning Windows Script - Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and - not default with Excel.exe. Excel.exe will generally be found in the following path - `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` - or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. - `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line executed will most likely - be obfuscated and captured via another detection. During triage, review parallel - processes and identify any files that may have been written. Review the reputation - of the remote destination and block accordingly. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cscript.exe - - wscript.exe - ParentImage: excel.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. In some instances, `cscript.exe` is used for legitimate business - practices. -references: -- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/ -- https://attack.mitre.org/techniques/T1566/001/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/execute_javascript_with_jscript_com_clsid.yml b/dev/endpoint/execute_javascript_with_jscript_com_clsid.yml deleted file mode 100644 index c20e6575fc..0000000000 --- a/dev/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Execute Javascript With Jscript COM CLSID -id: dc64d064-d346-11eb-8588-acde48001122 -version: 1 -date: '2021-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic will identify suspicious process of cscript.exe where it - tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique - was seen in ransomware (reddot ransomware) where it execute javascript with this - com object with combination of amsi disabling technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*' - Image|endswith: cscript.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: unknown -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 70 - impact: 80 - message: Suspicious process of cscript.exe with a parent process $parent_process_name$ - where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected - on $dest$ by $user$ - mitre_attack_id: - - T1059 - - T1059.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process_id - type: Process - role: - - Attacker - - name: parent_process_name - type: Process Name - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/execution_of_file_with_multiple_extensions.yml b/dev/endpoint/execution_of_file_with_multiple_extensions.yml deleted file mode 100644 index 26bafeb99a..0000000000 --- a/dev/endpoint/execution_of_file_with_multiple_extensions.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Execution of File with Multiple Extensions -id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 -version: 3 -date: '2020-11-18' -author: Rico Valdez, Splunk -status: production -type: TTP -description: This search looks for processes launched from files that have double - extensions in the file name. This is typically done to obscure the "real" file extension - and make it appear as though the file being accessed is a data file, as opposed - to executable content. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*.doc.exe' - - '*.htm.exe' - - '*.html.exe' - - '*.txt.exe' - - '*.pdf.exe' - - '*.doc.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. -known_false_positives: None identified. -references: [] -tags: - analytic_story: - - Windows File Extension and Association Abuse - - Masquerading - Rename System Utilities - asset_type: Endpoint - confidence: 70 - impact: 80 - message: process $process$ have double extensions in the file name is executed on - $dest$ by $user$ - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process - type: Process - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/extraction_of_registry_hives.yml b/dev/endpoint/extraction_of_registry_hives.yml deleted file mode 100644 index 3fe99bcfef..0000000000 --- a/dev/endpoint/extraction_of_registry_hives.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Extraction of Registry Hives -id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 2 -date: '2021-09-09' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of `reg.exe` exporting Windows - Registry hives containing credentials. Adversaries may use this technique to export - registry hives for offline credential access attacks. Typically found executed from - a untrusted process or script. Upon execution, a file will be written to disk. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: - - '*save*' - - '*export*' - selection4: - CommandLine: - - '*\sam *' - - '*\system *' - - '*\security *' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: It is possible some agent based products will generate false - positives. Filter as needed. -references: -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - DarkSide Ransomware - - Credential Dumping - - CISA AA22-257A - - Volt Typhoon - asset_type: Endpoint - confidence: 70 - impact: 80 - message: Suspicious use of `reg.exe` exporting Windows Registry hives containing - credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_id - type: Process - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/firewall_allowed_program_enable.yml b/dev/endpoint/firewall_allowed_program_enable.yml deleted file mode 100644 index a1577a3b44..0000000000 --- a/dev/endpoint/firewall_allowed_program_enable.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Firewall Allowed Program Enable -id: 9a8f63a8-43ac-11ec-904c-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic detects a potential suspicious modification of firewall - rule allowing to execute specific application. This technique was identified when - an adversary and red teams to bypassed firewall file execution restriction in a - targetted host. Take note that this event or command can run by administrator during - testing or allowing legitimate tool or application. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*allow*' - selection2: - CommandLine: '*firewall*' - selection3: - CommandLine: '*add*' - selection4: - CommandLine: '*ENABLE*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated or manual execution of this firewall rule that may generate false positives. - Filter as needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: firewall allowed program commandline $process$ of $process_name$ on $dest$ - by $user$ - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/first_time_seen_child_process_of_zoom.yml b/dev/endpoint/first_time_seen_child_process_of_zoom.yml deleted file mode 100644 index 68a36ba279..0000000000 --- a/dev/endpoint/first_time_seen_child_process_of_zoom.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: First Time Seen Child Process of Zoom -id: e91bd102-d630-4e76-ab73-7e3ba22c5961 -version: 1 -date: '2020-05-20' -author: David Dorsey, Splunk -status: experimental -type: Anomaly -description: This search looks for child processes spawned by zoom.exe or zoom.us - that has not previously been seen. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - zoom.exe - - zoom.us - condition: (selection1) -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You should run - the baseline search `Previously Seen Zoom Child Processes - Initial` to build the - initial table of child processes and hostnames for this search to work. You should - also schedule at the same interval as this search the second baseline search `Previously - Seen Zoom Child Processes - Update` to keep this table up to date and to age out - old child processes. Please update the `previously_seen_zoom_child_processes_window` - macro to adjust the time window. -known_false_positives: A new child process of zoom isn't malicious by that fact alone. - Further investigation of the actions of the child process is needed to verify any - malicious behavior is taken. -references: [] -tags: - analytic_story: - - Suspicious Zoom Child Processes - asset_type: Endpoint - confidence: 80 - impact: 80 - message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us - which has not been previously on host $dest$ - mitre_attack_id: - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint diff --git a/dev/endpoint/fodhelper_uac_bypass.yml b/dev/endpoint/fodhelper_uac_bypass.yml deleted file mode 100644 index 9edcd4497a..0000000000 --- a/dev/endpoint/fodhelper_uac_bypass.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: FodHelper UAC Bypass -id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 -version: 1 -date: '2021-03-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific - registry keys upon execution, that do not exist. Therefore, an attacker can write - its malicious commands in these registry keys to be executed by fodhelper.exe with - the highest privilege. - - * `HKCU:\Software\Classes\ms-settings\shell\open\command` - - * `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute` - - * `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)` - - Upon triage, fodhelper.exe will have a child process and read access will occur - on the registry keys. Isolate the endpoint and review parallel processes for additional - behavior.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: fodhelper.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited to no false positives are expected. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 -- https://attack.mitre.org/techniques/T1548/002/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - IcedID - asset_type: Endpoint - confidence: 90 - impact: 90 - message: Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), - with a parent_process of $parent_process_name$ that has been executed on $dest$ - by $user$. - mitre_attack_id: - - T1112 - - T1548.002 - - T1548 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/fsutil_zeroing_file.yml b/dev/endpoint/fsutil_zeroing_file.yml deleted file mode 100644 index c992871134..0000000000 --- a/dev/endpoint/fsutil_zeroing_file.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Fsutil Zeroing File -id: 4e5e024e-fabb-11eb-8b8f-acde48001122 -version: 1 -date: '2021-08-11' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious fsutil process to zeroing a target - file. This technique was seen in lockbit ransomware where it tries to zero out its - malware path as part of its defense evasion after encrypting the compromised host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*setzerodata*' - Image|endswith: fsutil.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 60 - message: Possible file data deletion on $dest$ using $process$ - mitre_attack_id: - - T1070 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/dev/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml deleted file mode 100644 index eae347af84..0000000000 --- a/dev/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get ADDefaultDomainPasswordPolicy with Powershell -id: 36e46ebe-065a-11ec-b4c7-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` executing the - Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy - in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate - domain policies for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-ADDefaultDomainPasswordPolicy*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 30 - impact: 30 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_aduser_with_powershell.yml b/dev/endpoint/get_aduser_with_powershell.yml deleted file mode 100644 index 083f600d33..0000000000 --- a/dev/endpoint/get_aduser_with_powershell.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Get ADUser with PowerShell -id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns - a list of all domain users. Red Teams and adversaries alike may use this commandlet - to identify remote systems for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-ADUser*' - Image|endswith: - - powershell* - - cmd.exe - selection2: - CommandLine: '*-filter*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://www.blackhillsinfosec.com/red-blue-purple/ -- https://attack.mitre.org/techniques/T1087/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/dev/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml deleted file mode 100644 index 7895f50102..0000000000 --- a/dev/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get ADUserResultantPasswordPolicy with Powershell -id: 8b5ef342-065a-11ec-b0fc-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` executing the - Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy - in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate - domain policies for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-ADUserResultantPasswordPolicy*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://attack.mitre.org/techniques/T1201/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_domainpolicy_with_powershell.yml b/dev/endpoint/get_domainpolicy_with_powershell.yml deleted file mode 100644 index 795ecb2b54..0000000000 --- a/dev/endpoint/get_domainpolicy_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get DomainPolicy with Powershell -id: b8f9947e-065a-11ec-aafb-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` executing the - `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. - Red Teams and adversaries alike may use PowerShell to enumerate domain policies - for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainPolicy*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ -- https://attack.mitre.org/techniques/T1201/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 60 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_domaintrust_with_powershell.yml b/dev/endpoint/get_domaintrust_with_powershell.yml deleted file mode 100644 index 8bd69528ea..0000000000 --- a/dev/endpoint/get_domaintrust_with_powershell.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Get-DomainTrust with PowerShell -id: 4fa7f846-054a-11ec-a836-acde48001122 -version: 1 -date: '2021-08-24' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies Get-DomainTrust from PowerView in order to gather - domain trust information. Typically, this is utilized within a script being executed - and used to enumerate the domain trust information. This grants the adversary an - understanding of how large or small the domain is. During triage, review parallel - processes using an EDR product or 4688 events. It will be important to understand - the timeline of events around this activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-domaintrust*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives as this requires an active Administrator - or adversary to bring in, import, and execute. -references: -- https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 40 - impact: 30 - message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ - by user $user$. - mitre_attack_id: - - T1482 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_domainuser_with_powershell.yml b/dev/endpoint/get_domainuser_with_powershell.yml deleted file mode 100644 index f7d4411e14..0000000000 --- a/dev/endpoint/get_domainuser_with_powershell.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Get DomainUser with PowerShell -id: 9a5a41d6-04e7-11ec-923c-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, - a PowerShell tool used to perform enumeration on Windows domains. Red Teams and - adversaries alike may leverage PowerView to enumerate domain users for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainUser*' - Image|endswith: - - powershell* - - cmd.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_foresttrust_with_powershell.yml b/dev/endpoint/get_foresttrust_with_powershell.yml deleted file mode 100644 index 223a9c13fa..0000000000 --- a/dev/endpoint/get_foresttrust_with_powershell.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Get-ForestTrust with PowerShell -id: 584f4884-0bf1-11ec-a5ec-acde48001122 -version: 1 -date: '2021-09-02' -author: Michael Haag, Splunk -status: production -type: TTP -description: This analytic identifies Get-ForestTrust from PowerSploit in order to - gather domain trust information. Typically, this is utilized within a script being - executed and used to enumerate the domain trust information. This grants the adversary - an understanding of how large or small the domain is. During triage, review parallel - processes using an EDR product or 4688 events. It will be important to understand - the timeline of events around this activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-foresttrust*' - Image|endswith: - - cmd.exe - - powershell.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives as this requires an active Administrator - or adversary to bring in, import, and execute. -references: -- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 40 - impact: 30 - message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ - by user $user$. - mitre_attack_id: - - T1482 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/get_wmiobject_group_discovery.yml b/dev/endpoint/get_wmiobject_group_discovery.yml deleted file mode 100644 index 2c2d087c76..0000000000 --- a/dev/endpoint/get_wmiobject_group_discovery.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Get WMIObject Group Discovery -id: 5434f670-155d-11ec-8cca-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` - being used with PowerShell to identify local groups on the endpoint. \ Typically, - by itself, is not malicious but may raise suspicion based on time of day, endpoint - and username. \ During triage, review parallel processes and identify any further - suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - processes.process_name: cmd.exe - selection2: - Image|endswith: powershell.exe - selection3: - CommandLine: '*Win32_Group*' - selection4: - CommandLine: '*Get-WMIObject*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present. Tune as needed. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getadcomputer_with_powershell.yml b/dev/endpoint/getadcomputer_with_powershell.yml deleted file mode 100644 index 2d6850b6e2..0000000000 --- a/dev/endpoint/getadcomputer_with_powershell.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: GetAdComputer with PowerShell -id: c5a31f80-5888-4d81-9f78-1cc65026316e -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns - a list of all domain computers. Red Teams and adversaries alike may use this commandlet - to identify remote systems for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-AdComputer*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getadgroup_with_powershell.yml b/dev/endpoint/getadgroup_with_powershell.yml deleted file mode 100644 index b260f47936..0000000000 --- a/dev/endpoint/getadgroup_with_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: GetAdGroup with PowerShell -id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is - used to return a list of all groups available in a Windows Domain. Red Teams and - adversaries alike may leverage this commandlet to enumerate domain groups for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-AdGroup*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getcurrent_user_with_powershell.yml b/dev/endpoint/getcurrent_user_with_powershell.yml deleted file mode 100644 index c5ea79eb86..0000000000 --- a/dev/endpoint/getcurrent_user_with_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: GetCurrent User with PowerShell -id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powerhsell.exe` with command-line - arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. - This method returns an object that represents the current Windows user. Red Teams - and adversaries may leverage this method to identify the logged user on a compromised - endpoint for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*GetCurrent(' - - '*System.Security.Principal.WindowsIdentity*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getdomaincomputer_with_powershell.yml b/dev/endpoint/getdomaincomputer_with_powershell.yml deleted file mode 100644 index f0beb1e53d..0000000000 --- a/dev/endpoint/getdomaincomputer_with_powershell.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: GetDomainComputer with PowerShell -id: ed550c19-712e-43f6-bd19-6f58f61b3a5e -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, - a PowerShell tool used to perform enumeration on Windows domains. Red Teams and - adversaries alike may leverage PowerView to enumerate domain groups for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainComputer*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use PowerView for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getdomaincontroller_with_powershell.yml b/dev/endpoint/getdomaincontroller_with_powershell.yml deleted file mode 100644 index a74c085d4e..0000000000 --- a/dev/endpoint/getdomaincontroller_with_powershell.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: GetDomainController with PowerShell -id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. `Get-DomainController` is part of - PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red - Teams and adversaries alike may leverage PowerView to enumerate domain groups for - situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainController*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use PowerView for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Remote system discovery using PowerView on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getdomaingroup_with_powershell.yml b/dev/endpoint/getdomaingroup_with_powershell.yml deleted file mode 100644 index 28e4e70c84..0000000000 --- a/dev/endpoint/getdomaingroup_with_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: GetDomainGroup with PowerShell -id: 93c94be3-bead-4a60-860f-77ca3fe59903 -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, - a PowerShell tool used to perform enumeration on Windows domains. Red Teams and - adversaries alike may leverage PowerView to enumerate domain groups for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-DomainGroup*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery with PowerView on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getlocaluser_with_powershell.yml b/dev/endpoint/getlocaluser_with_powershell.yml deleted file mode 100644 index e1957412f4..0000000000 --- a/dev/endpoint/getlocaluser_with_powershell.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: GetLocalUser with PowerShell -id: 85fae8fa-0427-11ec-8b78-acde48001122 -version: 1 -date: '2021-08-23' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for local users. The `Get-LocalUser` commandlet is used - to return a list of all local users. Red Teams and adversaries may leverage this - commandlet to enumerate users for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-LocalUser*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration using PowerShell on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getnettcpconnection_with_powershell.yml b/dev/endpoint/getnettcpconnection_with_powershell.yml deleted file mode 100644 index bdce44a61a..0000000000 --- a/dev/endpoint/getnettcpconnection_with_powershell.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: GetNetTcpconnection with PowerShell -id: e02af35c-1de5-4afe-b4be-f45aba57272b -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` - commandlet lists the current TCP connections. Red Teams and adversaries alike may - use this commandlet for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*Get-NetTcpConnection*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_ds_computer_with_powershell.yml b/dev/endpoint/getwmiobject_ds_computer_with_powershell.yml deleted file mode 100644 index 955396dc81..0000000000 --- a/dev/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: GetWmiObject Ds Computer with PowerShell -id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 -version: 1 -date: '2021-09-07' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined - with the `DS_Computer` parameter can be used to return a list of all domain computers. - Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, - to enumerate domain groups for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: powershell.exe - selection2: - CommandLine: '*namespace root\\directory\\ldap*' - selection3: - CommandLine: '*Get-WmiObject*' - selection4: - CommandLine: '*class ds_computer*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 70 - impact: 30 - message: Remote system discovery enumeration using WMI on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 21 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_ds_group_with_powershell.yml b/dev/endpoint/getwmiobject_ds_group_with_powershell.yml deleted file mode 100644 index c9faad9079..0000000000 --- a/dev/endpoint/getwmiobject_ds_group_with_powershell.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: GetWmiObject Ds Group with PowerShell -id: df275a44-4527-443b-b884-7600e066e3eb -version: 1 -date: '2021-08-25' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined - with the `-class ds_group` parameter can be used to return the full list of groups - in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, - using PowerShell, to enumerate domain groups for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: powershell.exe - selection2: - CommandLine: '*namespace root\\directory\\ldap*' - selection3: - CommandLine: '*Get-WmiObject*' - selection4: - CommandLine: '*class ds_group*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain group discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1069 - - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_ds_user_with_powershell.yml b/dev/endpoint/getwmiobject_ds_user_with_powershell.yml deleted file mode 100644 index 8b524a3171..0000000000 --- a/dev/endpoint/getwmiobject_ds_user_with_powershell.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: GetWmiObject DS User with PowerShell -id: 22d3b118-04df-11ec-8fa3-acde48001122 -version: 1 -date: '2021-08-24' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined - with the `-class ds_user` parameter can be used to return the full list of users - in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, - using PowerShell, to enumerate domain users for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-wmiobject*' - Image|endswith: - - powershell* - - cmd.exe - selection2: - CommandLine: '*ds_user*' - selection3: - CommandLine: '*root\\directory\\ldap*' - selection4: - CommandLine: '*-namespace*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1087.002 - - T1087 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/getwmiobject_user_account_with_powershell.yml b/dev/endpoint/getwmiobject_user_account_with_powershell.yml deleted file mode 100644 index 69fdeaed6a..0000000000 --- a/dev/endpoint/getwmiobject_user_account_with_powershell.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: GetWmiObject User Account with PowerShell -id: b44f6ac6-0429-11ec-87e9-acde48001122 -version: 1 -date: '2021-08-23' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query local users. The `Get-WmiObject` commandlet combined - with the `Win32_UserAccount` parameter is used to return a list of all local users. - Red Teams and adversaries may leverage this commandlet to enumerate users for situational - awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: powershell.exe - selection2: - CommandLine: '*Win32_UserAccount*' - selection3: - CommandLine: '*Get-WmiObject*' - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this PowerShell commandlet - for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration using PowerShell on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/dev/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml deleted file mode 100644 index 13739b4d12..0000000000 --- a/dev/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: GPUpdate with no Command Line Arguments with Network -id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 2 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies gpupdate.exe with no command line arguments - and with a network connection. It is unusual for gpupdate.exe to execute with no - command line arguments present. This particular behavior is common with malicious - software, including Cobalt Strike. During investigation, triage any network connections - and parallel processes. Identify any suspicious module loads related to credential - dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and - C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: gpupdate.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 90 - impact: 90 - message: Process gpupdate.exe with parent_process $parent_process_name$ is executed - on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ - on port $dest_port$. This behaviour is seen with cobaltstrike. - mitre_attack_id: - - T1055 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - Attacker - - name: connection_to_CNC - type: IP Address - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/hide_user_account_from_sign_in_screen.yml b/dev/endpoint/hide_user_account_from_sign_in_screen.yml deleted file mode 100644 index 999c5482e9..0000000000 --- a/dev/endpoint/hide_user_account_from_sign_in_screen.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Hide User Account From Sign-In Screen -id: 834ba832-ad89-11eb-937d-acde48001122 -version: 2 -date: '2022-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies a suspicious registry modification to hide a - user account on the Windows Login screen. This technique was seen in some tradecraft - where the adversary will create a hidden user account with Admin privileges in login - screen to avoid noticing by the user that they already compromise and to persist - on that said machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: Unknown. Filter as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -tags: - analytic_story: - - XMRig - - Windows Registry Abuse - - Azorult - asset_type: Endpoint - confidence: 80 - impact: 90 - message: Suspicious registry modification ($registry_value_name$) which is used - go hide a user account on the Windows Login screen detected on $dest$ executed - by $user$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: registry_value_name - type: Other - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/dev/endpoint/hiding_files_and_directories_with_attrib_exe.yml deleted file mode 100644 index e699c61749..0000000000 --- a/dev/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Hiding Files And Directories With Attrib exe -id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 -version: 4 -date: '2020-07-21' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific - as hidden by using specific flags so that the victim does not see the file. The - search looks for specific command-line arguments to detect the use of attrib.exe - to hide files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*+h*' - Image|endswith: attrib.exe - condition: (selection1) -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: 'Some applications and users may legitimately use attrib.exe - to interact with the files. ' -references: [] -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Persistence Techniques - - Azorult - asset_type: '' - confidence: 80 - impact: 90 - message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. - mitre_attack_id: - - T1222 - - T1222.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process - type: Other - role: - - Attacker - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/impacket_lateral_movement_commandline_parameters.yml b/dev/endpoint/impacket_lateral_movement_commandline_parameters.yml deleted file mode 100644 index 2f95e9e9e1..0000000000 --- a/dev/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Impacket Lateral Movement Commandline Parameters -id: 8ce07472-496f-11ec-ab3b-3e22fbd008af -version: 2 -date: '2022-01-18' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the presence of suspicious commandline parameters - typically present when using Impacket tools. Impacket is a collection of python - classes meant to be used with Microsoft network protocols. There are multiple scripts - that leverage impacket libraries like `wmiexec.py`, `smbexec.py`, `dcomexec.py` - and `atexec.py` used to execute commands on remote endpoints. By default, these - scripts leverage administrative shares and hardcoded parameters that can be used - as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets - tools for lateral movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/c* \\\\127.0.0.1\\*' - - '*/c* 2>&1' - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Although uncommon, Administrators may leverage Impackets tools - to start a process on remote systems for system administration or automation use - cases. -references: -- https://attack.mitre.org/techniques/T1021/002/ -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://github.com/SecureAuthCorp/impacket -- https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Active Directory Lateral Movement - - WhisperGate - - Industroyer2 - - CISA AA22-277A - - Prestige Ransomware - - Volt Typhoon - asset_type: Endpoint - confidence: 70 - impact: 90 - message: Suspicious command line parameters on $dest may represent a lateral movement - attack with Impackets tools - mitre_attack_id: - - T1021 - - T1021.002 - - T1021.003 - - T1047 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/java_writing_jsp_file.yml b/dev/endpoint/java_writing_jsp_file.yml deleted file mode 100644 index 31e442bd94..0000000000 --- a/dev/endpoint/java_writing_jsp_file.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Java Writing JSP File -id: eb65619c-4f8d-4383-a975-d352765d344b -version: 2 -date: '2022-06-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the process java writing a .jsp to - disk. This is potentially indicative of a web shell being written to disk. Modify - and tune the analytic based on data ingested. For instance, it may be worth running - a broad query for jsp file writes first before performing a join. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - java - - java.exe - - javaw.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` - node. In addition, confirm the latest CIM App 4.20 or higher is installed and the - latest TA for the endpoint product. -known_false_positives: False positives are possible and filtering may be required. - Restrict by assets or filter known jsp files that are common for the environment. -references: -- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/ -- https://github.com/TheGejr/SpringShell -- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability -tags: - analytic_story: - - Spring4Shell CVE-2022-22965 - - Atlassian Confluence Server and Data Center CVE-2022-26134 - - SysAid On-Prem Software CVE-2023-47246 Vulnerability - asset_type: Endpoint - confidence: 70 - cve: - - CVE-2022-22965 - impact: 60 - message: An instance of $process_name$ was identified on endpoint $dest$ writing - a jsp file to disk, potentially indicative of exploitation. - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/jscript_execution_using_cscript_app.yml b/dev/endpoint/jscript_execution_using_cscript_app.yml deleted file mode 100644 index 52286f433d..0000000000 --- a/dev/endpoint/jscript_execution_using_cscript_app.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Jscript Execution Using Cscript App -id: 002f1e24-146e-11ec-a470-acde48001122 -version: 1 -date: '2021-09-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a execution of jscript using cscript process. - Commonly when a user run jscript file it was executed by wscript.exe application. - This technique was seen in FIN7 js implant to execute its malicious script using - cscript process. This behavior is uncommon and a good artifacts to check further - anomalies within the network -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*//e:jscript*' - ParentImage: cscript.exe - selection2: - CommandLine: '*//e:jscript*' - Image|endswith: cscript.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -tags: - analytic_story: - - FIN7 - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Process name $process_name$ with commandline $process$ to execute jscript - in $dest$ - mitre_attack_id: - - T1059 - - T1059.007 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/dev/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml deleted file mode 100644 index ef53991417..0000000000 --- a/dev/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Linux Account Manipulation Of SSH Config and Keys -id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a deletion of ssh key in a linux machine. - attacker may delete or modify ssh key to impair some security features or act as - defense evasion in compromised linux machine. This Anomaly can be also a good indicator - of a malware trying to wipe or delete several files in a compromised host as part - of its destructive payload like what acidrain malware does in linux or router machines. - This detection can be a good pivot to check what process and user tries to delete - this type of files which is not so common and need further investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - /etc/ssh/* - - ~/.ssh/* - Filesystem.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - Acidrain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting a SSH key in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_add_files_in_known_crontab_directories.yml b/dev/endpoint/linux_add_files_in_known_crontab_directories.yml deleted file mode 100644 index 173a50356b..0000000000 --- a/dev/endpoint/linux_add_files_in_known_crontab_directories.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Add Files In Known Crontab Directories -id: 023f3452-5f27-11ec-bf00-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious file creation in known - cron table directories. This event is commonly abuse by malware, adversaries and - red teamers to persist on the target or compromised host. crontab or cronjob is - like a schedule task in windows environment where you can create an executable or - script on the known crontab directories to run it base on its schedule. This Anomaly - query is a good indicator to look further what file is added and who added the file - if to consider it legitimate file. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/cron*' - - '*/var/spool/cron/*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in crontab - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/ -- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_add_user_account.yml b/dev/endpoint/linux_add_user_account.yml deleted file mode 100644 index 3a981ab90e..0000000000 --- a/dev/endpoint/linux_add_user_account.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Add User Account -id: 51fbcaf2-6259-11ec-b0f3-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for commands to create user accounts on the linux - platform. This technique is commonly abuse by adversaries, malware author and red - teamers to persist on the targeted or compromised host by creating new user with - an elevated privilege. This Hunting query may catch normal creation of user by administrator - so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*useradd *' - - '*adduser *' - selection2: - Image|endswith: - - useradd - - adduser - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ that may create user account on $dest$ - mitre_attack_id: - - T1136.001 - - T1136 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_adding_crontab_using_list_parameter.yml b/dev/endpoint/linux_adding_crontab_using_list_parameter.yml deleted file mode 100644 index edf667f465..0000000000 --- a/dev/endpoint/linux_adding_crontab_using_list_parameter.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Adding Crontab Using List Parameter -id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a suspicious cron jobs modification - using crontab list parameters. This command line parameter can be abused by malware - like industroyer2, adversaries, and red teamers to add a crontab entry to their - malicious code to execute to the schedule they want. This event can also be executed - by administrator or normal user for automation purposes so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* -l*' - Image|endswith: crontab - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A possible crontab list command $process$ executed on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_apt_get_privilege_escalation.yml b/dev/endpoint/linux_apt_get_privilege_escalation.yml deleted file mode 100644 index 366445fc2a..0000000000 --- a/dev/endpoint/linux_apt_get_privilege_escalation.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux apt-get Privilege Escalation -id: d870ce3b-e796-402f-b2af-cab4da1223f2 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The apt-get is a command line tool for interacting with the Advanced - Package Tool (APT) library (a package management system for Linux distributions). - It allows you to search for, install, manage, update, and remove software. The tool - does not build software from the source code. If sudo right is given to the tool - for user, then the user can run system commands as root and possibly get a root - shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*APT::Update::Pre-Invoke::*' - selection2: - CommandLine: '*apt-get*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/apt-get/ -- https://phoenixnap.com/kb/how-to-use-apt-get-commands -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_apt_privilege_escalation.yml b/dev/endpoint/linux_apt_privilege_escalation.yml deleted file mode 100644 index e874966639..0000000000 --- a/dev/endpoint/linux_apt_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux APT Privilege Escalation -id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Advanced Package Tool, more commonly known as APT, is a collection of - tools used to install, update, remove, and otherwise manage software packages on - Debian and its derivative operating systems, including Ubuntu and Linux Mint. If - sudo right is given to the tool for user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*APT::Update::Pre-Invoke::*' - selection2: - CommandLine: '*apt*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/apt/ -- https://www.digitalocean.com/community/tutorials/what-is-apt -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_at_allow_config_file_creation.yml b/dev/endpoint/linux_at_allow_config_file_creation.yml deleted file mode 100644 index 5c33a14901..0000000000 --- a/dev/endpoint/linux_at_allow_config_file_creation.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux At Allow Config File Creation -id: 977b3082-5f3d-11ec-b954-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious file creation of /etc/at.allow - or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red - teamers to persist on the targeted or compromised host. These config files can restrict - or allow user to execute "at" application (another schedule task application in - linux). attacker can create a user or add the compromised username to that config - file to execute "at" to schedule it malicious code. This anomaly detection can be - a good indicator to investigate further the entry in created config file and who - created it to verify if it is a false positive. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/at.allow' - - '*/etc/at.deny' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints - into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for - Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create this file for - automation purposes. Please update the filter macros to remove false positives. -references: -- https://linuxize.com/post/at-command-in-linux/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_at_application_execution.yml b/dev/endpoint/linux_at_application_execution.yml deleted file mode 100644 index 1e9c02f275..0000000000 --- a/dev/endpoint/linux_at_application_execution.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Linux At Application Execution -id: bf0a378e-5f3c-11ec-a6de-acde48001122 -version: 2 -date: '2022-05-26' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious process creation of At - application. This process can be used by malware, adversaries and red teamers to - create persistence entry to the targeted or compromised host with their malicious - code. This anomaly detection can be a good indicator to investigate the event before - and after this process execution, when it was executed and what schedule task it - will execute. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - at - - atd - selection2: - Image|endswith: - - at - - atd - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/001/ -- https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 30 - message: At application was executed in $dest$ - mitre_attack_id: - - T1053.002 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_awk_privilege_escalation.yml b/dev/endpoint/linux_awk_privilege_escalation.yml deleted file mode 100644 index bd9aaf4539..0000000000 --- a/dev/endpoint/linux_awk_privilege_escalation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux AWK Privilege Escalation -id: 4510cae0-96a2-4840-9919-91d262db210a -version: 1 -date: '2022-07-31' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Awk is mostly used for processing and scanning patterns. It checks one - or more files to determine whether any lines fit the specified patterns, and if - so, it does the appropriate action. If sudo right is given to AWK binary for the - user, then the user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*awk*' - selection2: - CommandLine: '*sudo*' - selection3: - CommandLine: '*BEGIN*system*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://www.hacknos.com/awk-privilege-escalation/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_busybox_privilege_escalation.yml b/dev/endpoint/linux_busybox_privilege_escalation.yml deleted file mode 100644 index b4dc8979ce..0000000000 --- a/dev/endpoint/linux_busybox_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Busybox Privilege Escalation -id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: BusyBox combines tiny versions of many common UNIX utilities into a single - small executable. It provides minimalist replacements for most of the utilities - you usually find in GNU coreutils, util-linux, etc. If sudo right is given to BusyBox - application for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*sh*' - selection2: - CommandLine: '*busybox*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/busybox/ -- https://man.archlinux.org/man/busybox.1.en -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_c89_privilege_escalation.yml b/dev/endpoint/linux_c89_privilege_escalation.yml deleted file mode 100644 index 50312ea89e..0000000000 --- a/dev/endpoint/linux_c89_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux c89 Privilege Escalation -id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The c89 and cc commands compile, assemble, and link-edit C programs; - the cxx or c++ command does the same for C++ programs. The c89 command should be - used when compiling C programs that are written according to Standard C. If sudo - right is given to c89 application for the user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-wrapper*' - selection2: - CommandLine: '*c89*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/c89/ -- https://www.ibm.com/docs/en/zos/2.1.0?topic=guide-c89-compiler-invocation-using-host-environment-variables -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_c99_privilege_escalation.yml b/dev/endpoint/linux_c99_privilege_escalation.yml deleted file mode 100644 index 8e4b8ff9ee..0000000000 --- a/dev/endpoint/linux_c99_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux c99 Privilege Escalation -id: e1c6dec5-2249-442d-a1f9-99a4bd228183 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The c99 utility is an interface to the standard C compilation system; - it shall accept source code conforming to the ISO C standard. The system conceptually - consists of a compiler and link editor. If sudo right is given to ruby application - for the user, then the user can run system commands as root and possibly get a root - shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-wrapper*' - selection2: - CommandLine: '*c99*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/c99/ -- https://pubs.opengroup.org/onlinepubs/009604499/utilities/c99.html -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_change_file_owner_to_root.yml b/dev/endpoint/linux_change_file_owner_to_root.yml deleted file mode 100644 index 94f70fb652..0000000000 --- a/dev/endpoint/linux_change_file_owner_to_root.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Change File Owner To Root -id: c1400ea2-6257-11ec-ad49-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for a commandline that change the file owner to root - using chown utility tool. This technique is commonly abuse by adversaries, malware - author and red teamers to escalate privilege to the targeted or compromised host - by changing the owner of their malicious file to root. This event is not so common - in corporate network except from the administrator doing normal task that needs - high privilege. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*chown *' - selection2: - Image|endswith: chown - selection3: - CommandLine: '* root *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users -- https://askubuntu.com/questions/617850/changing-from-user-to-superuser -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may change ownership to root on $dest$ - mitre_attack_id: - - T1222.002 - - T1222 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_clipboard_data_copy.yml b/dev/endpoint/linux_clipboard_data_copy.yml deleted file mode 100644 index fa24f802be..0000000000 --- a/dev/endpoint/linux_clipboard_data_copy.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Clipboard Data Copy -id: 7173b2ad-6146-418f-85ae-c3479e4515fc -version: 1 -date: '2022-07-28' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the use of Linux Xclip copying data - out of the clipboard. Adversaries have utilized this technique to capture passwords, - IP addresses, or store payloads. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-o *' - - '*-sel *' - - '*-selection *' - - '*clip *' - - '*clipboard*' - Image|endswith: xclip - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present on Linux desktop as it may commonly - be used by administrators or end users. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1115/ -- https://linux.die.net/man/1/xclip -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 40 - impact: 40 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ adding or removing content from the clipboard. - mitre_attack_id: - - T1115 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 16 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_common_process_for_elevation_control.yml b/dev/endpoint/linux_common_process_for_elevation_control.yml deleted file mode 100644 index 3fb272275e..0000000000 --- a/dev/endpoint/linux_common_process_for_elevation_control.yml +++ /dev/null @@ -1,96 +0,0 @@ -name: Linux Common Process For Elevation Control -id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: 1 -date: '2021-12-23' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to look for possible elevation control access using - a common known process in linux platform to change the attribute and file ownership. - This technique is commonly abused by adversaries, malware author and red teamers - to gain persistence or privilege escalation on the target or compromised host. This - common process is used to modify file attribute, file ownership or SUID. This tools - can be used in legitimate purposes so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*chmod *' - - '*chown *' - - '*fchmod *' - - '*fchmodat *' - - '*fchown *' - - '*fchownat *' - - '*fremovexattr *' - - '*fsetxattr *' - - '*lchown *' - - '*lremovexattr *' - - '*lsetxattr *' - - '*removexattr *' - - '*setuid *' - - '*setgid *' - - '*setreuid *' - - '*setregid *' - - '*setcap *' - - '*chattr *' - selection2: - Image|endswith: - - chmod - - chown - - fchmod - - fchmodat - - fchown - - fchownat - - fremovexattr - - fsetxattr - - lchown - - lremovexattr - - lsetxattr - - removexattr - - setuid - - setgid - - setreuid - - setregid - - chattr - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1548/001/ -- https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297 -- https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270 -- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ with process $process_name$ on $dest$ - mitre_attack_id: - - T1548.001 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_composer_privilege_escalation.yml b/dev/endpoint/linux_composer_privilege_escalation.yml deleted file mode 100644 index a1b28e59e8..0000000000 --- a/dev/endpoint/linux_composer_privilege_escalation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Composer Privilege Escalation -id: a3bddf71-6ba3-42ab-a6b2-396929b16d92 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Composer is a tool for dependency management in PHP. It allows you to - declare the libraries your project depends on and it will manage (install/update) - them for you. If sudo right is given to tool for the user, then the user can run - system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*run-script*' - selection2: - CommandLine: '*composer*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/composer/ -- https://getcomposer.org/doc/00-intro.md -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_cpulimit_privilege_escalation.yml b/dev/endpoint/linux_cpulimit_privilege_escalation.yml deleted file mode 100644 index 886009ea58..0000000000 --- a/dev/endpoint/linux_cpulimit_privilege_escalation.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux Cpulimit Privilege Escalation -id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: cpulimit is a simple program which attempts to limit the cpu usage of - a process (expressed in percentage, not in cpu time). This is useful to control - batch jobs, when you don't want them to eat too much cpu. If sudo right is given - to the program for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-l*' - selection2: - CommandLine: '*cpulimit*' - selection3: - CommandLine: '*-f*' - selection4: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/cpulimit/ -- http://cpulimit.sourceforge.net/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_csvtool_privilege_escalation.yml b/dev/endpoint/linux_csvtool_privilege_escalation.yml deleted file mode 100644 index 5c6d74f3a4..0000000000 --- a/dev/endpoint/linux_csvtool_privilege_escalation.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Linux Csvtool Privilege Escalation -id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: csvtool is an easy to use command-line tool to work with .CSV files. - If sudo right is given to the tool for the user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*call*' - selection2: - CommandLine: '*csvtool*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/csvtool/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_curl_upload_file.yml b/dev/endpoint/linux_curl_upload_file.yml deleted file mode 100644 index c810ebb3c3..0000000000 --- a/dev/endpoint/linux_curl_upload_file.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Linux Curl Upload File -id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies curl being utilized with the -F or - --form, --upload-file, -T, -d, --data, --data-raw, -I and --head switches to upload - AWS credentials or config to a remote destination. This enables uploading of binary - files and so forth. To force the 'content' part to be a file, prefix the file name - with an @ sign. To just get the content part from a file, prefix the file name with - the symbol <. The difference between @ and < is then that @ makes a file get attached - in the post as a file upload, while the < makes a text field and just get the contents - for that text field from a file. This technique was utlized by the TeamTNT group - to exfiltrate AWS credentials. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-F *' - - '*--form *' - - '*--upload-file *' - - '*-T *' - - '*-d *' - - '*--data *' - - '*--data-raw *' - - '*-I *' - - '*--head *' - Image|endswith: curl - selection2: - CommandLine: '*.aws/credentials*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Filtering may be required. In addition to AWS credentials, - add other important files and monitor. The inverse would be to look for _all_ -F - behavior and tune from there. -references: -- https://curl.se/docs/manpage.html -- https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ -- https://gtfobins.github.io/gtfobins/curl/ -tags: - analytic_story: - - Linux Living Off The Land - - Data Exfiltration - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ attempting to upload important files to a remote destination. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_dd_file_overwrite.yml b/dev/endpoint/linux_dd_file_overwrite.yml deleted file mode 100644 index 134800c879..0000000000 --- a/dev/endpoint/linux_dd_file_overwrite.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Linux DD File Overwrite -id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 -version: 1 -date: '2022-02-14' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to look for dd command to overwrite file. This technique - was abused by adversaries or threat actor to destroy files or data on specific system - or in a large number of host within network to interrupt host avilability, services - and many more. This is also used to destroy data where it make the file irrecoverable - by forensic techniques through overwriting files, data or local and remote drives. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*of=' - Image|endswith: dd - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://gtfobins.github.io/gtfobins/dd/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md -tags: - analytic_story: - - Data Destruction - - Industroyer2 - asset_type: endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1485 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_decode_base64_to_shell.yml b/dev/endpoint/linux_decode_base64_to_shell.yml deleted file mode 100644 index 73a38becf9..0000000000 --- a/dev/endpoint/linux_decode_base64_to_shell.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Decode Base64 to Shell -id: 637b603e-1799-40fd-bf87-47ecbd551b66 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies base64 being decoded and passed to - a Linux shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*|*' - selection2: - CommandLine: - - '*base64 -d*' - - '*base64 --decode*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on legitimate software - being utilized. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -- https://linux.die.net/man/1/base64 -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell. - mitre_attack_id: - - T1027 - - T1059.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/dev/endpoint/linux_deleting_critical_directory_using_rm_command.yml deleted file mode 100644 index 0b573a38e1..0000000000 --- a/dev/endpoint/linux_deleting_critical_directory_using_rm_command.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Linux Deleting Critical Directory Using RM Command -id: 33f89303-cc6f-49ad-921d-2eaea38a6f7a -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious deletion of a critical - folder in Linux machine using rm command. This technique was seen in industroyer2 - campaign to wipe or destroy energy facilities of a targeted sector. Deletion in - these list of folder is not so common since it need some elevated privileges to - access some of it. We recommend to look further events specially in file access - or file deletion, process commandline that may related to this technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* -rf *' - Image|endswith: rm - selection2: - CommandLine: - - '*/boot/*' - - '*/var/log/*' - - '*/etc/*' - - '*/dev/*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - - Data Destruction - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A deletion in known critical list of folder using rm command $process$ - executed on $dest$ - mitre_attack_id: - - T1485 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_cron_jobs.yml b/dev/endpoint/linux_deletion_of_cron_jobs.yml deleted file mode 100644 index e6922761b1..0000000000 --- a/dev/endpoint/linux_deletion_of_cron_jobs.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Deletion Of Cron Jobs -id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a deletion of cron job in a linux machine. - This technique can be related to an attacker, threat actor or malware to disable - scheduled cron jobs that might be related to security or to evade some detections. - We also saw that this technique can be a good indicator for malware that is trying - to wipe or delete several files on the compromised host like the acidrain malware. - This anomaly detection can be a good pivot detection to look for process and user - doing it why they doing. Take note that this event can be done by administrator - so filtering on those possible false positive event is needed. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: /etc/cron.* - Filesystem.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - AcidRain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting cron jobs in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_init_daemon_script.yml b/dev/endpoint/linux_deletion_of_init_daemon_script.yml deleted file mode 100644 index c139919851..0000000000 --- a/dev/endpoint/linux_deletion_of_init_daemon_script.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Linux Deletion Of Init Daemon Script -id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a deletion of init daemon script in a linux - machine. daemon script that place in /etc/init.d/ is a directory that can start - and stop some daemon services in linux machines. attacker may delete or modify daemon - script to impair some security features or act as defense evasion in a compromised - linux machine. This TTP can be also a good indicator of a malware trying to wipe - or delete several files in compromised host as part of its destructive payload like - what acidrain malware does in linux or router machines. This detection can be a - good pivot to check what process and user tries to delete this type of files which - is not so common and need further investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: /etc/init.d/* - Filesystem.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - AcidRain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting a daemon script in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_services.yml b/dev/endpoint/linux_deletion_of_services.yml deleted file mode 100644 index 487761fb6c..0000000000 --- a/dev/endpoint/linux_deletion_of_services.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Deletion Of Services -id: b509bbd3-0331-4aaa-8e4a-d2affe100af6 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a deletion of services in a linux machine. - attacker may delete or modify services to impair some security features or act as - defense evasion in a compromised linux machine. This TTP can be also a good indicator - of a malware trying to wipe or delete several files in a compromised host as part - of its destructive payload like what acidrain malware does in linux or router machines. - This detection can be a good pivot to check what process and user tries to delete - this type of files which is not so common and need further investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - /etc/systemd/* - - /usr/lib/systemd/* - Filesystem.action: deleted - selection2: - TargetFilename: '*.service' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - AcidRain - asset_type: endpoint - confidence: 80 - impact: 80 - message: a $process_name$ deleting a services in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_deletion_of_ssl_certificate.yml b/dev/endpoint/linux_deletion_of_ssl_certificate.yml deleted file mode 100644 index a0ac97d0a9..0000000000 --- a/dev/endpoint/linux_deletion_of_ssl_certificate.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Deletion of SSL Certificate -id: 839ab790-a60a-4f81-bfb3-02567063f615 -version: 1 -date: '2022-04-12' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a deletion of ssl certificate in a linux machine. - attacker may delete or modify ssl certificate to impair some security features or - act as defense evasion in compromised linux machine. This Anomaly can be also a - good indicator of a malware trying to wipe or delete several files in a compromised - host as part of its destructive payload like what acidrain malware does in linux - or router machines. This detection can be a good pivot to check what process and - user tries to delete this type of files which is not so common and need further - investigation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: /etc/ssl/certs/* - Filesystem.action: deleted - selection2: - TargetFilename: - - '*.pem' - - '*.crt' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ -tags: - analytic_story: - - Acidrain - asset_type: endpoint - confidence: 70 - impact: 70 - message: a $process_name$ deleting a SSL certificate in $dest$ - mitre_attack_id: - - T1485 - - T1070.004 - - T1070 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_disable_services.yml b/dev/endpoint/linux_disable_services.yml deleted file mode 100644 index 12fb5a6386..0000000000 --- a/dev/endpoint/linux_disable_services.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Disable Services -id: f2e08a38-6689-4df4-ad8c-b51c16262316 -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to detect events that attempts to disable a - service. This is typically identified in parallel with other instances of service - enumeration of attempts to stop a service and then delete it. Adversaries utilize - this technique like industroyer2 malware to terminate security services or other - related services to continue there objective as a destructive payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* disable*' - Image|endswith: - - systemctl - - service - - svcadm - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to disable services on endpoint $dest$ by $user$. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_doas_conf_file_creation.yml b/dev/endpoint/linux_doas_conf_file_creation.yml deleted file mode 100644 index 72934a3eb3..0000000000 --- a/dev/endpoint/linux_doas_conf_file_creation.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Linux Doas Conf File Creation -id: f6343e86-6e09-11ec-9376-acde48001122 -version: 1 -date: '2022-01-05' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect the creation of doas.conf file in linux host - platform. This configuration file can be use by doas utility tool to allow or permit - standard users to perform tasks as root, the same way sudo does. This tool is developed - as a minimalistic alternative to sudo application. This tool can be abused advesaries, - attacker or malware to gain elevated privileges to the targeted or compromised host. - On the other hand this can also be executed by administrator for a certain task - that needs admin rights. In this case filter is needed. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/etc/doas.conf' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://wiki.gentoo.org/wiki/Doas -- https://www.makeuseof.com/how-to-install-and-use-doas/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_doas_tool_execution.yml b/dev/endpoint/linux_doas_tool_execution.yml deleted file mode 100644 index 0f3f1e3f0d..0000000000 --- a/dev/endpoint/linux_doas_tool_execution.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Linux Doas Tool Execution -id: d5a62490-6e09-11ec-884e-acde48001122 -version: 1 -date: '2022-01-05' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect the doas tool execution in linux host platform. - This utility tool allow standard users to perform tasks as root, the same way sudo - does. This tool is developed as a minimalistic alternative to sudo application. - This tool can be abused advesaries, attacker or malware to gain elevated privileges - to the targeted or compromised host. On the other hand this can also be executed - by administrator for a certain task that needs admin rights. In this case filter - is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: doas - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://wiki.gentoo.org/wiki/Doas -- https://www.makeuseof.com/how-to-install-and-use-doas/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A doas $process_name$ with commandline $process$ was executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_docker_privilege_escalation.yml b/dev/endpoint/linux_docker_privilege_escalation.yml deleted file mode 100644 index ae128bff7f..0000000000 --- a/dev/endpoint/linux_docker_privilege_escalation.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux Docker Privilege Escalation -id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 -version: 1 -date: '2022-07-31' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Docker is an open source containerization platform. It helps programmers - to bundle applications into containers, which are standardized executable parts - that include the application source code along with the OS libraries and dependencies - needed to run that code in any setting. The user can add mount the root directory - into a container and edit the /etc/password file to add a super user. This requires - the user to be privileged enough to run docker, i.e. being in the docker group or - being root. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*docker*-v*/*:*' - - '*docker*--volume*/*:*' - - '*docker*exec*sh*' - - '*docker*exec*bash*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/docker/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_edit_cron_table_parameter.yml b/dev/endpoint/linux_edit_cron_table_parameter.yml deleted file mode 100644 index 3a7b34e1bc..0000000000 --- a/dev/endpoint/linux_edit_cron_table_parameter.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Edit Cron Table Parameter -id: 0d370304-5f26-11ec-a4bb-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a suspicious cronjobs modification - using crontab edit parameter. This commandline parameter can be abuse by malware - author, adversaries, and red red teamers to add cronjob entry to their malicious - code to execute to the schedule they want. This event can also be executed by administrator - or normal user for automation purposes so filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*crontab *' - Image|endswith: crontab - selection2: - CommandLine: '* -e*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A possible crontab edit command $process$ executed on $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_emacs_privilege_escalation.yml b/dev/endpoint/linux_emacs_privilege_escalation.yml deleted file mode 100644 index 6e10a076b4..0000000000 --- a/dev/endpoint/linux_emacs_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Emacs Privilege Escalation -id: 92033cab-1871-483d-a03b-a7ce98665cfc -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: EMACS is a family of text editors that are characterized by their extensibility. - The manual for the most widely used variant, GNU Emacs, describes it as "the extensible, - customizable, self-documenting, real-time display editor". If sudo right is given - to EMACS tool for the user, then the user can run special commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--eval*' - selection2: - CommandLine: '*emacs*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/emacs/ -- https://en.wikipedia.org/wiki/Emacs -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_file_created_in_kernel_driver_directory.yml b/dev/endpoint/linux_file_created_in_kernel_driver_directory.yml deleted file mode 100644 index 4f15b09552..0000000000 --- a/dev/endpoint/linux_file_created_in_kernel_driver_directory.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Linux File Created In Kernel Driver Directory -id: b85bbeec-6326-11ec-9311-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation in kernel/driver directory - in linux platform. This directory is known folder for all linux kernel module available - within the system. so creation of file in this directory is a good indicator that - there is a possible rootkit installation in the host machine. This technique was - abuse by adversaries, malware author and red teamers to gain high privileges to - their malicious code such us in kernel level. Even this event is not so common administrator - or legitimate 3rd party tool may install driver or linux kernel module as part of - its installation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/kernel/drivers/*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in this folders - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ -- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup -- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Rootkit - asset_type: Endpoint - confidence: 90 - impact: 80 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1547.006 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_file_creation_in_init_boot_directory.yml b/dev/endpoint/linux_file_creation_in_init_boot_directory.yml deleted file mode 100644 index 17089f7851..0000000000 --- a/dev/endpoint/linux_file_creation_in_init_boot_directory.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux File Creation In Init Boot Directory -id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation on init system directories - for automatic execution of script or file upon boot up. This technique is commonly - abuse by adversaries, malware author and red teamer to persist on the targeted or - compromised host. This behavior can be executed or use by an administrator or network - operator to add script files or binary files as part of a task or automation. filter - is needed. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/init.d/*' - - '*/etc/rc.d/*' - - '*/sbin/init.d/*' - - '*/etc/rc.local*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase -known_false_positives: Administrator or network operator can create file in this folders - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1037.004 - - T1037 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_file_creation_in_profile_directory.yml b/dev/endpoint/linux_file_creation_in_profile_directory.yml deleted file mode 100644 index d34b70b535..0000000000 --- a/dev/endpoint/linux_file_creation_in_profile_directory.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux File Creation In Profile Directory -id: 46ba0082-61af-11ec-9826-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation in /etc/profile.d directory - to automatically execute scripts by shell upon boot up of a linux machine. This - technique is commonly abused by adversaries, malware and red teamers as a persistence - mechanism to the targeted or compromised host. This Anomaly detection is a good - indicator that someone wants to run a code after boot up which can be done also - by the administrator or network operator for automation purposes. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/etc/profile.d/*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in profile.d - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://attack.mitre.org/techniques/T1546/004/ -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1546.004 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_find_privilege_escalation.yml b/dev/endpoint/linux_find_privilege_escalation.yml deleted file mode 100644 index c498d890bb..0000000000 --- a/dev/endpoint/linux_find_privilege_escalation.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Find Privilege Escalation -id: 2ff4e0c2-8256-4143-9c07-1e39c7231111 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Find is a command-line utility that locates files based on some user-specified - criteria and either prints the pathname of each matched object or, if another action - is requested, performs that action on each matched object. If sudo right is given - to find utility for the user, then the user can run system commands as root and - possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-exec*' - selection2: - CommandLine: '*find*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/find/ -- https://en.wikipedia.org/wiki/Find_(Unix) -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_gdb_privilege_escalation.yml b/dev/endpoint/linux_gdb_privilege_escalation.yml deleted file mode 100644 index bbe155eb3f..0000000000 --- a/dev/endpoint/linux_gdb_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux GDB Privilege Escalation -id: 310b7da2-ab52-437f-b1bf-0bd458674308 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: GDB is the acronym for GNU Debugger. This tool helps to debug the programs - written in C, C++, Ada, Fortran, etc. The console can be opened using the gdb command - on terminal. If sudo right is given to GDB tool for the user, then the user can - run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-nx*' - selection2: - CommandLine: '*gdb*' - selection3: - CommandLine: '*-ex*!*' - selection4: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/gdb/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_gem_privilege_escalation.yml b/dev/endpoint/linux_gem_privilege_escalation.yml deleted file mode 100644 index 9d2f025e69..0000000000 --- a/dev/endpoint/linux_gem_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Gem Privilege Escalation -id: 0115482a-5dcb-4bb0-bcca-5d095d224236 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: RubyGems is a package manager for the Ruby programming language that - provides a standard format for distributing Ruby programs and libraries (in a self-contained - format called a "gem"), a tool designed to easily manage the installation of gems, - and a server for distributing them. If sudo right is given to GEM utility for the - user, then the user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-c*' - selection2: - CommandLine: '*gem*open*-e*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/gem/ -- https://en.wikipedia.org/wiki/RubyGems -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 20 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_gnu_awk_privilege_escalation.yml b/dev/endpoint/linux_gnu_awk_privilege_escalation.yml deleted file mode 100644 index f7e6293bc9..0000000000 --- a/dev/endpoint/linux_gnu_awk_privilege_escalation.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux GNU Awk Privilege Escalation -id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: gawk command in Linux is used for pattern scanning and processing language. - The awk command requires no compiling and allows the user to use variables, numeric - functions, string functions, and logical operators. It is a utility that enables - programmers to write tiny and effective programs in the form of statements that - define text patterns that are to be searched for, in a text document and the action - that is to be taken when a match is found within a line. If sudo right is given - to gawk tool for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*BEGIN*{system*' - selection2: - CommandLine: '*gawk*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/gawk/ -- https://www.geeksforgeeks.org/gawk-command-in-linux-with-examples/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ingress_tool_transfer_hunting.yml b/dev/endpoint/linux_ingress_tool_transfer_hunting.yml deleted file mode 100644 index e9b1929248..0000000000 --- a/dev/endpoint/linux_ingress_tool_transfer_hunting.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Ingress Tool Transfer Hunting -id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic hunts for curl and wget being utilized in the - environment. This is meant to help with identifying normal usage and potentially - malicious. Utilize this query to tune other curl and wget analytics. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - curl - - wget - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present. This query is meant to help - tune other curl and wget analytics. -references: -- https://gtfobins.github.io/gtfobins/curl/ -- https://curl.se/docs/manpage.html#-I -- https://gtfobins.github.io/gtfobins/curl/ -- https://github.com/rapid7/metasploit-framework/search?q=curl -tags: - analytic_story: - - Linux Living Off The Land - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 10 - impact: 10 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ utilizing curl or wget. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 1 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ingress_tool_transfer_with_curl.yml b/dev/endpoint/linux_ingress_tool_transfer_with_curl.yml deleted file mode 100644 index 4d2822d3fc..0000000000 --- a/dev/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Ingress Tool Transfer with Curl -id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies curl with the command-line switches - that are commonly used to download, output, a remote script or binary. MetaSploit - Framework will combine the -sO switch with | chmod +x to enable a simple one liner - to download and set the execute bit to run the file immediately. During triage, - review the remote domain and file being downloaded for legitimacy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: curl - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present. Tune and then change type - to TTP. -references: -- https://gtfobins.github.io/gtfobins/curl/ -- https://curl.se/docs/manpage.html#-I -- https://gtfobins.github.io/gtfobins/curl/ -- https://github.com/rapid7/metasploit-framework/search?q=curl -tags: - analytic_story: - - Linux Living Off The Land - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 30 - impact: 40 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ to download a remote file. Review activity for further details. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/dev/endpoint/linux_insert_kernel_module_using_insmod_utility.yml deleted file mode 100644 index 08bf70fe8c..0000000000 --- a/dev/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Insert Kernel Module Using Insmod Utility -id: 18b5a1a0-6326-11ec-943a-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for inserting of linux kernel module using insmod - utility function. This event can detect a installation of rootkit or malicious kernel - module to gain elevated privileges to their malicious code and bypassed detections. - This Anomaly detection is a good indicator that someone installing kernel module - in a linux host either admin or adversaries. filter is needed in this scenario -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*insmod*' - Image|endswith: - - kmod - - sudo - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ -- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup -- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Rootkit - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may install kernel module on $dest$ - mitre_attack_id: - - T1547.006 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/dev/endpoint/linux_install_kernel_module_using_modprobe_utility.yml deleted file mode 100644 index f9be77532e..0000000000 --- a/dev/endpoint/linux_install_kernel_module_using_modprobe_utility.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Install Kernel Module Using Modprobe Utility -id: 387b278a-6326-11ec-aa2c-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for possible installing a linux kernel module using - modprobe utility function. This event can detect a installation of rootkit or malicious - kernel module to gain elevated privileges to their malicious code and bypassed detections. - This Anomaly detection is a good indicator that someone installing kernel module - in a linux host either admin or adversaries. filter is needed in this scenario -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*modprobe*' - Image|endswith: - - kmod - - sudo - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ -- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup -- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Rootkit - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may install kernel module on $dest$ - mitre_attack_id: - - T1547.006 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_iptables_firewall_modification.yml b/dev/endpoint/linux_iptables_firewall_modification.yml deleted file mode 100644 index bc64379af3..0000000000 --- a/dev/endpoint/linux_iptables_firewall_modification.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Iptables Firewall Modification -id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 3 -date: '2022-06-03' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious commandline that modify the iptables - firewall setting of a linux machine. This technique was seen in cyclopsblink malware - where it modifies the firewall setting of the compromised machine to allow traffic - to its tcp port that will be used to communicate with its C2 server. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* --dport *' - selection2: - CommandLine: '*iptables *' - selection3: - CommandLine: '* ACCEPT*' - selection4: - CommandLine: '*&>/dev/null*' - selection5: - CommandLine: '* tcp *' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: administrator may do this commandline for auditing and testing - purposes. In this scenario filter is needed. -references: -- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf -- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html -tags: - analytic_story: - - CyclopsBLink - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ that may modify iptables firewall on $dest$ - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_java_spawning_shell.yml b/dev/endpoint/linux_java_spawning_shell.yml deleted file mode 100644 index b73e7ca450..0000000000 --- a/dev/endpoint/linux_java_spawning_shell.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Linux Java Spawning Shell -id: 7b09db8a-5c20-11ec-9945-acde48001122 -version: 1 -date: '2021-12-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the process name of Java, Apache, or - Tomcat spawning a Linux shell. This is potentially indicative of exploitation of - the Java application and may be related to current event CVE-2021-44228 (Log4Shell). - The shells included in the macro are "sh", "ksh", "zsh", "bash", "dash", "rbash", - "fish", "csh', "tcsh', "ion", "eshell". Upon triage, review parallel processes and - command-line arguments to determine legitimacy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - java - - apache - - tomcat - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly. - Add any additional java process names for your environment to the analytic as needed. -known_false_positives: Filtering may be required on internal developer build systems - or classify assets as web facing and restrict the analytic based on asset type. -references: -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 -tags: - analytic_story: - - Hermetic Wiper - - Log4Shell CVE-2021-44228 - - Spring4Shell CVE-2022-22965 - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation. - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/java_spawn_shell_nix.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_kernel_module_enumeration.yml b/dev/endpoint/linux_kernel_module_enumeration.yml deleted file mode 100644 index 6b41f0d000..0000000000 --- a/dev/endpoint/linux_kernel_module_enumeration.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Kernel Module Enumeration -id: 6df99886-0e04-4c11-8b88-325747419278 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the process kmod being utilized to - list kernel modules in use. Typically, this is not seen as malicious, however it - may be a precurser to the use of insmod to install a module. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*lsmod*' - - '*list*' - Image|endswith: kmod - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://man7.org/linux/man-pages/man8/kmod.8.html -tags: - analytic_story: - - Linux Rootkit - asset_type: Endpoint - confidence: 50 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ enumeration kernel modules. - mitre_attack_id: - - T1082 - - T1014 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_kworker_process_in_writable_process_path.yml b/dev/endpoint/linux_kworker_process_in_writable_process_path.yml deleted file mode 100644 index 889fadb668..0000000000 --- a/dev/endpoint/linux_kworker_process_in_writable_process_path.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Kworker Process In Writable Process Path -id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed -version: 2 -date: '2022-04-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for suspicious process kworker commandline in a linux - machine. kworker process name or thread are common names of kernel threads in linux - process. This hunting detections can lead to investigate process contains process - path in writable directory in linux like /home/, /var/log and /tmp/. This technique - was seen in cyclopsblink malware to blend its core and other of its child process - as normal kworker on the compromised machine. This detection might be a good pivot - to look for other IOC related to cyclopsblink malware or attacks. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.parent_process_path: - - /home/* - - /tmp/* - - /var/log/* - ParentCommandLine: '*[kworker/*' - CommandLine: '*iptables*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: unknown -references: -- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf -- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html -tags: - analytic_story: - - CyclopsBLink - asset_type: Endpoint - confidence: 60 - impact: 60 - message: a $process_name$ with kworker commandline in $dest$ - mitre_attack_id: - - T1036.004 - - T1036 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_make_privilege_escalation.yml b/dev/endpoint/linux_make_privilege_escalation.yml deleted file mode 100644 index cdbe3bd005..0000000000 --- a/dev/endpoint/linux_make_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Make Privilege Escalation -id: 80b22836-5091-4944-80ee-f733ac443f4f -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: The Linux make command is used to build and maintain groups of programs - and files from the source code. In Linux, it is one of the most frequently used - commands by the developers. It assists developers to install and compile many utilities - from the terminal. If sudo right is given to make utility for the user, then the - user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--eval*' - selection2: - CommandLine: '*make*-s*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/make/ -- https://www.javatpoint.com/linux-make-command -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_mysql_privilege_escalation.yml b/dev/endpoint/linux_mysql_privilege_escalation.yml deleted file mode 100644 index 52b3c9f4b5..0000000000 --- a/dev/endpoint/linux_mysql_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux MySQL Privilege Escalation -id: c0d810f4-230c-44ea-b703-989da02ff145 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: MySQL is an open-source relational database management system. Its name - is a combination of "My", the name of co-founder Michael Widenius's daughter My, - and "SQL", the abbreviation for Structured Query Language. If sudo right is given - to mysql utility for the user, then the user can run system commands as root and - possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*\!**' - selection2: - CommandLine: '*mysql*-e*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/mysql/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_node_privilege_escalation.yml b/dev/endpoint/linux_node_privilege_escalation.yml deleted file mode 100644 index 5bbf8cabdc..0000000000 --- a/dev/endpoint/linux_node_privilege_escalation.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Node Privilege Escalation -id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce -version: 1 -date: '2022-07-31' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Node.js is a back-end JavaScript runtime environment that is open-source, - cross-platform, runs on the V8 engine, and executes JavaScript code outside of a - web browser. It was created to help create scalable network applications. If the - binary is allowed to run as superuser by sudo, it does not drop the elevated privileges - and may be used to access the file system, escalate or maintain privileged access. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-e*' - selection2: - CommandLine: '*sudo*node*' - selection3: - CommandLine: '*child_process.spawn*' - selection4: - CommandLine: '*stdio*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/docker/ -- https://en.wikipedia.org/wiki/Node.js -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/dev/endpoint/linux_nopasswd_entry_in_sudoers_file.yml deleted file mode 100644 index 583470b1e9..0000000000 --- a/dev/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Linux NOPASSWD Entry In Sudoers File -id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for suspicious command lines that may add entry - to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly - abuse by adversaries, malware author and red teamers to gain elevated privilege - to the targeted or compromised host. /etc/sudoers file controls who can run what - commands users can execute on the machines and can also control whether user need - a password to execute particular commands. This file is composed of aliases (basically - variables) and user specifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*NOPASSWD:*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands -- https://help.ubuntu.com/community/Sudoers -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 80 - message: a commandline $process$ executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/dev/endpoint/linux_obfuscated_files_or_information_base64_decode.yml deleted file mode 100644 index 67991a8df0..0000000000 --- a/dev/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Obfuscated Files or Information Base64 Decode -id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the use of base64 decode on Linux being - utilized to deobfuscate a file. Identify the source of the file and determine if - legitimate. Review parallel processes for further behavior before and after. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*base64 -d*' - - '*base64 --decode*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and will require some tuning - based on processes. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -- https://linux.die.net/man/1/base64 -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ decoding base64. - mitre_attack_id: - - T1027 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_octave_privilege_escalation.yml b/dev/endpoint/linux_octave_privilege_escalation.yml deleted file mode 100644 index 33b16e8927..0000000000 --- a/dev/endpoint/linux_octave_privilege_escalation.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Octave Privilege Escalation -id: 78f7487d-42ce-4f7f-8685-2159b25fb477 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: GNU Octave is a high-level programming language primarily intended for - scientific computing and numerical computation. Octave helps in solving linear and - nonlinear problems numerically, and for performing other numerical experiments using - a language that is mostly compatible with MATLAB. If sudo right is given to the - application for the user, then the user can run system commands as root and possibly - get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--eval*' - selection2: - CommandLine: '*octave-cli*' - selection3: - CommandLine: '*system*' - selection4: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/octave/ -- https://en.wikipedia.org/wiki/GNU_Octave -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_openvpn_privilege_escalation.yml b/dev/endpoint/linux_openvpn_privilege_escalation.yml deleted file mode 100644 index c28b187d4e..0000000000 --- a/dev/endpoint/linux_openvpn_privilege_escalation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Linux OpenVPN Privilege Escalation -id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: OpenVPN is a virtual private network system that implements techniques - to create secure point-to-point or site-to-site connections in routed or bridged - configurations and remote access facilities. It implements both client and server - applications. If sudo right is given to the OpenVPN application for the user, then - the user can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*--dev*' - selection2: - CommandLine: '*openvpn*' - selection3: - CommandLine: '*--script-security*' - selection4: - CommandLine: '*--up*' - selection5: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/openvpn/ -- https://en.wikipedia.org/wiki/OpenVPN -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_php_privilege_escalation.yml b/dev/endpoint/linux_php_privilege_escalation.yml deleted file mode 100644 index 8bca4dd1ad..0000000000 --- a/dev/endpoint/linux_php_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux PHP Privilege Escalation -id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: PHP is a general-purpose scripting language geared toward web development. - It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1994. - The PHP reference implementation is now produced by The PHP Group. If sudo right - is given to php application for the user, then the user can run system commands - as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*system*' - selection2: - CommandLine: '*php*-r*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/php/ -- https://en.wikipedia.org/wiki/PHP -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_pkexec_privilege_escalation.yml b/dev/endpoint/linux_pkexec_privilege_escalation.yml deleted file mode 100644 index 998f5630fd..0000000000 --- a/dev/endpoint/linux_pkexec_privilege_escalation.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Linux pkexec Privilege Escalation -id: 03e22c1c-8086-11ec-ac2e-acde48001122 -version: 1 -date: '2022-01-28' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies `pkexec` spawning with no command-line - arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 - (PwnKit) which is present in the default configuration of all major Linux distributions - and can be exploited to gain full root privileges on the system. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: pkexec - condition: selection1 -how_to_implement: Depending on the EDR product in use, there are multiple ways to - "null" the command-line field, Processes.process. Two that may be useful `process="(^.{0}$)"` - or `| where isnull(process)`. To generate data for this behavior, Sysmon for Linux - was utilized. To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter as needed. -references: -- https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/ -- https://linux.die.net/man/1/pkexec -- https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/ -- https://access.redhat.com/security/security-updates/#/?q=polkit&p=1&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=PortalProduct -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - cve: - - CVE-2021-4034 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit - pkexec. - mitre_attack_id: - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/pkexec/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/dev/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml deleted file mode 100644 index 488622ca90..0000000000 --- a/dev/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Possible Access Or Modification Of sshd Config File -id: 7a85eb24-72da-11ec-ac76-acde48001122 -version: 1 -date: '2022-01-11' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for suspicious process command-line that might - be accessing or modifying sshd_config. This file is the ssh configuration file that - might be modify by threat actors or adversaries to redirect port connection, allow - user using authorized key generated during attack. This anomaly detection might - catch noise from administrator auditing or modifying ssh configuration file. In - this scenario filter is needed -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/etc/ssh/sshd_config' - Image|endswith: - - cat - - nano* - - vim* - - vi* - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.hackingarticles.in/ssh-penetration-testing-port-22/ -- https://attack.mitre.org/techniques/T1098/004/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a commandline $process$ executed on $dest$ - mitre_attack_id: - - T1098.004 - - T1098 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_access_to_credential_files.yml b/dev/endpoint/linux_possible_access_to_credential_files.yml deleted file mode 100644 index 44ad9ca6d8..0000000000 --- a/dev/endpoint/linux_possible_access_to_credential_files.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Linux Possible Access To Credential Files -id: 16107e0e-71fc-11ec-b862-acde48001122 -version: 1 -date: '2022-01-10' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a possible attempt to dump or access the content - of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd" - store user information within linux OS while "etc/shadow" contain the user passwords - hash. Adversaries and threat actors may attempt to access this to gain persistence - and/or privilege escalation. This anomaly detection can be a good indicator of possible - credential dumping technique but it might catch some normal administrator automation - scripts or during credential auditing. In this scenario filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/etc/shadow*' - - '*/etc/passwd*' - Image|endswith: - - cat - - nano* - - vim* - - vi* - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd -- https://attack.mitre.org/techniques/T1003/008/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1003.008 - - T1003 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_access_to_sudoers_file.yml b/dev/endpoint/linux_possible_access_to_sudoers_file.yml deleted file mode 100644 index 8c3a2808b3..0000000000 --- a/dev/endpoint/linux_possible_access_to_sudoers_file.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Linux Possible Access To Sudoers File -id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: 1 -date: '2022-01-10' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a possible access or modification of /etc/sudoers - file. "/etc/sudoers" file controls who can run what command as what users on what - machine and can also control whether a specific user need a password for particular - commands. adversaries and threat actors abuse this file to gain persistence and/or - privilege escalation during attack on targeted host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/etc/sudoers*' - Image|endswith: - - cat - - nano* - - vim* - - vi* - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1548/003/ -- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/dev/endpoint/linux_possible_append_command_to_at_allow_config_file.yml deleted file mode 100644 index ec7f98aa12..0000000000 --- a/dev/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Possible Append Command To At Allow Config File -id: 7bc20606-5f40-11ec-a586-acde48001122 -version: 2 -date: '2022-05-26' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is designed to identify suspicious command lines that may append user entries to either /etc/at.allow or /etc/at.deny. These files can be exploited by malicious actors for persistence on a compromised Linux host by altering permissions for scheduled tasks using the at command. - - In this context, an attacker can create a user or add an existing user to these configuration files to execute their malicious code through scheduled tasks. The detection of such anomalous behavior can serve as an effective indicator warranting further investigation to validate if the activity is indeed malicious or a false positive. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/etc/at.allow' - - '*/etc/at.deny' - selection2: - CommandLine: '*echo*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: False positives may occur when administrators or network operators use similar command lines for legitimate automation purposes. Therefore, it is recommended to update filter macros to reduce such instances. -references: -- https://linuxize.com/post/at-command-in-linux/ -- https://attack.mitre.org/techniques/T1053/001/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ that may modify at allow config file in $dest$ - mitre_attack_id: - - T1053.002 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_append_command_to_profile_config_file.yml b/dev/endpoint/linux_possible_append_command_to_profile_config_file.yml deleted file mode 100644 index 62cd8bb9cc..0000000000 --- a/dev/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Linux Possible Append Command To Profile Config File -id: 9c94732a-61af-11ec-91e3-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious command-lines that can be possibly - used to modify user profile files to automatically execute scripts/executables by - shell upon reboot of the machine. This technique is commonly abused by adversaries, - malware and red teamers as persistence mechanism to the targeted or compromised - host. This Anomaly detection is a good indicator that someone wants to run code - after reboot which can be done also by the administrator or network operator for - automation purposes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*~/.bashrc' - - '*~/.bash_profile' - - '*/etc/profile' - - ~/.bash_login - - '*~/.profile' - - ~/.bash_logout - selection2: - CommandLine: '*echo*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work -- https://attack.mitre.org/techniques/T1546/004/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: a commandline $process$ that may modify profile files in $dest$ - mitre_attack_id: - - T1546.004 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/dev/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml deleted file mode 100644 index a6b0b89f94..0000000000 --- a/dev/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Linux Possible Append Cronjob Entry on Existing Cronjob File -id: b5b91200-5f27-11ec-bb4e-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for possible suspicious commandline that may use - to append a code to any existing cronjob files for persistence or privilege escalation. - This technique is commonly abused by malware, adversaries and red teamers to automatically - execute their code within a existing or sometimes in normal cronjob script file. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/etc/cron*' - - '*/var/spool/cron/*' - - '*/etc/anacrontab*' - selection2: - CommandLine: '*echo*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/003/ -- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A commandline $process$ that may modify cronjob file in $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_cronjob_modification_with_editor.yml b/dev/endpoint/linux_possible_cronjob_modification_with_editor.yml deleted file mode 100644 index c88b5bd5d1..0000000000 --- a/dev/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Linux Possible Cronjob Modification With Editor -id: dcc89bde-5f24-11ec-87ca-acde48001122 -version: 1 -date: '2021-12-17' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic looks for possible modification of cronjobs file using - editor. This event is can be seen in normal user but can also be a good hunting - indicator for unwanted user modifying cronjobs for possible persistence or privilege - escalation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*nano *' - - '*vi *' - - '*vim *' - selection2: - Image|endswith: - - nano - - vim.basic - selection3: - CommandLine: - - '*/etc/cron*' - - '*/var/spool/cron/*' - - '*/etc/anacrontab*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1053/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 30 - impact: 20 - message: A commandline $process$ that may modify cronjob file using editor in $dest$ - mitre_attack_id: - - T1053.003 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 6 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_possible_ssh_key_file_creation.yml b/dev/endpoint/linux_possible_ssh_key_file_creation.yml deleted file mode 100644 index 6b8eadaae4..0000000000 --- a/dev/endpoint/linux_possible_ssh_key_file_creation.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Possible Ssh Key File Creation -id: c04ef40c-72da-11ec-8eac-acde48001122 -version: 1 -date: '2022-01-11' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for possible ssh key file creation on ~/.ssh/ - folder. This technique is commonly abused by threat actors and adversaries to gain - persistence and privilege escalation to the targeted host. by creating ssh private - and public key and passing the public key to the attacker server. threat actor can - access remotely the machine using openssh daemon service. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*/.ssh*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in ~/.ssh - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://www.hackingarticles.in/ssh-penetration-testing-port-22/ -- https://attack.mitre.org/techniques/T1098/004/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1098.004 - - T1098 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_preload_hijack_library_calls.yml b/dev/endpoint/linux_preload_hijack_library_calls.yml deleted file mode 100644 index c0b57f5515..0000000000 --- a/dev/endpoint/linux_preload_hijack_library_calls.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Linux Preload Hijack Library Calls -id: cbe2ca30-631e-11ec-8670-acde48001122 -version: 1 -date: '2021-12-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious command that may hijack a library - function in linux platform. This technique is commonly abuse by adversaries, malware - author and red teamers to gain privileges and persist on the machine. This detection - pertains to loading a dll to hijack or hook a library function of specific program - using LD_PRELOAD command. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*LD_PRELOAD*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5 -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A commandline $process$ that may hijack library function on $dest$ - mitre_attack_id: - - T1574.006 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_proxy_socks_curl.yml b/dev/endpoint/linux_proxy_socks_curl.yml deleted file mode 100644 index 542282e84b..0000000000 --- a/dev/endpoint/linux_proxy_socks_curl.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Linux Proxy Socks Curl -id: bd596c22-ad1e-44fc-b242-817253ce8b08 -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies curl being utilized with a proxy based - on command-line arguments - -x, socks, --preproxy and --proxy. This behavior is - built into the MetaSploit Framework as a auxiliary module. What does socks buy an - adversary? SOCKS4a extends the SOCKS4 protocol to allow a client to specify a destination - domain name rather than an IP address. The SOCKS5 protocol is defined in RFC 1928. - It is an incompatible extension of the SOCKS4 protocol; it offers more choices for - authentication and adds support for IPv6 and UDP, the latter of which can be used - for DNS lookups. The protocols, and a proxy itself, allow an adversary to evade - controls in place monitoring traffic, making it harder for the defender to identify - and track activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-x *' - - '*socks4a://*' - - '*socks5h://*' - - '*socks4://*' - - '*socks5://*' - - '*--preproxy *' - - --proxy* - Image|endswith: curl - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on proxy usage internally. - Filter as needed. -references: -- https://www.offensive-security.com/metasploit-unleashed/proxytunnels/ -- https://curl.se/docs/manpage.html -- https://en.wikipedia.org/wiki/SOCKS -- https://oxylabs.io/blog/curl-with-proxy -- https://reqbin.com/req/c-ddxflki5/curl-proxy-server#:~:text=To%20use%20a%20proxy%20with,be%20URL%20decoded%20by%20Curl. -- https://gtfobins.github.io/gtfobins/curl/ -tags: - analytic_story: - - Linux Living Off The Land - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 80 - impact: 70 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ utilizing a proxy. Review activity for further details. - mitre_attack_id: - - T1090 - - T1095 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_puppet_privilege_escalation.yml b/dev/endpoint/linux_puppet_privilege_escalation.yml deleted file mode 100644 index 4f905e2f17..0000000000 --- a/dev/endpoint/linux_puppet_privilege_escalation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Linux Puppet Privilege Escalation -id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: In computing, Puppet is a software configuration management tool which - includes its own declarative language to describe system configuration. It is a - model-driven solution that requires limited programming knowledge to use. If sudo - right is given to the tool for the user, then the user can run system commands as - root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*apply*' - selection2: - CommandLine: '*puppet*' - selection3: - CommandLine: '*-e*' - selection4: - CommandLine: '*exec*' - selection5: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/puppet/ -- https://en.wikipedia.org/wiki/Puppet_(software) -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 5 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_rpm_privilege_escalation.yml b/dev/endpoint/linux_rpm_privilege_escalation.yml deleted file mode 100644 index c5419adc39..0000000000 --- a/dev/endpoint/linux_rpm_privilege_escalation.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux RPM Privilege Escalation -id: f8e58a23-cecd-495f-9c65-6c76b4cb9774 -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: RPM Package Manager is a free and open-source package management system. - The name RPM refers to the .rpm file format and the package manager program itself. - RPM was intended primarily for Linux distributions; the file format is the baseline - package format of the Linux Standard Base. If sudo right is given to rpm utility - for the user, then the user can run system commands as root and possibly get a root - shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*lua:os.execute*' - selection2: - CommandLine: '*rpm*--eval*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/rpm/ -- https://en.wikipedia.org/wiki/RPM_Package_Manager -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ruby_privilege_escalation.yml b/dev/endpoint/linux_ruby_privilege_escalation.yml deleted file mode 100644 index 62d1f2593c..0000000000 --- a/dev/endpoint/linux_ruby_privilege_escalation.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux Ruby Privilege Escalation -id: 097b28b5-7004-4d40-a715-7e390501788b -version: 1 -date: '2022-08-09' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: Ruby is one of the most used and easy to use programming languages. Ruby - is an open-source, object-oriented interpreter that can be installed on a Linux - system. If sudo right is given to ruby application for the user, then the user can - run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*exec*' - selection2: - CommandLine: '*ruby*-e*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives are present based on automated tooling or system - administrative usage. Filter as needed. -references: -- https://gtfobins.github.io/gtfobins/ruby/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_service_file_created_in_systemd_directory.yml b/dev/endpoint/linux_service_file_created_in_systemd_directory.yml deleted file mode 100644 index 32366a555e..0000000000 --- a/dev/endpoint/linux_service_file_created_in_systemd_directory.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Linux Service File Created In Systemd Directory -id: c7495048-61b6-11ec-9a37-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious file creation in systemd timer directory - in linux platform. systemd is a system and service manager for Linux distributions. - From the Windows perspective, this process fulfills the duties of wininit.exe and - services.exe combined. At the risk of simplifying the functionality of systemd, - it initializes a Linux system and starts relevant services that are defined in service - unit files. Adversaries, malware and red teamers may abuse this this feature by - stashing systemd service file to persist on the targetted or compromised host. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*/etc/systemd/system*' - - '*/lib/systemd/system*' - - '*/usr/lib/systemd/system*' - - '*/run/systemd/system*' - - '*~/.config/systemd/*' - - '*~/.local/share/systemd/*' - - '*/etc/systemd/user*' - - '*/lib/systemd/user*' - - '*/usr/lib/systemd/user*' - - '*/run/systemd/user*' - Filesystem.file_name: '*.service' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the file name, file path, and process_guid executions from your endpoints. - If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can create file in systemd - folders for automation purposes. Please update the filter macros to remove false - positives. -references: -- https://attack.mitre.org/techniques/T1053/006/ -- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ -- https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/ -- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A service file named as $file_path$ is created in systemd folder on $dest$ - mitre_attack_id: - - T1053.006 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_service_restarted.yml b/dev/endpoint/linux_service_restarted.yml deleted file mode 100644 index 71b034318a..0000000000 --- a/dev/endpoint/linux_service_restarted.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux Service Restarted -id: 084275ba-61b8-11ec-8d64-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for restarted or re-enable services in linux platform. - This technique can be executed or performed using systemctl or service tool application. - Adversaries may create or modify Windows services to repeatedly execute malicious - payloads as part of persistence. When Windows boots up, it starts programs or applications - called services that perform background system functions. Administrator may also - create a legitimated service for a specific tool or normal application as part of - task or automation, in this scenario it is suggested to look for the service path - of the actual script or executable that register as service and who created the - service for further verification. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*systemctl *' - - '*service *' - selection2: - Image|endswith: - - systemctl - - service - selection3: - CommandLine: - - '*restart*' - - '*reload*' - - '*reenable*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and commandline executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: A commandline $process$ that may create or start a service on $dest$ - mitre_attack_id: - - T1053.006 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_service_started_or_enabled.yml b/dev/endpoint/linux_service_started_or_enabled.yml deleted file mode 100644 index aebf6a979d..0000000000 --- a/dev/endpoint/linux_service_started_or_enabled.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Linux Service Started Or Enabled -id: e0428212-61b7-11ec-88a3-acde48001122 -version: 1 -date: '2021-12-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for created or enable services in linux platform. - This technique can be executed or performed using systemctl or service tool application. - Adversaries may create or modify Windows services to repeatedly execute malicious - payloads as part of persistence. When Windows boots up, it starts programs or applications - called services that perform background system functions. Administrator may also - create a legitimated service for a specific tool or normal application as part of - task or automation, in this scenario it is suggested to look for the service path - of the actual script or executable that register as service and who created the - service for further verification. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*systemctl *' - - '*service *' - selection2: - Image|endswith: - - systemctl - - service - selection3: - CommandLine: - - '* start *' - - '* enable *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this commandline - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - message: a commandline $process$ that may create or start a service on $dest - mitre_attack_id: - - T1053.006 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_setuid_using_setcap_utility.yml b/dev/endpoint/linux_setuid_using_setcap_utility.yml deleted file mode 100644 index 74ca3e98a1..0000000000 --- a/dev/endpoint/linux_setuid_using_setcap_utility.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Setuid Using Setcap Utility -id: 9d96022e-6250-11ec-9a19-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic looks for suspicious setcap utility execution to enable - SUID bit. This allows a user to temporarily gain root access, usually in order to - run a program. For example, only the root account is allowed to change the password - information contained in the password database; If the SUID bit appears as an s, - the file's owner also has execute permission to the file; if it appears as an S, - the file's owner does not have execute permission. The second specialty permission - is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily - change group membership, usually to execute a program. The SGID bit is set if an - s or an S appears in the group section of permissions. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*setcap *' - selection2: - Image|endswith: setcap - selection3: - CommandLine: '* cap_setuid=' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A commandline $process$ that may set suid or sgid on $dest$ - mitre_attack_id: - - T1548.001 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_shred_overwrite_command.yml b/dev/endpoint/linux_shred_overwrite_command.yml deleted file mode 100644 index 1502728e3f..0000000000 --- a/dev/endpoint/linux_shred_overwrite_command.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux Shred Overwrite Command -id: c1952cf1-643c-4965-82de-11c067cbae76 -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a shred process to overwrite a files in a - linux machine. Shred Linux application is designed to overwrite file to hide its - contents or make the deleted file un-recoverable. Weve seen this technique in industroyer2 - malware that tries to wipe energy facilities of targeted sector as part of its destructive - attack. It might be some normal user may use this command for valid purposes but - it is recommended to check what files, disk or folder it tries to shred that might - be good pivot for incident response in this type of destructive malware. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-n*' - - '*-u*' - - '*-z*' - - '*-s*' - Image|endswith: shred - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A possible shred overwrite command $process$ executed on $dest$ - mitre_attack_id: - - T1485 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_sqlite3_privilege_escalation.yml b/dev/endpoint/linux_sqlite3_privilege_escalation.yml deleted file mode 100644 index 3ca3ee937b..0000000000 --- a/dev/endpoint/linux_sqlite3_privilege_escalation.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Linux Sqlite3 Privilege Escalation -id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1 -version: 1 -date: '2022-08-11' -author: Gowthamaraj Rajendran, Splunk -status: production -type: Anomaly -description: sqlite3 is a terminal-based front-end to the SQLite library that can - evaluate queries interactively and display the results in multiple formats. sqlite3 - can also be used within shell scripts and other applications to provide batch processing - features. If sudo right is given to this application for the user, then the user - can run system commands as root and possibly get a root shell. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*.shell*' - selection2: - CommandLine: '*sqlite3*' - selection3: - CommandLine: '*sudo*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the - Add-on for Linux Sysmon from Splunkbase. -known_false_positives: False positives may be present, filter as needed. -references: -- https://gtfobins.github.io/gtfobins/sqlite3/ -- https://manpages.ubuntu.com/manpages/trusty/en/man1/sqlite3.1.html -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ssh_authorized_keys_modification.yml b/dev/endpoint/linux_ssh_authorized_keys_modification.yml deleted file mode 100644 index e829fefaad..0000000000 --- a/dev/endpoint/linux_ssh_authorized_keys_modification.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Linux SSH Authorized Keys Modification -id: f5ab595e-28e5-4327-8077-5008ba97c850 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies based on process execution the modification - of SSH Authorized Keys. Adversaries perform this behavior to persist on endpoints. - During triage, review parallel processes and capture any additional file modifications - for review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/authorized_keys*' - Image|endswith: - - bash - - cat - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Filtering will be required as system administrators will add - and remove. One way to filter query is to add "echo". -references: -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ modifying SSH Authorized Keys. - mitre_attack_id: - - T1098.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_ssh_remote_services_script_execute.yml b/dev/endpoint/linux_ssh_remote_services_script_execute.yml deleted file mode 100644 index 0260d12c2e..0000000000 --- a/dev/endpoint/linux_ssh_remote_services_script_execute.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Linux SSH Remote Services Script Execute -id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 -version: 1 -date: '2022-07-27' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies SSH being utilized to move laterally - and execute a script or file on the remote host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*oStrictHostKeyChecking*' - - '*oConnectTimeout*' - - '*oBatchMode*' - Image|endswith: ssh - selection2: - CommandLine: - - '*http:*' - - '*https:*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: This is not a common command to be executed. Filter as needed. -references: -- https://redcanary.com/blog/lateral-movement-with-secure-shell/ -tags: - analytic_story: - - Linux Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ by user - $user$ attempting to move laterally and download a file. - mitre_attack_id: - - T1021.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux - update_timestamp: true diff --git a/dev/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/dev/endpoint/linux_stdout_redirection_to_dev_null_file.yml deleted file mode 100644 index 6a891ee3cc..0000000000 --- a/dev/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Linux Stdout Redirection To Dev Null File -id: de62b809-a04d-46b5-9a15-8298d330f0c8 -version: 1 -date: '2022-04-05' -author: Teoderick Contreras, Splunk -status: experimental -type: Anomaly -description: This analytic looks for suspicious commandline that redirect the stdout - or possible stderror to dev/null file. This technique was seen in cyclopsblink malware - where it redirect the possible output or error while modify the iptables firewall - setting of the compromised machine to hide its action from the user. This Anomaly - detection is a good pivot to look further why process or user use this un common - approach. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*&>/dev/null*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: unknown -references: -- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf -- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html -tags: - analytic_story: - - CyclopsBLink - - Industroyer2 - asset_type: Endpoint - confidence: 60 - impact: 60 - message: a commandline $process$ that redirect stdout to dev/null in $dest$ - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_stop_services.yml b/dev/endpoint/linux_stop_services.yml deleted file mode 100644 index 74752efd21..0000000000 --- a/dev/endpoint/linux_stop_services.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Linux Stop Services -id: d05204a5-9f1c-4946-a7f3-4fa58d76d5fd -version: 1 -date: '2022-04-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to detect events that attempt to stop or clear - a service. This is typically identified in parallel with other instances of service - enumeration of attempts to stop a service and then delete it. Adversaries utilize - this technique like industroyer2 malware to terminate security services or other - related services to continue there objective as a destructive payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*stop*' - Image|endswith: - - systemctl - - service - - svcadm - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ -- https://cert.gov.ua/article/39518 -tags: - analytic_story: - - Industroyer2 - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to stop services on endpoint $dest$ by $user$. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_sudo_or_su_execution.yml b/dev/endpoint/linux_sudo_or_su_execution.yml deleted file mode 100644 index 3e101898c0..0000000000 --- a/dev/endpoint/linux_sudo_or_su_execution.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Linux Sudo OR Su Execution -id: 4b00f134-6d6a-11ec-a90c-acde48001122 -version: 1 -date: '2022-01-04' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to detect the execution of sudo or su command in linux - operating system. The "sudo" command allows a system administrator to delegate authority - to give certain users (or groups of users) the ability to run some (or all) commands - as root or another user while providing an audit trail of the commands and their - arguments. This command is commonly abused by adversaries, malware author and red - teamers to elevate privileges to the targeted host. This command can be executed - by administrator for legitimate purposes or to execute process that need admin privileges, - In this scenario filter is needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - sudo - - su - selection2: - Image|endswith: - - sudo - - su - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are - using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://attack.mitre.org/techniques/T1548/003/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ that execute sudo or su in $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_sudoers_tmp_file_creation.yml b/dev/endpoint/linux_sudoers_tmp_file_creation.yml deleted file mode 100644 index 4d2f1f80c4..0000000000 --- a/dev/endpoint/linux_sudoers_tmp_file_creation.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Sudoers Tmp File Creation -id: be254a5c-63e7-11ec-89da-acde48001122 -version: 1 -date: '2021-12-23' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to looks for file creation of sudoers.tmp file cause - by editing /etc/sudoers using visudo or editor in linux platform. This technique - may abuse by adversaries, malware author and red teamers to gain elevated privilege - to targeted or compromised host. /etc/sudoers file controls who can run what commands - as what users on what machines and can also control special things such as whether - you need a password for particular commands. The file is composed of aliases (basically - variables) and user specifications (which control who can run what). -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*sudoers.tmp*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/ -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 90 - impact: 80 - message: A file $file_name$ is created in $file_path$ on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_system_network_discovery.yml b/dev/endpoint/linux_system_network_discovery.yml deleted file mode 100644 index 5118a822f1..0000000000 --- a/dev/endpoint/linux_system_network_discovery.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Linux System Network Discovery -id: 535cb214-8b47-11ec-a2c7-acde48001122 -version: 1 -date: '2022-02-11' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for possible enumeration of local network configuration. - This technique is commonly used as part of recon of adversaries or threat actor - to know some network information for its next or further attack. This anomaly detections - may capture normal event made by administrator during auditing or testing network - connection of specific host or network to network. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - arp - - ifconfig - - ip - - netstat - - firewall-cmd - - ufw - - iptables - - ss - - route - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md -tags: - analytic_story: - - Network Discovery - - Industroyer2 - asset_type: endpoint - confidence: 30 - impact: 30 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1016 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/linux_visudo_utility_execution.yml b/dev/endpoint/linux_visudo_utility_execution.yml deleted file mode 100644 index 3847f71449..0000000000 --- a/dev/endpoint/linux_visudo_utility_execution.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Linux Visudo Utility Execution -id: 08c41040-624c-11ec-a71f-acde48001122 -version: 1 -date: '2021-12-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to looks for suspicious commandline that add entry to - /etc/sudoers by using visudo utility tool in linux platform. This technique may - abuse by adversaries, malware author and red teamers to gain elevated privilege - to targeted or compromised host. /etc/sudoers file controls who can run what commands - as what users on what machines and can also control special things such as whether - you need a password for particular commands. The file is composed of aliases (basically - variables) and user specifications (which control who can run what). -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: visudo - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from - Splunkbase. -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. -references: -- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands -tags: - analytic_story: - - Linux Privilege Escalation - - Linux Persistence Techniques - asset_type: Endpoint - confidence: 40 - impact: 40 - message: A commandline $process$ executed on $dest$ - mitre_attack_id: - - T1548.003 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 16 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/local_account_discovery_with_net.yml b/dev/endpoint/local_account_discovery_with_net.yml deleted file mode 100644 index 128635eaa4..0000000000 --- a/dev/endpoint/local_account_discovery_with_net.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Local Account Discovery with Net -id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 2 -date: '2021-09-16' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to query for local users. The two arguments `user` - and 'users', return a list of all local users. Red Teams and adversaries alike use - net.exe to enumerate users for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - selection5: - CommandLine: - - '*user' - - '*users' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/local_account_discovery_with_wmic.yml b/dev/endpoint/local_account_discovery_with_wmic.yml deleted file mode 100644 index 0f40e13dc5..0000000000 --- a/dev/endpoint/local_account_discovery_with_wmic.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Local Account Discovery With Wmic -id: 4902d7aa-0134-11ec-9d65-acde48001122 -version: 2 -date: '2021-09-16' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for local users. The argument `useraccount` is used - to leverage WMI to return a list of all local users. Red Teams and adversaries alike - use net.exe to enumerate users for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*useraccount*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1087/001/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local user discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1087 - - T1087.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/logon_script_event_trigger_execution.yml b/dev/endpoint/logon_script_event_trigger_execution.yml deleted file mode 100644 index 2dab6661fd..0000000000 --- a/dev/endpoint/logon_script_event_trigger_execution.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Logon Script Event Trigger Execution -id: 4c38c264-1f74-11ec-b5fa-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of registry entry - to persist and gain privilege escalation upon booting up of compromised host. This - technique was seen in several APT and malware where it modify UserInitMprLogonScript - registry entry to its malicious payload to be executed upon boot up of the machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Environment\\UserInitMprLogonScript' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1037/001/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1037 - - T1037.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/macos___re_opened_applications.yml b/dev/endpoint/macos___re_opened_applications.yml deleted file mode 100644 index 0f0e174b9c..0000000000 --- a/dev/endpoint/macos___re_opened_applications.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: MacOS - Re-opened Applications -id: 40bb64f9-f619-4e3d-8732-328d40377c4b -version: 1 -date: '2020-02-07' -author: Jamie Windley, Splunk -status: experimental -type: TTP -description: This search looks for processes referencing the plist files that determine - which applications are re-opened when a user reboots their machine. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*com.apple.loginwindow*' - condition: selection1 -how_to_implement: In order to properly run this search, Splunk needs to ingest process - data from your osquery deployed agents with the [splunk.conf](https://github.com/splunk/TA-osquery/blob/master/config/splunk.conf) - pack enabled. Also the [TA-OSquery](https://github.com/splunk/TA-osquery) must be - deployed across your indexers and universal forwarders in order to have the data - populate the Endpoint data model. -known_false_positives: At this stage, there are no known false positives. During testing, - no process events refering the com.apple.loginwindow.plist files were observed during - normal operation of re-opening applications on reboot. Therefore, it can be asumed - that any occurences of this in the process events would be worth investigating. - In the event that the legitimate modification by the system of these files is in - fact logged to the process log, then the process_name of that process can be added - to an allow list. -references: [] -tags: - analytic_story: - - ColdRoot MacOS RAT - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: threat diff --git a/dev/endpoint/malicious_powershell_process___encoded_command.yml b/dev/endpoint/malicious_powershell_process___encoded_command.yml deleted file mode 100644 index 150451fd61..0000000000 --- a/dev/endpoint/malicious_powershell_process___encoded_command.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Malicious PowerShell Process - Encoded Command -id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -version: 7 -date: '2022-01-18' -author: David Dorsey, Michael Haag, Splunk -status: production -type: Hunting -description: 'The following analytic identifies the use of the EncodedCommand PowerShell - parameter. This is typically used by Administrators to run complex scripts, but - commonly used by adversaries to hide their code. - - The analytic identifies all variations of EncodedCommand, as PowerShell allows the - ability to shorten the parameter. For example enc, enco, encod and so forth. In - addition, through our research it was identified that PowerShell will interpret - different command switch types beyond the hyphen. We have added endash, emdash, - horizontal bar, and forward slash. - - During triage, review parallel events to determine legitimacy. Tune as needed based - on admin scripts in use. - - Alternatively, may use regex per matching here https://regexr.com/662ov.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: System administrators may use this option, but it's not common. -references: -- https://regexr.com/662ov -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - NOBELIUM Group - - WhisperGate - - DarkCrystal RAT - - Qakbot - - CISA AA22-320A - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Powershell.exe running potentially malicious encodede commands on $dest$ - mitre_attack_id: - - T1027 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/dev/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml deleted file mode 100644 index 6330b449aa..0000000000 --- a/dev/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Malicious PowerShell Process With Obfuscation Techniques -id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 -version: 5 -date: '2021-01-19' -author: David Dorsey, Splunk -status: production -type: TTP -description: This search looks for PowerShell processes launched with arguments that - have characters indicative of obfuscation on the command-line. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: These characters might be legitimately on the command-line, - but it is not common. -references: [] -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - asset_type: Endpoint - confidence: 60 - impact: 70 - message: Powershell.exe running with potential obfuscated arguments on $dest$ - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/dev/endpoint/mimikatz_passtheticket_commandline_parameters.yml deleted file mode 100644 index afaf47eb72..0000000000 --- a/dev/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Mimikatz PassTheTicket CommandLine Parameters -id: 13bbd574-83ac-11ec-99d4-acde48001122 -version: 1 -date: '2022-02-01' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic looks for the use of Mimikatz command line parameters - leveraged to execute pass the ticket attacks. Red teams and adversaries alike may - use the pass the ticket technique using stolen Kerberos tickets to move laterally - within an environment, bypassing normal system access controls. Defenders should - be aware that adversaries may customize the source code of Mimikatz and modify the - command line parameters. This would effectively bypass this analytic. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*sekurlsa::tickets /export*' - - '*kerberos::ptt*' - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although highly unlikely, legitimate applications may use the - same command line parameters as Mimikatz. -references: -- https://github.com/gentilkiwi/mimikatz -- https://attack.mitre.org/techniques/T1550/003/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - - CISA AA22-320A - asset_type: endpoint - confidence: 60 - impact: 60 - message: Mimikatz command line parameters for pass the ticket attacks were used - on $dest$ - mitre_attack_id: - - T1550 - - T1550.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/mmc_lolbas_execution_process_spawn.yml b/dev/endpoint/mmc_lolbas_execution_process_spawn.yml deleted file mode 100644 index 829f0e63b3..0000000000 --- a/dev/endpoint/mmc_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,114 +0,0 @@ -name: Mmc LOLBAS Execution Process Spawn -id: f6601940-4c74-11ec-b9b7-3e22fbd008af -version: 1 -date: '2021-11-23' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing the DCOM protocol - and the MMC20 COM object, the executed command is spawned as a child processs of - `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused - by threat actors to perform tasks like executing malicious code. Looking for child - processes of mmc.exe that are part of the LOLBAS project can help defenders identify - lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: mmc.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Mmc.exe spawned a LOLBAS process on $dest$. - mitre_attack_id: - - T1021 - - T1021.003 - - T1218.014 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/monitor_registry_keys_for_print_monitors.yml b/dev/endpoint/monitor_registry_keys_for_print_monitors.yml deleted file mode 100644 index 9baec47a2a..0000000000 --- a/dev/endpoint/monitor_registry_keys_for_print_monitors.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Monitor Registry Keys for Print Monitors -id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -version: 3 -date: '2020-01-28' -author: Bhavin Patel, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search looks for registry activity associated with modifications - to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this - scenario, an attacker can load an arbitrary .dll into the print-monitor registry - by giving the full path name to the after.dll. The system will execute the .dll - with elevated (SYSTEM) permissions and will persist after reboot. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*CurrentControlSet\\Control\\Print\\Monitors*' - Registry.action: modified - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. - The data used for this search is typically generated via logs that report registry - modifications. -known_false_positives: You will encounter noise from legitimate print-monitor registry - entries. -references: [] -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 80 - message: New print monitor added on $dest$ - mitre_attack_id: - - T1547.010 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml b/dev/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml deleted file mode 100644 index db1edb3b9f..0000000000 --- a/dev/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: MS Exchange Mailbox Replication service writing Active Server Pages -id: 985f322c-57a5-11ec-b9ac-acde48001122 -version: 1 -date: '2021-12-07' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: 'The following query identifies suspicious .aspx created in 3 paths identified - by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM - group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, - `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited - to process name MSExchangeMailboxReplication.exe, which typically does not write - .aspx files to disk. Upon triage, the suspicious .aspx file will likely look obvious - on the surface. inspect the contents for script code inside. Identify additional - log sources, IIS included, to review source and other potential exploitation. It - is often the case that a particular threat is only applicable to a specific subset - of systems in your environment. Typically analytics to detect those threats are - written without the benefit of being able to only target those systems as well. - Writing analytics against all systems when those behaviors are limited to identifiable - subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability - on Microsoft Exchange Servers. With asset information, a hunter can limit their - analytics to systems that have been identified as Exchange servers. A hunter may - start with the theory that the exchange server is communicating with new systems - that it has not previously. If this theory is run against all publicly facing systems, - the amount of noise it will generate will likely render this theory untenable. However, - using the asset information to limit this analytic to just the Exchange servers - will reduce the noise allowing the hunter to focus only on the systems where this - behavioral change is relevant.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: MSExchangeMailboxReplication.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -references: -- https://redcanary.com/blog/blackbyte-ransomware/ -tags: - analytic_story: - - ProxyShell - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 90 - message: A file - $file_name$ was written to disk that is related to IIS exploitation - related to ProxyShell. Review further file modifications on endpoint $dest$ by - user $user$. - mitre_attack_id: - - T1505 - - T1505.003 - - T1190 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: file_name - type: File Name - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint diff --git a/dev/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/dev/endpoint/msbuild_suspicious_spawned_by_script_process.yml deleted file mode 100644 index 212740aa76..0000000000 --- a/dev/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: MSBuild Suspicious Spawned By Script Process -id: 213b3148-24ea-11ec-93a2-acde48001122 -version: 1 -date: '2021-10-04' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious child process of MSBuild spawned - by Windows Script Host - cscript or wscript. This behavior or event are commonly - seen and used by malware or adversaries to execute malicious msbuild process using - malicious script in the compromised host. During triage, review parallel processes - and identify any file modifications. MSBuild may load a script from the same path - without having command-line arguments. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - wscript.exe - - cscript.exe - selection2: - OriginalFileName: MSBuild.exe - selection3: - Image|endswith: msbuild.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as developers do not spawn - MSBuild via a WSH. -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/ -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed - by $user$ - mitre_attack_id: - - T1127.001 - - T1127 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/dev/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml deleted file mode 100644 index 0446a2ec37..0000000000 --- a/dev/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Mshta spawning Rundll32 OR Regsvr32 Process -id: 4aa5d062-e893-11eb-9eb2-acde48001122 -version: 2 -date: '2021-07-19' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious mshta.exe process that spawn rundll32 - or regsvr32 child process. This technique was seen in several malware nowadays like - trickbot to load its initial .dll stage loader to execute and download the the actual - trickbot payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: mshta.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: limitted. this anomaly behavior is not commonly seen in clean - host. -references: -- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 -tags: - analytic_story: - - Trickbot - - IcedID - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 70 - message: a mshta parent process $parent_process_name$ spawn child process $process_name$ - in host $dest$ - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/net_localgroup_discovery.yml b/dev/endpoint/net_localgroup_discovery.yml deleted file mode 100644 index 230232b494..0000000000 --- a/dev/endpoint/net_localgroup_discovery.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Net Localgroup Discovery -id: 54f5201e-155b-11ec-a6e2-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic will identify the use of localgroup discovery - using `net localgroup`. During triage, review parallel processes and identify any - further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*localgroup*' - Image|endswith: - - net1.exe - - net.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present. Tune as needed. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Active Directory Discovery - - Windows Discovery Techniques - - Azorult - - Windows Post-Exploitation - - Prestige Ransomware - - Volt Typhoon - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/net_profiler_uac_bypass.yml b/dev/endpoint/net_profiler_uac_bypass.yml deleted file mode 100644 index fa53e9769e..0000000000 --- a/dev/endpoint/net_profiler_uac_bypass.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: NET Profiler UAC bypass -id: 0252ca80-e30d-11eb-8aa3-acde48001122 -version: 2 -date: '2022-02-18' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect modification of registry to bypass UAC windows - feature. This technique is to add a payload dll path on .NET COR file path that - will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring - the registry key and values in the detection area. It may happened that windows - update some dll related to mmc.exe and add dll path in this registry. In this case - filtering is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '*.dll' - TargetObject: '*\\Environment\\COR_PROFILER_PATH' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: limited false positive. It may trigger by some windows update - that will modify this registry. -references: -- https://offsec.almond.consulting/UAC-bypass-dotnet.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_connection_discovery_with_arp.yml b/dev/endpoint/network_connection_discovery_with_arp.yml deleted file mode 100644 index ae6d707bbd..0000000000 --- a/dev/endpoint/network_connection_discovery_with_arp.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Network Connection Discovery With Arp -id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -version: 1 -date: '2021-09-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `arp.exe` utilized to get a - listing of network connections on a compromised system. Red Teams and adversaries - alike may use arp.exe for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-a*' - Image|endswith: arp.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_connection_discovery_with_net.yml b/dev/endpoint/network_connection_discovery_with_net.yml deleted file mode 100644 index 36c0237cb3..0000000000 --- a/dev/endpoint/network_connection_discovery_with_net.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Network Connection Discovery With Net -id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -version: 1 -date: '2021-09-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` with command-line - arguments utilized to get a listing of network connections on a compromised system. - Red Teams and adversaries alike may use net.exe for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*use*' - Image|endswith: - - net1.exe - - net.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -tags: - analytic_story: - - Active Directory Discovery - - Azorult - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_connection_discovery_with_netstat.yml b/dev/endpoint/network_connection_discovery_with_netstat.yml deleted file mode 100644 index c19c688b6d..0000000000 --- a/dev/endpoint/network_connection_discovery_with_netstat.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Network Connection Discovery With Netstat -id: 2cf5cc25-f39a-436d-a790-4857e5995ede -version: 1 -date: '2021-09-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `netstat.exe` with command-line - arguments utilized to get a listing of network connections on a compromised system. - Red Teams and adversaries alike may use netstat.exe for situational awareness and - Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*-a*' - Image|endswith: netstat.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - - CISA AA22-277A - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/network_discovery_using_route_windows_app.yml b/dev/endpoint/network_discovery_using_route_windows_app.yml deleted file mode 100644 index 1e5b6bd96e..0000000000 --- a/dev/endpoint/network_discovery_using_route_windows_app.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Network Discovery Using Route Windows App -id: dd83407e-439f-11ec-ab8e-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic look for a spawned process of route.exe windows application. - Adversaries and red teams alike abuse this application the recon or do a network - discovery on a target host. but one possible false positive might be an automated - tool used by a system administator or a powershell script in amazon ec2 config services. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: route.exe - selection2: - Image|endswith: route.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives or an amazon - ec2 script that uses this application. Filter as needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - - CISA AA22-277A - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ - mitre_attack_id: - - T1016 - - T1016.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: WinEventLog diff --git a/dev/endpoint/nishang_powershelltcponeline.yml b/dev/endpoint/nishang_powershelltcponeline.yml deleted file mode 100644 index dc90e58d79..0000000000 --- a/dev/endpoint/nishang_powershelltcponeline.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Nishang PowershellTCPOneLine -id: 1a382c6c-7c2e-11eb-ac69-acde48001122 -version: 2 -date: '2021-03-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that - spawns a call back to a remote Command And Control server. This is a powershell - oneliner. In addition, this will capture on the command-line additional utilities - used by Nishang. Triage the endpoint and identify any parallel processes that look - suspicious. Review the reputation of the remote IP or domain contacted by the powershell - process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*System.Text.ASCIIEncoding*' - selection6: - CommandLine: '*Net.Sockets.TCPClient*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives may be present. Filter as needed based - on initial analysis. -references: -- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1 -- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ -- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ -- https://www.rapid7.com/blog/post/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ -tags: - analytic_story: - - HAFNIUM Group - asset_type: Endpoint - confidence: 60 - impact: 70 - message: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/nltest_domain_trust_discovery.yml b/dev/endpoint/nltest_domain_trust_discovery.yml deleted file mode 100644 index dd8178f845..0000000000 --- a/dev/endpoint/nltest_domain_trust_discovery.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: NLTest Domain Trust Discovery -id: c3e05466-5f22-11eb-ae93-0242ac130002 -version: 2 -date: '2022-04-18' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for the execution of `nltest.exe` with command-line - arguments utilized to query for Domain Trust information. Two arguments `/domain - trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted - domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current - domain to assist with further understanding where to pivot next. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: nltestrk.exe - selection2: - Image|endswith: nltest.exe - selection3: - CommandLine: - - '*/domain_trusts*' - - '*/all_trusts*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators may use nltest for troubleshooting purposes, - otherwise, rarely used. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md -- https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104 -- https://attack.mitre.org/techniques/T1482/ -- https://owasp.org/www-pdf-archive/Red_Team_Operating_in_a_Modern_Environment.pdf -- https://ss64.com/nt/nltest.html -- https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/ -- https://thedfirreport.com/2020/10/08/ryuks-return/ -tags: - analytic_story: - - Ryuk Ransomware - - Domain Trust Discovery - - IcedID - - Active Directory Discovery - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Domain trust discovery execution on $dest$ - mitre_attack_id: - - T1482 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ntdsutil_export_ntds.yml b/dev/endpoint/ntdsutil_export_ntds.yml deleted file mode 100644 index 2eb56965b3..0000000000 --- a/dev/endpoint/ntdsutil_export_ntds.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Ntdsutil Export NTDS -id: da63bc76-61ae-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-28' -author: Michael Haag, Patrick Bareiss, Splunk -status: production -type: TTP -description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory - database - NTDS.dit, typically used for offline password cracking. It may be used - in normal circumstances with no command line arguments or shorthand variations of - more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical - command used to dump ntds.dit - - ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q - - This technique uses "Install from Media" (IFM), which will extract a copy of the - Active Directory database. A successful export of the Active Directory database - will yield a file modification named ntds.dit to the destination.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*ntds*' - Image|endswith: ntdsutil.exe - selection2: - CommandLine: '*create*' - condition: (selection1 and selection2) -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints, to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Highly possible Server Administrators will troubleshoot with - ntdsutil.exe, generating false positives. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) -- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -tags: - analytic_story: - - Credential Dumping - - HAFNIUM Group - - Living Off The Land - - Prestige Ransomware - - Ntdsutil Export NTDS - asset_type: Endpoint - confidence: 50 - impact: 100 - message: Active Directory NTDS export on $dest$ - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 50 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_application_drop_executable.yml b/dev/endpoint/office_application_drop_executable.yml deleted file mode 100644 index 102ba11b4f..0000000000 --- a/dev/endpoint/office_application_drop_executable.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Office Application Drop Executable -id: 73ce70c4-146d-11ec-9184-acde48001122 -version: 1 -date: '2021-09-13' -author: Teoderick Contreras, Michael Haag Splunk -status: production -type: TTP -description: This search is to detect a suspicious MS office application that drops - or creates executables or scripts in a Windows Operating System. This behavior is - commonly seen in spear phishing office attachment where it drop malicious files - or script to compromised the host. It might be some normal macro may drop script - or tools as part of automation but still this behavior is reallly suspicious and - not commonly seen in normal office application -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - - wordpad.exe - - wordview.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: office macro for automation may do this behavior -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -- https://www.joesandbox.com/analysis/702680/0/html -tags: - analytic_story: - - FIN7 - - AgentTesla - asset_type: Endpoint - confidence: 80 - impact: 80 - message: process $process_name$ drops a file $TargetFilename$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_application_spawn_regsvr32_process.yml b/dev/endpoint/office_application_spawn_regsvr32_process.yml deleted file mode 100644 index b149c06ee5..0000000000 --- a/dev/endpoint/office_application_spawn_regsvr32_process.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Office Application Spawn Regsvr32 process -id: 2d9fc90c-f11f-11eb-9300-acde48001122 -version: 2 -date: '2021-07-30' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this detection was designed to identifies suspicious spawned process - of known MS office application due to macro or malicious code. this technique can - be seen in so many malware like IcedID that used MS office as its weapon or attack - vector to initially infect the machines. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - outlook.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://www.joesandbox.com/analysis/380662/0/html -tags: - analytic_story: - - IcedID - - Qakbot - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Office application spawning regsvr32.exe on $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_application_spawn_rundll32_process.yml b/dev/endpoint/office_application_spawn_rundll32_process.yml deleted file mode 100644 index 5fa8a8b166..0000000000 --- a/dev/endpoint/office_application_spawn_rundll32_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Office Application Spawn rundll32 process -id: 958751e4-9c5f-11eb-b103-acde48001122 -version: 2 -date: '2021-04-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This detection was designed to identify suspicious spawned processes - of known MS office applications due to macro or malicious code. this technique can - be seen in so many malware like trickbot that used MS office as its weapon or attack - vector to initially infect the machines. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://any.run/malware-trends/trickbot -- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe -- https://www.joesandbox.com/analysis/702680/0/html -tags: - analytic_story: - - Spearphishing Attachments - - Trickbot - - IcedID - - AgentTesla - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Office application spawning rundll32.exe on $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_document_spawned_child_process_to_download.yml b/dev/endpoint/office_document_spawned_child_process_to_download.yml deleted file mode 100644 index 55fc72c0b4..0000000000 --- a/dev/endpoint/office_document_spawned_child_process_to_download.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Office Document Spawned Child Process To Download -id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -version: 3 -date: '2021-09-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect potential malicious office document executing - lolbin child process to download payload or other malware. Since most of the attacker - abused the capability of office document to execute living on land application to - blend it to the normal noise in the infected machine to cover its track. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*http:*' - - '*https:*' - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances office application and browser may be - used. -known_false_positives: Default browser not in the filter list. -references: -- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Office document spawning suspicious child process on $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawn_cmd_process.yml b/dev/endpoint/office_product_spawn_cmd_process.yml deleted file mode 100644 index c287949e18..0000000000 --- a/dev/endpoint/office_product_spawn_cmd_process.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Office Product Spawn CMD Process -id: b8b19420-e892-11eb-9244-acde48001122 -version: 2 -date: '2021-07-19' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: this search is to detect a suspicious office product process that spawn - cmd child process. This is commonly seen in a ms office product having macro to - execute shell command to download or execute malicious lolbin relative to its malicious - code. This is seen in trickbot spear phishing doc where it execute shell cmd to - run mshta payload. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - selection2: - OriginalFileName: Cmd.Exe - selection3: - Image|endswith: cmd.exe - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: IT or network admin may create an document automation that - will run shell script. -references: -- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 -- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ -- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing -tags: - analytic_story: - - Trickbot - - DarkCrystal RAT - - Azorult - - Remcos - - Qakbot - - AgentTesla - asset_type: Endpoint - confidence: 80 - impact: 70 - message: an office product parent process $parent_process_name$ spawn child process - $process_name$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_bitsadmin.yml b/dev/endpoint/office_product_spawning_bitsadmin.yml deleted file mode 100644 index b8b0bf3acc..0000000000 --- a/dev/endpoint/office_product_spawning_bitsadmin.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Office Product Spawning BITSAdmin -id: e8c591f4-a6d7-11eb-8cf7-acde48001122 -version: 2 -date: '2021-04-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by different - malware families (including TA551, IcedID). This detection identifies any Windows - Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line - of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line - arguments as transfer, Download, priority, Foreground. In addition, Threat Research - has released a detections identifying suspicious use of `bitsadmin.exe`. In this - instance, we narrow our detection down to the Office suite as a parent process. - During triage, review all file modifications. Capture and analyze any artifacts - on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote - destination, capture and block the IPs or domain. Review additional parallel processes - for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: bitsadmin.exe - selection3: - Image|endswith: bitsadmin.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_certutil.yml b/dev/endpoint/office_product_spawning_certutil.yml deleted file mode 100644 index 96d984e8a0..0000000000 --- a/dev/endpoint/office_product_spawning_certutil.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Office Product Spawning CertUtil -id: 6925fe72-a6d5-11eb-9e17-acde48001122 -version: 2 -date: '2021-04-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by different - malware families (including TA551, IcedID). This detection identifies any Windows - Office Product spawning `certutil.exe`. In malicious instances, the command-line - of `certutil.exe` will contain a URL to a remote destination. In addition, Threat - Research has released a detections identifying suspicious use of `certutil.exe`. - In this instance, we narrow our detection down to the Office suite as a parent process. - During triage, review all file modifications. Capture and analyze any artifacts - on disk. The Office Product, or `certutil.exe` will have reached out to a remote - destination, capture and block the IPs or domain. Review additional parallel processes - for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: CertUtil.exe - selection3: - Image|endswith: certutil.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://redcanary.com/threat-detection-report/threats/TA551/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md -tags: - analytic_story: - - Spearphishing Attachments - - AgentTesla - - Trickbot - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_mshta.yml b/dev/endpoint/office_product_spawning_mshta.yml deleted file mode 100644 index bba3a5c4e2..0000000000 --- a/dev/endpoint/office_product_spawning_mshta.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Office Product Spawning MSHTA -id: 6078fa20-a6d2-11eb-b662-acde48001122 -version: 2 -date: '2021-04-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by different - malware families (including TA551, IcedID). This detection identifies any Windows - Office Product spawning `mshta.exe`. In malicious instances, the command-line of - `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. - In addition, Threat Research has released a detections identifying suspicious use - of `mshta.exe`. In this instance, we narrow our detection down to the Office suite - as a parent process. During triage, review all file modifications. Capture and analyze - any artifacts on disk. The Office Product, or `mshta.exe` will have reached out - to a remote destination, capture and block the IPs or domain. Review additional - parallel processes for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: MSHTA.EXE - selection3: - Image|endswith: mshta.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://redcanary.com/threat-detection-report/threats/TA551/ -tags: - analytic_story: - - Spearphishing Attachments - - IcedID - - Azorult - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/dev/endpoint/office_product_spawning_rundll32_with_no_dll.yml deleted file mode 100644 index a83797854c..0000000000 --- a/dev/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Office Product Spawning Rundll32 with no DLL -id: c661f6be-a38c-11eb-be57-acde48001122 -version: 2 -date: '2021-04-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by IcedID - malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` - without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` - will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat - Research has released a detection identifying the use of `DllRegisterServer` on - the command-line of `rundll32.exe`. In this instance, we narrow our detection down - to the Office suite as a parent process. During triage, review all file modifications. - Capture and analyze the `DLL` that was dropped to disk. The Office Product will - have reached out to a remote destination, capture and block the IPs or domain. Review - additional parallel processes for further activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://www.joesandbox.com/analysis/395471/0/html -- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ -- https://any.run/malware-trends/icedid -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ and no dll commandline $process$ - in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_spawning_windows_script_host.yml b/dev/endpoint/office_product_spawning_windows_script_host.yml deleted file mode 100644 index 6a369aaea2..0000000000 --- a/dev/endpoint/office_product_spawning_windows_script_host.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Office Product Spawning Windows Script Host -id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 -version: 1 -date: '2022-09-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic will identify a Windows Office Product spawning - WScript.exe or CScript.exe. Tuning may be required based on legitimate application - usage that may spawn scripts from an Office product. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - wscript.exe - - cscript.exe - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on macro based approved - documents in the organization. Filtering may be needed. -references: -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing -tags: - analytic_story: - - Spearphishing Attachments - - Remcos - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ on host $dest$. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/office_product_spawning_wmic.yml b/dev/endpoint/office_product_spawning_wmic.yml deleted file mode 100644 index 5462ef532e..0000000000 --- a/dev/endpoint/office_product_spawning_wmic.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Office Product Spawning Wmic -id: ffc236d6-a6c9-11eb-95f1-acde48001122 -version: 3 -date: '2021-09-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies the latest behavior utilized by Ursnif - malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. - In malicious instances, the command-line of `wmic.exe` will contain `wmic process - call create`. In addition, Threat Research has released a detection identifying - the use of `wmic process call create` on the command-line of `wmic.exe`. In this - instance, we narrow our detection down to the Office suite as a parent process. - During triage, review all file modifications. Capture and analyze any artifacts - on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, - capture and block the IPs or domain. Review additional parallel processes for further - activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - selection2: - OriginalFileName: wmic.exe - selection3: - Image|endswith: wmic.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: No false positives known. Filter as needed. -references: -- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ -- https://attack.mitre.org/techniques/T1047/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md -tags: - analytic_story: - - Spearphishing Attachments - - FIN7 - asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_product_writing_cab_or_inf.yml b/dev/endpoint/office_product_writing_cab_or_inf.yml deleted file mode 100644 index 587f21a67e..0000000000 --- a/dev/endpoint/office_product_writing_cab_or_inf.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Office Product Writing cab or inf -id: f48cd1d4-125a-11ec-a447-acde48001122 -version: 2 -date: '2022-07-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies behavior related to CVE-2021-40444. - Whereas the malicious document will load ActiveX and download the remote payload - (.inf, .cab). During triage, review parallel processes and further activity on endpoint - to identify additional patterns. Retrieve the file modifications and analyze further. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - - wordpad.exe - - wordview.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -references: -- https://twitter.com/vxunderground/status/1436326057179860992?s=20 -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20 -tags: - analytic_story: - - Spearphishing Attachments - - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-40444 - impact: 80 - message: An instance of $process_name$ was identified on $dest$ writing an inf or - cab file to this. This is not typical of $process_name$. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/office_spawning_control.yml b/dev/endpoint/office_spawning_control.yml deleted file mode 100644 index 5433271d66..0000000000 --- a/dev/endpoint/office_spawning_control.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Office Spawning Control -id: 053e027c-10c7-11ec-8437-acde48001122 -version: 1 -date: '2021-09-08' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies control.exe spawning from an office - product. This detection identifies any Windows Office Product spawning `control.exe`. - In malicious instances, the command-line of `control.exe` will contain a file path - to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection - down to the Office suite as a parent process. During triage, review all file modifications. - Capture and analyze any artifacts on disk. review parallel and child processes to - identify further suspicious behavior -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: control.exe - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - mspub.exe - - visio.exe - - wordpad.exe - - wordview.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present. -references: -- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://attack.mitre.org/techniques/T1218/011/ -- https://www.echotrail.io/insights/search/control.exe/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml -tags: - analytic_story: - - Spearphishing Attachments - - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-40444 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ clicking a suspicious attachment. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/dev/endpoint/outbound_network_connection_from_java_using_default_ports.yml deleted file mode 100644 index c55fd5c445..0000000000 --- a/dev/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Outbound Network Connection from Java Using Default Ports -id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 2 -date: '2022-06-28' -author: Mauricio Velazco, Lou Stella, Splunk -status: production -type: TTP -description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability - is that the victim server will perform outbound connections to attacker-controlled - infrastructure. This is required as part of the JNDI lookup as well as for retrieving - the second stage .class payload. The following analytic identifies the Java process - reaching out to default ports used by the LDAP and RMI protocols. This behavior - could represent successfull exploitation. Note that adversaries can easily decide - to use arbitrary ports for these protocols and potentially bypass this detection. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - java.exe - - javaw.exe - - javaw.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Legitimate Java applications may use perform outbound connections - to these ports. Filter as needed -references: -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ -tags: - analytic_story: - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 60 - cve: - - CVE-2021-44228 - impact: 90 - message: Java performed outbound connections to default ports of LDAP or RMI on - $dest$ - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/overwriting_accessibility_binaries.yml b/dev/endpoint/overwriting_accessibility_binaries.yml deleted file mode 100644 index c49d1bdc9c..0000000000 --- a/dev/endpoint/overwriting_accessibility_binaries.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Overwriting Accessibility Binaries -id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae -version: 4 -date: '2020-07-21' -author: David Dorsey, Splunk -status: production -type: TTP -description: Microsoft Windows contains accessibility features that can be launched - with a key combination before a user has logged in. An adversary can modify or replace - these programs so they can get a command prompt or backdoor without logging in to - the system. This search looks for modifications to these binaries. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*\\Windows\\System32\\sethc.exe*' - - '*\\Windows\\System32\\utilman.exe*' - - '*\\Windows\\System32\\osk.exe*' - - '*\\Windows\\System32\\Magnify.exe*' - - '*\\Windows\\System32\\Narrator.exe*' - - '*\\Windows\\System32\\DisplaySwitch.exe*' - - '*\\Windows\\System32\\AtBroker.exe*' - condition: (selection1) -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: Microsoft may provide updates to these binaries. Verify that - these changes do not correspond with your normal software update cycle. -references: [] -tags: - analytic_story: - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 90 - impact: 80 - message: A suspicious file modification or replace in $file_path$ in host $dest$ - mitre_attack_id: - - T1546 - - T1546.008 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: file_path - type: File - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/password_policy_discovery_with_net.yml b/dev/endpoint/password_policy_discovery_with_net.yml deleted file mode 100644 index 04238cb5cb..0000000000 --- a/dev/endpoint/password_policy_discovery_with_net.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Password Policy Discovery with Net -id: 09336538-065a-11ec-8665-acde48001122 -version: 1 -date: '2021-08-26' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command line arguments used to obtain the domain password policy. Red Teams and - adversaries may leverage `net.exe` for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*accounts*' - Image|endswith: - - net1.exe - - net.exe - selection2: - CommandLine: '*/domain*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 30 - impact: 30 - message: an instance of process $process_name$ with commandline $process$ in $dest$ - mitre_attack_id: - - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/permission_modification_using_takeown_app.yml b/dev/endpoint/permission_modification_using_takeown_app.yml deleted file mode 100644 index b43e142618..0000000000 --- a/dev/endpoint/permission_modification_using_takeown_app.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Permission Modification using Takeown App -id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a modification of file or directory permission - using takeown.exe windows app. This technique was seen in some ransomware that take - the ownership of a folder or files to encrypt or delete it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/f*' - Image|endswith: takeown.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: takeown.exe is a normal windows application that may used by - network operator. -references: -- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A suspicious of execution of $process_name$ with process id $process_id$ - and commandline $process$ to modify permission of directory or files in host $dest$ - mitre_attack_id: - - T1222 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ping_sleep_batch_command.yml b/dev/endpoint/ping_sleep_batch_command.yml deleted file mode 100644 index b196132e31..0000000000 --- a/dev/endpoint/ping_sleep_batch_command.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Ping Sleep Batch Command -id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 1 -date: '2022-01-20' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic will identify the possible execution of ping sleep batch - commands. This technique was seen in several malware samples and is used to trigger - sleep times without explicitly calling sleep functions or commandlets. The goal - is to delay the execution of malicious code and bypass detection or sandbox analysis. - This detection can be a good indicator of a process delaying its execution for - malicious purposes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: ping.exe - selection2: - Image|endswith: ping.exe - selection3: - ParentCommandLine: '*-n*' - selection4: - ParentCommandLine: '*ping*' - selection5: - ParentCommandLine: '* Nul*' - selection6: - ParentCommandLine: '*>*' - selection7: - CommandLine: '*-n*' - selection8: - CommandLine: '*ping*' - selection9: - CommandLine: '* Nul*' - selection10: - CommandLine: '*>*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 or selection7 or selection8 or selection9 or selection10 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrator or network operator may execute this command. - Please update the filter macros to remove false positives. -references: -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - WhisperGate - asset_type: Endpoint - confidence: 60 - impact: 60 - message: suspicious $process$ commandline run in $dest$ - mitre_attack_id: - - T1497 - - T1497.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/possible_browser_pass_view_parameter.yml b/dev/endpoint/possible_browser_pass_view_parameter.yml deleted file mode 100644 index dd051df54a..0000000000 --- a/dev/endpoint/possible_browser_pass_view_parameter.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Possible Browser Pass View Parameter -id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 1 -date: '2021-11-22' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic will detect if a suspicious process contains a commandline - parameter related to a web browser credential dumper. This technique is used by - Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to - dump web browser credentials. Remcos uses the "/stext" command line to dump the - credentials in text format. This Hunting query is a good indicator of hosts suffering - from possible Remcos RAT infection. Since the hunting query is based on the parameter - command and the possible path where it will save the text credential information, - it may catch normal tools that are using the same command and behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*\\temp\\*' - - '*\\users\\public\\*' - - '*\\programdata\\*' - selection2: - CommandLine: - - '*/stext *' - - '*/shtml *' - - '*/LoadPasswordsIE*' - - '*/LoadPasswordsFirefox*' - - '*/LoadPasswordsChrome*' - - '*/LoadPasswordsOpera*' - - '*/LoadPasswordsSafari*' - - '*/UseOperaPasswordFile*' - - '*/OperaPasswordFile*' - - '*/stab*' - - '*/scomma*' - - '*/stabular*' - - '*/shtml*' - - '*/sverhtml*' - - '*/sxml*' - - '*/skeepass*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: False positive is quite limited. Filter is needed -references: -- https://www.nirsoft.net/utils/web_browser_password.html -- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 40 - impact: 40 - message: suspicious process $process_name$ contains commandline $process$ on $dest$ - mitre_attack_id: - - T1555.003 - - T1555 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 16 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/possible_lateral_movement_powershell_spawn.yml b/dev/endpoint/possible_lateral_movement_powershell_spawn.yml deleted file mode 100644 index 2b373cf1b4..0000000000 --- a/dev/endpoint/possible_lateral_movement_powershell_spawn.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Possible Lateral Movement PowerShell Spawn -id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 1 -date: '2021-11-29' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic assists with identifying a PowerShell process - spawned as a child or grand child process of commonly abused processes during lateral - movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` - and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, - Windows Management Instrumentation, Task Scheduler, Windows Remote Management and - the DCOM protocol can be abused to start a process on a remote endpoint. Looking - for PowerShell spawned out of this processes may reveal a lateral movement attack. - Red Teams and adversaries alike may abuse these services during a breach for lateral - movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - mmc.exe - - wsmprovhost.exe - - svchost.exe - - services.exe - - wmiprvse.exe - selection2: - CommandLine: '*powershell.exe*' - Image|endswith: - - cmd.exe - - powershell.exe - - pwsh.exe - selection3: - CommandLine: '*pwsh.exe*' - Image|endswith: cmd.exe - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may spawn PowerShell as a child process - of the the identified processes. Filter as needed. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://attack.mitre.org/techniques/T1021/006/ -- https://attack.mitre.org/techniques/T1047/ -- https://attack.mitre.org/techniques/T1053/005/ -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Hermetic Wiper - - Active Directory Lateral Movement - - Malicious PowerShell - asset_type: Endpoint - confidence: 50 - impact: 90 - message: A PowerShell process was spawned as a child process of typically abused - processes on $dest$ - mitre_attack_id: - - T1021 - - T1021.003 - - T1021.006 - - T1047 - - T1053.005 - - T1543.003 - - T1059.001 - - T1218.014 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/dev/endpoint/powershell___connect_to_internet_with_hidden_window.yml deleted file mode 100644 index eeaf6c9ecd..0000000000 --- a/dev/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: PowerShell - Connect To Internet With Hidden Window -id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 8 -date: '2022-01-12' -author: David Dorsey, Michael Haag Splunk -status: production -type: Hunting -description: The following hunting analytic identifies PowerShell commands utilizing - the WindowStyle parameter to hide the window on the compromised endpoint. This combination - of command-line options is suspicious because it is overriding the default PowerShell - execution policy, attempts to hide its activity from the user, and connects to the - Internet. Removed in this version of the query is New-Object. The analytic identifies - all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. - For example w, win, windowsty and so forth. In addition, through our research it - was identified that PowerShell will interpret different command switch types beyond - the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - condition: (selection1 or selection2 or selection3 or selection4) -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Legitimate process can have this combination of command-line - options, but it's not common. -references: -- https://regexr.com/663rr -- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 -- https://ss64.com/ps/powershell.html -- https://twitter.com/M_haggis/status/1440758396534214658?s=20 -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - HAFNIUM Group - - Log4Shell CVE-2021-44228 - - AgentTesla - asset_type: Endpoint - confidence: 90 - cve: - - CVE-2021-44228 - impact: 90 - message: PowerShell processes $process$ started with parameters to modify the execution - policy of the run, run in a hidden window, and connect to the Internet on host - $dest$ executed by user $user$. - mitre_attack_id: - - T1059.001 - - T1059 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell_disable_security_monitoring.yml b/dev/endpoint/powershell_disable_security_monitoring.yml deleted file mode 100644 index de32698a2d..0000000000 --- a/dev/endpoint/powershell_disable_security_monitoring.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Powershell Disable Security Monitoring -id: c148a894-dd93-11eb-bf2a-acde48001122 -version: 3 -date: '2022-07-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search is to identifies a modification in registry to disable the - windows denfender real time behavior monitoring. This event or technique is commonly - seen in RAT, bot, or Trojan to disable AV to evade detections. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*set-mppreference*' - selection6: - CommandLine: - - '*disablerealtimemonitoring*' - - '*disableioavprotection*' - - '*disableintrusionpreventionsystem*' - - '*disablescriptscanning*' - - '*disableblockatfirstseen*' - - '*DisableBehaviorMonitoring*' - - '*drtm *' - - '*dioavp *' - - '*dscrptsc *' - - '*dbaf *' - - '*dbm *' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives. However, tune based on scripts that - may perform this action. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell -- https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps -tags: - analytic_story: - - Ransomware - - Revil Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: '' - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: ComputerName - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell_get_localgroup_discovery.yml b/dev/endpoint/powershell_get_localgroup_discovery.yml deleted file mode 100644 index 7dadfe2572..0000000000 --- a/dev/endpoint/powershell_get_localgroup_discovery.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: PowerShell Get LocalGroup Discovery -id: b71adfcc-155b-11ec-9413-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic identifies the use of `get-localgroup` - being used with PowerShell to identify local groups on the endpoint. During triage, - review parallel processes and identify any further suspicious behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*get-localgroup*' - Image|endswith: - - cmd.exe - - powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present. Tune as needed. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/powershell_start_bitstransfer.yml b/dev/endpoint/powershell_start_bitstransfer.yml deleted file mode 100644 index 489a25b523..0000000000 --- a/dev/endpoint/powershell_start_bitstransfer.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: PowerShell Start-BitsTransfer -id: 39e2605a-90d8-11eb-899e-acde48001122 -version: 2 -date: '2021-03-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar - functionality is present. This technique variation is not as commonly used by adversaries, - but has been abused in the past. Lesser known uses include the ability to set the - `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` - is used, it is highly possible files will be archived. During triage, review parallel - processes and process lineage. Capture any files on disk and review. For the remote - domain or IP, what is the reputation? -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*start-bitstransfer*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives. It is possible administrators will - utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent - process or command-line arguments. -references: -- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 -- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs -tags: - analytic_story: - - BITS Jobs - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A suspicious process $process_name$ with commandline $process$ that are - related to bittransfer functionality in host $dest$ - mitre_attack_id: - - T1197 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/dev/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml deleted file mode 100644 index cca022a366..0000000000 --- a/dev/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Prevent Automatic Repair Mode using Bcdedit -id: 7742aa92-c9d9-11eb-bbfc-acde48001122 -version: 1 -date: '2021-06-10' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious bcdedit.exe execution to ignore - all failures. This technique was used by ransomware to prevent the compromise machine - automatically boot in repair mode. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*bootstatuspolicy*' - Image|endswith: bcdedit.exe - selection2: - CommandLine: '*ignoreallfailures*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. -known_false_positives: Administrators may modify the boot configuration ignore failure - during testing and debugging. -references: -- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A suspicious process $process_name$ with process id $process_id$ contains - commandline $process$ to ignore all bcdedit execution failure in host $dest$ - mitre_attack_id: - - T1490 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/print_processor_registry_autostart.yml b/dev/endpoint/print_processor_registry_autostart.yml deleted file mode 100644 index 0d853c0f0a..0000000000 --- a/dev/endpoint/print_processor_registry_autostart.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Print Processor Registry Autostart -id: 1f5b68aa-2037-11ec-898e-acde48001122 -version: 1 -date: '2021-09-28' -author: Teoderick Contreras, Splunk -status: experimental -type: TTP -description: This analytic is to detect a suspicious modification or new registry - entry regarding print processor. This registry is known to be abuse by turla or - other APT to gain persistence and privilege escalation to the compromised machine. - This is done by adding the malicious dll payload on the new created key in this - registry that will be executed as it restarted the spoolsv.exe process and services. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Control\\Print\\Environments\\Windows x64\\Print Processors*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: possible new printer installation may add driver component - on this registry. -references: -- https://attack.mitre.org/techniques/T1547/012/ -- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1547.012 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log - source: WinEventLog:Microsoft-Windows-PrintService/Operational - sourcetype: WinEventLog diff --git a/dev/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/dev/endpoint/process_creating_lnk_file_in_suspicious_location.yml deleted file mode 100644 index d66e60739f..0000000000 --- a/dev/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Process Creating LNK file in Suspicious Location -id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 -version: 6 -date: '2024-05-16' -author: Jose Hernandez, Michael Haag, Splunk -status: production -type: TTP -description: This search looks for a process launching an `*.lnk` file under `C:\User*` - or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*\\Temp\\*' - - C:\\Users\\* - Filesystem.file_name: '*.lnk' - condition: (selection1) -how_to_implement: You must be ingesting data that records filesystem and process activity - from your hosts to populate the Endpoint data model. This is typically populated - via endpoint detection-and-response product, such as Carbon Black, or endpoint data - sources, such as Sysmon. -known_false_positives: This detection should yield little or no false positive results. - It is uncommon for LNK files to be executed from temporary or user directories. -references: -- https://attack.mitre.org/techniques/T1566/001/ -- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html -- https://twitter.com/pr0xylife/status/1590394227758104576 -tags: - analytic_story: - - Spearphishing Attachments - - Qakbot - - IcedID - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A process $process_name$ that launching .lnk file in $file_path$ in host - $dest$ - mitre_attack_id: - - T1566 - - T1566.002 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/process_execution_via_wmi.yml b/dev/endpoint/process_execution_via_wmi.yml deleted file mode 100644 index e78d98f016..0000000000 --- a/dev/endpoint/process_execution_via_wmi.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Process Execution via WMI -id: 24869767-8579-485d-9a4f-d9ddfd8f0cac -version: 4 -date: '2020-03-16' -author: Rico Valdez, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies `WmiPrvSE.exe` spawning a process. - This typically occurs when a process is instantiated from a local or remote process - using `wmic.exe`. During triage, review parallel processes for suspicious behavior - or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. - Contain and remediate the endpoint as necessary. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: WmiPrvSE.exe - condition: selection1 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Although unlikely, administrators may use wmi to execute commands - for legitimate purposes. -references: [] -tags: - analytic_story: - - Suspicious WMI Use - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A remote instance execution of wmic.exe that will spawn $parent_process_name$ - in host $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/processes_launching_netsh.yml b/dev/endpoint/processes_launching_netsh.yml deleted file mode 100644 index 5764442644..0000000000 --- a/dev/endpoint/processes_launching_netsh.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Processes launching netsh -id: b89919ed-fe5f-492c-b139-95dbb162040e -version: 4 -date: '2021-09-16' -author: Michael Haag, Josef Kuepker, Splunk -status: production -type: Anomaly -description: This search looks for processes launching netsh.exe. Netsh is a command-line - scripting utility that allows you to, either locally or remotely, display or modify - the network configuration of a computer that is currently running. Netsh can be - used as a persistence proxy technique to execute a helper DLL when netsh.exe is - executed. In this search, we are looking for processes spawned by netsh.exe and - executing commands via the command line. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Some VPN applications are known to launch netsh.exe. Outside - of these instances, it is unusual for an executable to launch netsh.exe and run - commands. -references: [] -tags: - analytic_story: - - Netsh Abuse - - Disabling Security Tools - - DHS Report TA18-074A - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 20 - message: A process $process_name$ has launched netsh with command-line $process$ - on $dest$. - mitre_attack_id: - - T1562.004 - - T1562 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 14 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/dev/endpoint/recursive_delete_of_directory_in_batch_cmd.yml deleted file mode 100644 index c77bed5fda..0000000000 --- a/dev/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Recursive Delete of Directory In Batch CMD -id: ba570b3a-d356-11eb-8358-acde48001122 -version: 3 -date: '2022-11-12' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious commandline designed to delete - files or directory recursive using batch command. This technique was seen in ransomware - (reddot) where it it tries to delete the files in recycle bin to impaire user from - recovering deleted files. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Cmd.Exe - selection2: - Image|endswith: cmd.exe - selection3: - CommandLine: '*/c*' - selection4: - CommandLine: '* rd *' - selection5: - CommandLine: '*/s*' - selection6: - CommandLine: '*/q*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: network operator may use this batch command to delete recursively - a directory or files within directory -references: -- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Recursive Delete of Directory In Batch CMD - mitre_attack_id: - - T1070.004 - - T1070 - observable: - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/dev/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml deleted file mode 100644 index 2803370cf9..0000000000 --- a/dev/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Reg exe Manipulating Windows Services Registry Keys -id: 8470d755-0c13-45b3-bd63-387a373c10cf -version: 5 -date: '2020-11-26' -author: Rico Valdez, Splunk -status: production -type: TTP -description: The search looks for reg.exe modifying registry keys that define Windows - services and their configurations. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*reg*' - Image|endswith: reg.exe - selection2: - CommandLine: '*add*' - selection3: - CommandLine: '*Services*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: It is unusual for a service to be created or modified by directly - manipulating the registry. However, there may be legitimate instances of this behavior. - It is important to validate and investigate, as appropriate. -references: [] -tags: - analytic_story: - - Windows Service Abuse - - Windows Persistence Techniques - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 75 - message: A reg.exe process $process_name$ with commandline $process$ in host $dest$ - mitre_attack_id: - - T1574.011 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/registry_keys_for_creating_shim_databases.yml b/dev/endpoint/registry_keys_for_creating_shim_databases.yml deleted file mode 100644 index b8d5c6e0b9..0000000000 --- a/dev/endpoint/registry_keys_for_creating_shim_databases.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Registry Keys for Creating SHIM Databases -id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 4 -date: '2020-01-28' -author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search looks for registry activity associated with application compatibility - shims, which can be leveraged by attackers for various nefarious purposes. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*CurrentVersion\\AppCompatFlags\\Custom*' - - '*CurrentVersion\\AppCompatFlags\\InstalledSDB*' - condition: selection1 -how_to_implement: To successfully implement this search, you must populate the Change_Analysis - data model. This is typically populated via endpoint detection and response product, - such as Carbon Black or other endpoint data sources such as Sysmon. The data used - for this search is typically generated via logs that report reads and writes to - the registry. -known_false_positives: There are many legitimate applications that leverage shim databases - for compatibility purposes for legacy applications -references: [] -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A registry activity in $registry_path$ related to shim modication in host - $dest$ - mitre_attack_id: - - T1546.011 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/registry_keys_used_for_persistence.yml b/dev/endpoint/registry_keys_used_for_persistence.yml deleted file mode 100644 index bcea209e1f..0000000000 --- a/dev/endpoint/registry_keys_used_for_persistence.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: Registry Keys Used For Persistence -id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 9 -date: '2022-09-19' -author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk -status: production -type: TTP -description: The search looks for modifications to registry keys that can be used - to launch an application or service at system startup. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_key_name: Debugger - TargetObject: - - '*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*' - - '*\\Classes\\htmlfile\\shell\\open\\command' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler' - - '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common - Startup' - - HKLM\\SOFTWARE\\Microsoft\\Netsh\\* - - '*\\currentversion\\runservices*' - - '*\\currentversion\\policies\\explorer\\run*' - - '*\\CurrentVersion\\Winlogon\\VmApplet*' - - '*\\CurrentVersion\\Winlogon\\Userinit*' - - '*\\CurrentVersion\\Winlogon\\Notify*' - - '*\\CurrentVersion\\Winlogon\\Shell*' - - '*\\currentVersion\\Windows\\Appinit_Dlls*' - - '*\\currentversion\\run*' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce' - selection2: - Registry.registry_key_name: Security Packages - TargetObject: '*\\CurrentControlSet\\Control\\Lsa' - selection3: - Registry.registry_key_name: Security Packages - TargetObject: '*\\CurrentControlSet\\Control\\Lsa\\OSConfig' - selection4: - TargetObject: '*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*' - selection5: - Registry.registry_key_name: Load - TargetObject: '*currentVersion\\Windows' - selection6: - Registry.registry_key_name: Svchost - TargetObject: '*\\CurrentVersion' - selection7: - Registry.registry_key_name: BootExecute - TargetObject: '*\\CurrentControlSet\Control\Session Manager' - selection8: - Registry.registry_key_name: auto_update - TargetObject: '*\\Software\\Run' - condition: (selection1 or selection2 or selection3 or selection4 or selection5 or - selection6 or selection7 or selection8) -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: There are many legitimate applications that must execute on - system startup and will use these registry keys to accomplish that task. -references: [] -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Suspicious MSHTA Activity - - DHS Report TA18-074A - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Ransomware - - Windows Persistence Techniques - - 'Emotet Malware DHS Report TA18-201A ' - - IcedID - - Remcos - - Windows Registry Abuse - - Azorult - - Qakbot - asset_type: Endpoint - confidence: 95 - impact: 80 - message: A registry activity in $registry_path$ related to persistence in host $dest$ - mitre_attack_id: - - T1547.001 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 76 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/registry_keys_used_for_privilege_escalation.yml b/dev/endpoint/registry_keys_used_for_privilege_escalation.yml deleted file mode 100644 index b499c1f1ee..0000000000 --- a/dev/endpoint/registry_keys_used_for_privilege_escalation.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Registry Keys Used For Privilege Escalation -id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -version: 5 -date: '2022-01-26' -author: David Dorsey, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search looks for modifications to registry keys that can be used - to elevate privileges. The registry keys under "Image File Execution Options" are - used to intercept calls to an executable and can be used to attach malicious binaries - to benign system binaries. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - Debugger - - GlobalFlag - TargetObject: '*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*' - condition: (selection1) -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: There are many legitimate applications that must execute upon - system startup and will use these registry keys to accomplish that task. -references: -- https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ -tags: - analytic_story: - - Windows Privilege Escalation - - Suspicious Windows Registry Activities - - Cloud Federated Credential Abuse - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 95 - impact: 80 - message: A registry activity in $registry_path$ related to privilege escalation - in host $dest$ - mitre_attack_id: - - T1546.012 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 76 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remcos_client_registry_install_entry.yml b/dev/endpoint/remcos_client_registry_install_entry.yml deleted file mode 100644 index 22d63c4fa3..0000000000 --- a/dev/endpoint/remcos_client_registry_install_entry.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Remcos client registry install entry -id: f2a1615a-1d63-11ec-97d2-acde48001122 -version: 2 -date: '2022-01-26' -author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk -status: production -type: TTP -description: This search detects registry key license at host where Remcos RAT agent - is installed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_key_name: '*\\Software\\Remcos*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://attack.mitre.org/software/S0332/ -tags: - analytic_story: - - Remcos - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 90 - message: A registry entry $registry_path$ with registry keyname $registry_key_name$ - related to Remcos RAT in host $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/dev/endpoint/remcos_rat_file_creation_in_remcos_folder.yml deleted file mode 100644 index 1dd3263304..0000000000 --- a/dev/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Remcos RAT File Creation in Remcos Folder -id: 25ae862a-1ac3-11ec-94a1-acde48001122 -version: 2 -date: '2021-09-21' -author: Teoderick Contreras, Splunk, Sanjay Govind -status: production -type: TTP -description: This search is to detect file creation in remcos folder in appdata which - is the keylog and clipboard logs that will be send to its c2 server. This is really - a good TTP indicator that there is a remcos rat in the system that do keylogging, - clipboard grabbing and audio recording. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*\\remcos\\*' - Filesystem.file_name: '*.dat' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US -- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 100 - impact: 100 - message: file $file_name$ created in $file_path$ of $dest$ - mitre_attack_id: - - T1113 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_desktop_process_running_on_system.yml b/dev/endpoint/remote_desktop_process_running_on_system.yml deleted file mode 100644 index 72da8f4959..0000000000 --- a/dev/endpoint/remote_desktop_process_running_on_system.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Remote Desktop Process Running On System -id: f5939373-8054-40ad-8c64-cec478a22a4a -version: 5 -date: '2020-07-21' -author: David Dorsey, Splunk -status: experimental -type: Hunting -description: This search looks for the remote desktop process mstsc.exe running on - systems upon which it doesn't typically run. This is accomplished by filtering out - all systems that are noted in the `common_rdp_source category` in the Assets and - Identity framework. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.dest_category: common_rdp_source - CommandLine: '*mstsc.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records process activity from your hosts to populate the endpoint data model - in the processes node. The search requires you to identify systems that do not commonly - use remote desktop. You can use the included support search "Identify Systems Using - Remote Desktop" to identify these systems. After identifying them, you will need - to add the "common_rdp_source" category to that system using the Enterprise Security - Assets and Identities framework. This can be done by adding an entry in the assets.csv - file located in `SA-IdentityManagement/lookups`. -known_false_positives: Remote Desktop may be used legitimately by users on the network. -references: [] -tags: - analytic_story: - - Hidden Cobra Malware - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/dev/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml deleted file mode 100644 index e8606c64e0..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Remote Process Instantiation via DCOM and PowerShell -id: d4f42098-4680-11ec-ad07-3e22fbd008af -version: 1 -date: '2021-11-15' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with arguments - utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, - this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams - and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and - remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: - - '*Document.ActiveView.ExecuteShellCommand*' - - '*Document.Application.ShellExecute*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage DCOM to start a process on remote - systems, but this activity is usually limited to a small set of hosts or users. -references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 70 - impact: 90 - message: A process was started on a remote endpoint from $dest by abusing DCOM using - PowerShell.exe - mitre_attack_id: - - T1021 - - T1021.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/dev/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml deleted file mode 100644 index 51123c33b2..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Remote Process Instantiation via WinRM and PowerShell -id: ba24cda8-4716-11ec-8009-3e22fbd008af -version: 1 -date: '2021-11-16' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` with arguments - utilized to start a process on a remote endpoint by abusing the WinRM protocol. - Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. - Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral - movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*-ComputerName*' - selection6: - CommandLine: '*Invoke-Command*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start - a process on remote systems for system administration or automation use cases. However, - this activity is usually limited to a small set of hosts or users. -references: -- https://attack.mitre.org/techniques/T1021/006/ -- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 50 - impact: 90 - message: A process was started on a remote endpoint from $dest by abusing WinRM - using PowerShell.exe - mitre_attack_id: - - T1021 - - T1021.006 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/dev/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml deleted file mode 100644 index 97d65ebfb9..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Remote Process Instantiation via WinRM and Winrs -id: 0dd296a2-4338-11ec-ba02-3e22fbd008af -version: 1 -date: '2021-11-11' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `winrs.exe` with command-line - arguments utilized to start a process on a remote endpoint. Red Teams and adversaries - alike may abuse the WinRM protocol and this binary for lateral movement and remote - code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: winrs.exe - selection2: - Image|endswith: winrs.exe - selection3: - CommandLine: - - '*-r:*' - - '*-remote:*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage WinRM and WinRs to start a process - on remote systems, but this activity is usually limited to a small set of hosts - or users. -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs -- https://attack.mitre.org/techniques/T1021/006/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A process was started on a remote endpoint from $dest - mitre_attack_id: - - T1021 - - T1021.006 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_wmi.yml b/dev/endpoint/remote_process_instantiation_via_wmi.yml deleted file mode 100644 index f7bf5129ad..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_wmi.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Remote Process Instantiation via WMI -id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: 7 -date: '2021-11-12' -author: Rico Valdez, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic identifies wmic.exe being launched with parameters to spawn - a process on a remote system. Red Teams and adversaries alike may abuse WMI and - this binary for lateral movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*process*' - selection4: - CommandLine: '*/node:*' - selection5: - CommandLine: '*call*' - selection6: - CommandLine: '*create*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: The wmic.exe utility is a benign Windows application. It may - be used legitimately by Administrators with these parameters for remote system administration, - but it's relatively uncommon. -references: -- https://attack.mitre.org/techniques/T1047/ -- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process -tags: - analytic_story: - - Ransomware - - Suspicious WMI Use - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A wmic.exe process $process$ contain process spawn commandline $process$ - in host $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/dev/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml deleted file mode 100644 index ede8883eb5..0000000000 --- a/dev/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Remote Process Instantiation via WMI and PowerShell -id: 112638b4-4634-11ec-b9ab-3e22fbd008af -version: 1 -date: '2021-11-15' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `powershell.exe` leveraging - the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start - a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may - abuse WMI and `powershell.exe` for lateral movement and remote code execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: pwsh.dll - selection2: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection3: - OriginalFileName: PowerShell.EXE - selection4: - OriginalFileName: powershell_ise.EXE - selection5: - CommandLine: '*-CN*' - selection6: - CommandLine: '*Invoke-WmiMethod*' - selection7: - CommandLine: '*-Class Win32_Process*' - selection8: - CommandLine: '*-Name create*' - condition: (selection1 or selection2 or selection3 or selection4) and selection5 - and selection6 and selection7 and selection8 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may leverage WWMI and powershell.exe to start - a process on remote systems, but this activity is usually limited to a small set - of hosts or users. -references: -- https://attack.mitre.org/techniques/T1047/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 70 - impact: 90 - message: A process was started on a remote endpoint from $dest by abusing WMI using - PowerShell.exe - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_system_discovery_with_dsquery.yml b/dev/endpoint/remote_system_discovery_with_dsquery.yml deleted file mode 100644 index cd3b858235..0000000000 --- a/dev/endpoint/remote_system_discovery_with_dsquery.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Remote System Discovery with Dsquery -id: 9fb562f4-42f8-4139-8e11-a82edf7ed718 -version: 1 -date: '2021-08-31' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `dsquery.exe` with command-line - arguments utilized to discover remote systems. The `computer` argument returns a - list of all computers registered in the domain. Red Teams and adversaries alike - engage in remote system discovery for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*computer*' - Image|endswith: dsquery.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11) -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_system_discovery_with_net.yml b/dev/endpoint/remote_system_discovery_with_net.yml deleted file mode 100644 index 083e4eef41..0000000000 --- a/dev/endpoint/remote_system_discovery_with_net.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Remote System Discovery with Net -id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 -version: 1 -date: '2021-08-30' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `net.exe` or `net1.exe` with - command-line arguments utilized to discover remote systems. The argument `domain - computers /domain` returns a list of all domain computers. Red Teams and adversaries - alike use net.exe to identify remote systems for situational awareness and Active - Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - net.exe - - net1.exe - selection2: - CommandLine: '*/do*' - selection3: - CommandLine: '*domain computers*' - selection4: - CommandLine: '*/do*' - selection5: - CommandLine: '*view*' - condition: (selection1) and selection2 and selection3 or selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_system_discovery_with_wmic.yml b/dev/endpoint/remote_system_discovery_with_wmic.yml deleted file mode 100644 index 1eb1c2aeb0..0000000000 --- a/dev/endpoint/remote_system_discovery_with_wmic.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Remote System Discovery with Wmic -id: d82eced3-b1dc-42ab-859e-a2fc98827359 -version: 1 -date: '2021-09-01' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to discover remote systems. The arguments utilized in this command - return a list of all the systems registered in the domain. Red Teams and adversaries - alike may leverage WMI and wmic.exe to identify remote systems for situational awareness - and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: wmic.exe - selection2: - CommandLine: '*ds_computer*' - selection3: - CommandLine: '*/NAMESPACE:\\\\root\\directory\\ldap*' - selection4: - CommandLine: '*GET ds_samaccountname*' - condition: (selection1) and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ - mitre_attack_id: - - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/remote_wmi_command_attempt.yml b/dev/endpoint/remote_wmi_command_attempt.yml deleted file mode 100644 index 7695ba4502..0000000000 --- a/dev/endpoint/remote_wmi_command_attempt.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Remote WMI Command Attempt -id: 272df6de-61f1-4784-877c-1fbc3e2d0838 -version: 4 -date: '2018-12-03' -author: Rico Valdez, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies usage of `wmic.exe` spawning a local - or remote process, identified by the `node` switch. During triage, review parallel - processes for additional commands executed. Look for any file modifications before - and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm - execution or file modifications. Contain and isolate the endpoint as needed. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*node*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. Deprecated because duplicate of Remote Process Instantiation via - WMI. -known_false_positives: Administrators may use this legitimately to gather info from - remote systems. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml -tags: - analytic_story: - - Suspicious WMI Use - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A wmic.exe process $process$ contain node commandline $process$ in host - $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/revil_common_exec_parameter.yml b/dev/endpoint/revil_common_exec_parameter.yml deleted file mode 100644 index de89d010fe..0000000000 --- a/dev/endpoint/revil_common_exec_parameter.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Revil Common Exec Parameter -id: 85facebe-c382-11eb-9c3e-acde48001122 -version: 2 -date: '2021-06-02' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies suspicious commandline parameter that are commonly - used by REVIL ransomware to encrypts the compromise machine. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '* -nolan *' - - '* -nolocal *' - - '* -fast *' - - '* -full *' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: third party tool may have same command line parameters as revil - ransomware. -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ -tags: - analytic_story: - - Ransomware - - Revil Ransomware - asset_type: Endpoint - confidence: 90 - impact: 60 - message: A process $process_name$ with commandline $process$ related to revil ransomware - in host $dest$ - mitre_attack_id: - - T1204 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/revil_registry_entry.yml b/dev/endpoint/revil_registry_entry.yml deleted file mode 100644 index 0c51d178a6..0000000000 --- a/dev/endpoint/revil_registry_entry.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Revil Registry Entry -id: e3d3f57a-c381-11eb-9e35-acde48001122 -version: 2 -date: '2021-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies suspicious modification in registry entry to - keep some malware data during its infection. This technique seen in several apt - implant, malware and ransomware like REVIL where it keep some information like the - random generated file extension it uses for all the encrypted files and ransomware - notes file name in the compromised host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*' - - '*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*' - condition: (selection1) -how_to_implement: to successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: unknown -references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ -tags: - analytic_story: - - Ransomware - - Revil Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 60 - message: A registry entry $registry_path$ with registry value $registry_value_name$ - and $registry_value_name$ related to revil ransomware in host $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 60 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/rubeus_command_line_parameters.yml b/dev/endpoint/rubeus_command_line_parameters.yml deleted file mode 100644 index faed94b2b9..0000000000 --- a/dev/endpoint/rubeus_command_line_parameters.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Rubeus Command Line Parameters -id: cca37478-8377-11ec-b59a-acde48001122 -version: 1 -date: '2022-02-01' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is - heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin - project. This analytic looks for the use of Rubeus command line arguments utilized - in common Kerberos attacks like exporting and importing tickets, forging silver - and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. - Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory - networks. Defenders should be aware that adversaries may customize the source code - of Rubeus and modify the command line parameters. This would effectively bypass - this analytic. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*ptt /ticket*' - - '* monitor /interval*' - - '* asktgt* /user:*' - - '* asktgs* /service:*' - - '* golden* /user:*' - - '* silver* /service:*' - - '* kerberoast*' - - '* asreproast*' - - '* renew* /ticket:*' - - '* brute* /password:*' - - '* brute* /passwords:*' - - '* harvest*' - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, legitimate applications may use the same - command line parameters as Rubeus. Filter as needed. -references: -- https://github.com/GhostPack/Rubeus -- https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ -- https://attack.mitre.org/techniques/T1550/003/ -- https://en.hackndo.com/kerberos-silver-golden-tickets/ -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 60 - impact: 60 - message: Rubeus command line parameters were used on $dest$ - mitre_attack_id: - - T1550 - - T1550.003 - - T1558 - - T1558.003 - - T1558.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/runas_execution_in_commandline.yml b/dev/endpoint/runas_execution_in_commandline.yml deleted file mode 100644 index 88d5c30770..0000000000 --- a/dev/endpoint/runas_execution_in_commandline.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Runas Execution in CommandLine -id: 4807e716-43a4-11ec-a0e7-acde48001122 -version: 1 -date: '2021-11-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic look for a spawned runas.exe process with a administrator - user option parameter. This parameter was abused by adversaries, malware author - or even red teams to gain elevated privileges in target host. This is a good hunting - query to figure out privilege escalation tactics that may used for different stages - like lateral movement but take note that administrator may use this command in purpose - so its better to see other event context before and after this analytic. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: runas.exe - selection2: - Image|endswith: runas.exe - selection3: - CommandLine: '*/user:*' - selection4: - CommandLine: '*admin*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: A network operator or systems administrator may utilize an - automated or manual execute this command that may generate false positives. filter - is needed. -references: -- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/ -tags: - analytic_story: - - Windows Privilege Escalation - - Hermetic Wiper - asset_type: Endpoint - confidence: 50 - impact: 50 - message: elevated process using runas on $dest$ by $user$ - mitre_attack_id: - - T1134 - - T1134.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/rundll32_lockworkstation.yml b/dev/endpoint/rundll32_lockworkstation.yml deleted file mode 100644 index b7f5eae597..0000000000 --- a/dev/endpoint/rundll32_lockworkstation.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Rundll32 LockWorkStation -id: fa90f372-f91d-11eb-816c-acde48001122 -version: 2 -date: '2021-08-09' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This search is to detect a suspicious rundll32 commandline to lock the - workstation through command line. This technique was seen in CONTI leak tooling - and script as part of its defense evasion. This technique is not a common practice - to lock a screen and maybe a good indicator of compromise. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*user32.dll,LockWorkStation*' - Image|endswith: rundll32.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: unknown -references: -- https://threadreaderapp.com/thread/1423361119926816776.html -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: process $process_name$ with cmdline $process$ in host $dest$ - mitre_attack_id: - - T1218 - - T1218.011 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: SourceImage - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/ryuk_wake_on_lan_command.yml b/dev/endpoint/ryuk_wake_on_lan_command.yml deleted file mode 100644 index 94d4a7d117..0000000000 --- a/dev/endpoint/ryuk_wake_on_lan_command.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Ryuk Wake on LAN Command -id: 538d0152-7aaa-11eb-beaa-acde48001122 -version: 1 -date: '2021-03-01' -author: Michael Haag, Splunk -status: production -type: TTP -description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk - ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered - off devices on a compromised network to have greater success encrypting them. This - is a high fidelity indicator of Ryuk ransomware executing on an endpoint. Upon triage, - isolate the endpoint. Additional file modification events will be within the users - profile (\appdata\roaming) and in public directories (users\public\). Review all - Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled - Tasks will include a path to a unknown binary and those endpoints should be isolated - until triaged. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*8 LAN*' - - '*9 REP*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited to no known false positives. -references: -- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ -- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/ -- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf -tags: - analytic_story: - - Ryuk Ransomware - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A process $process_name$ with wake on LAN commandline $process$ in host - $dest$ - mitre_attack_id: - - T1059 - - T1059.003 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/samsam_test_file_write.yml b/dev/endpoint/samsam_test_file_write.yml deleted file mode 100644 index 99739e8e8e..0000000000 --- a/dev/endpoint/samsam_test_file_write.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Samsam Test File Write -id: 493a879d-519d-428f-8f57-a06a0fdc107e -version: 1 -date: '2018-12-14' -author: Rico Valdez, Splunk -status: production -type: TTP -description: The search looks for a file named "test.txt" written to the windows system - directory tree, which is consistent with Samsam propagation. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*\\windows\\system32\\test.txt' - condition: selection1 -how_to_implement: You must be ingesting data that records the file-system activity - from your hosts to populate the Endpoint file-system data-model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: No false positives have been identified. -references: [] -tags: - analytic_story: - - SamSam Ransomware - asset_type: Endpoint - confidence: 20 - impact: 60 - message: A samsam ransomware test file creation in $file_path$ in host $dest$ - mitre_attack_id: - - T1486 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 12 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/dev/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml deleted file mode 100644 index b1d5570034..0000000000 --- a/dev/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Scheduled Task Creation on Remote Endpoint using At -id: 4be54858-432f-11ec-8209-3e22fbd008af -version: 1 -date: '2021-11-11' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `at.exe` with command-line arguments - utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries - alike may abuse the Task Scheduler for lateral movement and remote code execution. - The `at.exe` binary internally leverages the AT protocol which was deprecated starting - with Windows 8 and Windows Server 2012 but may still work on previous versions of - Windows. Furthermore, attackers may enable this protocol on demand by changing a - sytem registry key. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: at.exe - selection2: - Image|endswith: at.exe - selection3: - CommandLine: '*\\\\*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may create scheduled tasks on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at -- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Scheduled Task was created on a remote endpoint from $dest - mitre_attack_id: - - T1053 - - T1053.002 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/dev/endpoint/scheduled_task_deleted_or_created_via_cmd.yml deleted file mode 100644 index dd63a3e5a6..0000000000 --- a/dev/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Scheduled Task Deleted Or Created via CMD -id: d5af132c-7c17-439c-9d31-13d55340f36c -version: 6 -date: '2022-02-22' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: The following analytic identifies the creation or deletion of a scheduled - task using schtasks.exe with flags - create or delete being passed on the command-line. - This has been associated with the Dragonfly threat actor, and the SUNBURST attack - against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware". -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*create*' - - '*delete*' - Image|endswith: schtasks.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible scripts or administrators may trigger this analytic. - Filter as needed based on parent process, application. -references: -- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ -- https://www.joesandbox.com/analysis/691823/0/html -tags: - analytic_story: - - DHS Report TA18-074A - - NOBELIUM Group - - Windows Persistence Techniques - - Living Off The Land - - Azorult - - DarkCrystal RAT - - CISA AA22-257A - - AgentTesla - - Qakbot - - Trickbot - - Prestige Ransomware - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A schedule task process $process_name$ with create or delete commandline - $process$ in host $dest$ - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/dev/endpoint/scheduled_task_initiation_on_remote_endpoint.yml deleted file mode 100644 index 22f55349d5..0000000000 --- a/dev/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Scheduled Task Initiation on Remote Endpoint -id: 95cf4608-4302-11ec-8194-3e22fbd008af -version: 1 -date: '2021-11-11' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `schtasks.exe` with command-line - arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and - adversaries alike may abuse the Task Scheduler for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: schtasks.exe - selection2: - Image|endswith: schtasks.exe - selection3: - CommandLine: '*/run*' - selection4: - CommandLine: '*/s*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may start scheduled tasks on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks -- https://attack.mitre.org/techniques/T1053/005/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Scheduled Task was ran on a remote endpoint from $dest - mitre_attack_id: - - T1053 - - T1053.005 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/schtasks_scheduling_job_on_remote_system.yml b/dev/endpoint/schtasks_scheduling_job_on_remote_system.yml deleted file mode 100644 index e0cbe193a3..0000000000 --- a/dev/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Schtasks scheduling job on remote system -id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 -version: 6 -date: '2022-05-23' -author: David Dorsey, Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `schtasks.exe` with command-line - arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and - adversaries alike may abuse the Task Scheduler for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: schtasks.exe - selection2: - Image|endswith: schtasks.exe - selection3: - CommandLine: '*/s*' - selection4: - CommandLine: '*/create*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: Administrators may create scheduled tasks on remote systems, - but this activity is usually limited to a small set of hosts or users. It is important - to validate and investigate as appropriate. -references: [] -tags: - analytic_story: - - Active Directory Lateral Movement - - NOBELIUM Group - - Living Off The Land - - Prestige Ransomware - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A schedule task process $process_name$ with remote job command-line $process$ - in host $dest$ by $user$. - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/screensaver_event_trigger_execution.yml b/dev/endpoint/screensaver_event_trigger_execution.yml deleted file mode 100644 index e49861132d..0000000000 --- a/dev/endpoint/screensaver_event_trigger_execution.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Screensaver Event Trigger Execution -id: 58cea3ec-1f6d-11ec-8560-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is developed to detect possible event trigger execution - through screensaver registry entry modification for persistence or privilege escalation. - This technique was seen in several APT and malware where they put the malicious - payload path to the SCRNSAVE.EXE registry key to redirect the execution to their - malicious payload path. This TTP is a good indicator that some attacker may modify - this entry for their persistence and privilege escalation. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\Control Panel\\Desktop\\SCRNSAVE.EXE*' - condition: (selection1) -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1546/002/ -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 90 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1546 - - T1546.002 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/script_execution_via_wmi.yml b/dev/endpoint/script_execution_via_wmi.yml deleted file mode 100644 index e9d947ccc7..0000000000 --- a/dev/endpoint/script_execution_via_wmi.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Script Execution via WMI -id: aa73f80d-d728-4077-b226-81ea0c8be589 -version: 4 -date: '2020-03-16' -author: Rico Valdez, Michael Haag, Splunk -status: production -type: TTP -description: This search looks for scripts launched via WMI. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: scrcons.exe - condition: selection1 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. -known_false_positives: Although unlikely, administrators may use wmi to launch scripts - for legitimate purposes. Filter as needed. -references: -- https://redcanary.com/blog/child-processes/ -tags: - analytic_story: - - Suspicious WMI Use - asset_type: Endpoint - confidence: 60 - impact: 60 - message: A wmic.exe process $process_name$ taht execute script in host $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/sdclt_uac_bypass.yml b/dev/endpoint/sdclt_uac_bypass.yml deleted file mode 100644 index 041b072604..0000000000 --- a/dev/endpoint/sdclt_uac_bypass.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Sdclt UAC Bypass -id: d71efbf6-da63-11eb-8c6e-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious sdclt.exe registry modification. - This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe - application by modifying some registry that sdclt.exe tries to open or query with - payload file path on it to be executed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - IsolatedCommand - - (Default) - TargetObject: - - '*\\exefile\\shell\\runas\\command\\*' - - '*\\Windows\\CurrentVersion\\App Paths\\control.exe*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited to no false positives are expected. -references: -- https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ -- https://github.com/hfiref0x/UACME -- https://www.cyborgsecurity.com/cyborg-labs/threat-hunt-deep-dives-user-account-control-bypass-via-registry-modification/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/dev/endpoint/searchprotocolhost_with_no_command_line_with_network.yml deleted file mode 100644 index e00d283ca3..0000000000 --- a/dev/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: SearchProtocolHost with no Command Line with Network -id: b690df8c-a145-11eb-a38b-acde48001122 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies searchprotocolhost.exe with no command - line arguments and with a network connection. It is unusual for searchprotocolhost.exe - to execute with no command line arguments present. This particular behavior is common - with malicious software, including Cobalt Strike. During investigation, identify - any network connections and parallel processes. Identify any suspicious module loads - related to credential dumping or file writes. searchprotocolhost.exe is natively - found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: searchprotocolhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 100 - impact: 70 - message: A searchprotocolhost.exe process $process_name$ with no commandline in - host $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/dev/endpoint/secretdumps_offline_ntds_dumping_tool.yml deleted file mode 100644 index 0a7b86b367..0000000000 --- a/dev/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: SecretDumps Offline NTDS Dumping Tool -id: 5672819c-be09-11eb-bbfb-acde48001122 -version: 1 -date: '2021-05-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic detects a potential usage of secretsdump.py tool for dumping - credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry - hive. This technique was seen in some attacker that dump ntlm hashes offline after - having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*.py*' - Image|endswith: python*.exe - selection2: - CommandLine: '*-ntds*' - selection3: - CommandLine: - - '*-bootkey*' - - '*-security*' - - '*-sam*' - - '*-system*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py -tags: - analytic_story: - - Credential Dumping - asset_type: Endpoint - confidence: 100 - impact: 80 - message: A secretdump process $process_name$ with secretdump commandline $process$ - to dump credentials in host $dest$ - mitre_attack_id: - - T1003.003 - - T1003 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/dev/endpoint/serviceprincipalnames_discovery_with_setspn.yml deleted file mode 100644 index dbe71c66ec..0000000000 --- a/dev/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ /dev/null @@ -1,108 +0,0 @@ -name: ServicePrincipalNames Discovery with SetSPN -id: ae8b3efc-2d2e-11ec-8b57-acde48001122 -version: 1 -date: '2021-10-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies `setspn.exe` usage related to querying - the domain for Service Principle Names. typically, this is a precursor activity - related to kerberoasting or the silver ticket attack. - - What is a ServicePrincipleName? - - A service principal name (SPN) is a unique identifier of a service instance. SPNs - are used by Kerberos authentication to associate a service instance with a service - logon account. This allows a client application to request that the service authenticate - an account even if the client does not have the account name. - - Example usage includes the following - - 1. setspn -T offense -Q */* 1. setspn -T attackrange.local -F -Q MSSQLSvc/* 1. setspn - -Q */* > allspns.txt 1. setspn -q - - Values - - 1. -F = perform queries at the forest, rather than domain level 1. -T = perform - query on the specified domain or forest (when -F is also used) 1. -Q = query for - existence of SPN - - During triage, review parallel processes for further suspicious activity.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: setspn.exe - selection2: - Image|endswith: setspn.exe - selection3: - CommandLine: '*-f*' - selection4: - CommandLine: '*-t*' - selection5: - CommandLine: '**/**' - selection6: - CommandLine: '*-q*' - selection7: - CommandLine: '*-q*' - selection8: - CommandLine: '*-s*' - condition: (selection1 or selection2) and selection3 and selection4 or selection5 - or selection6 or selection7 or selection8 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be caused by Administrators resetting SPNs - or querying for SPNs. Filter as needed. -references: -- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names -- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting -- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html -- https://attack.mitre.org/techniques/T1558/003/ -- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx -- https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ -- https://blog.zsec.uk/paving-2-da-wholeset/ -- https://msitpros.com/?p=3113 -- https://adsecurity.org/?p=3466 -tags: - analytic_story: - - Active Directory Discovery - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to identify service principle names. - mitre_attack_id: - - T1558.003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/services_escalate_exe.yml b/dev/endpoint/services_escalate_exe.yml deleted file mode 100644 index b56e2db7fe..0000000000 --- a/dev/endpoint/services_escalate_exe.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Services Escalate Exe -id: c448488c-b7ec-11eb-8253-acde48001122 -version: 1 -date: '2021-05-18' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of `svc-exe` with Cobalt Strike. - The behavior typically follows after an adversary has already gained initial access - and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded - from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following, - the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\` - with multiple keys and values added to look like a legitimate service. Upon loading, - `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`. - The process lineage is completed with `400619a.exe` spawning rundll32.exe, which - is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary - and may be any process on disk (typically system32/syswow64 binary). The `spawnto_` - process will also contain a network connection. During triage, review parallel procesess - and identify any additional file modifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*admin$*' - ParentImage: services.exe - condition: selection1 -how_to_implement: To successfully implement this search, you will need to ensure that - DNS data is populating the Network_Resolution data model. -known_false_positives: False positives should be limited as `services.exe` should - never spawn a process from `ADMIN$`. Filter as needed. -references: -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ -- https://attack.mitre.org/techniques/T1548/ -- https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1085 -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 95 - impact: 80 - message: A service process $parent_process_name$ with process path $process_path$ - in host $dest$ - mitre_attack_id: - - T1548 - observable: - - name: Processes.dest - type: Hostname - role: - - Victim - - name: Processes.user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 76 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/services_lolbas_execution_process_spawn.yml b/dev/endpoint/services_lolbas_execution_process_spawn.yml deleted file mode 100644 index ced0dbe4a4..0000000000 --- a/dev/endpoint/services_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,114 +0,0 @@ -name: Services LOLBAS Execution Process Spawn -id: ba9e1954-4c04-11ec-8b74-3e22fbd008af -version: 1 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `services.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing the Service Control - Manager and creating a remote malicious service, the executed command is spawned - as a child process of `services.exe`. The LOLBAS project documents Windows native - binaries that can be abused by threat actors to perform tasks like executing malicious - code. Looking for child processes of services.exe that are part of the LOLBAS project - can help defenders identify lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: services.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1543/003/ -- https://pentestlab.blog/2020/07/21/lateral-movement-services/ -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - - Qakbot - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Services.exe spawned a LOLBAS process on $dest - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/dev/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml deleted file mode 100644 index 3ff618a744..0000000000 --- a/dev/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Set Default PowerShell Execution Policy To Unrestricted or Bypass -id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 7 -date: '2022-02-18' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Monitor for changes of the ExecutionPolicy in the registry to the values - "unrestricted" or "bypass," which allows the execution of malicious scripts. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ExecutionPolicy - TargetObject: '*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*' - Details: - - Bypass - - Unrestricted - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Registry node. You must also be - ingesting logs with the fields registry_path, registry_key_name, and registry_value_name - from your endpoints. -known_false_positives: Administrators may attempt to change the default execution - policy on a system for a variety of reasons. However, setting the policy to "unrestricted" - or "bypass" as this search is designed to identify, would be unusual. Hits should - be reviewed and investigated as appropriate. -references: [] -tags: - analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - Credential Dumping - - HAFNIUM Group - asset_type: Endpoint - confidence: 80 - impact: 60 - message: A registry modification in $registry_path$ with reg key $registry_key_name$ - and reg value $registry_value_name$ in host $dest$ - mitre_attack_id: - - T1059 - - T1059.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: registry_path - type: Unknown - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/shim_database_file_creation.yml b/dev/endpoint/shim_database_file_creation.yml deleted file mode 100644 index 8923d0e503..0000000000 --- a/dev/endpoint/shim_database_file_creation.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Shim Database File Creation -id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 -version: 3 -date: '2020-12-08' -author: David Dorsey, Splunk -status: production -type: TTP -description: This search looks for shim database files being written to default directories. - The sdbinst.exe application is used to install shim database files (.sdb). According - to Microsoft, a shim is a small library that transparently intercepts an API, changes - the parameters passed, handles the operation itself, or redirects the operation - elsewhere. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*Windows\\AppPatch\\Custom*' - condition: selection1 -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: Because legitimate shim files are created and used all the - time, this event, in itself, is not suspicious. However, if there are other correlating - events, it may warrant further investigation. -references: [] -tags: - analytic_story: - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 80 - impact: 70 - message: A process that possibly write shim database in $file_path$ in host $dest$ - mitre_attack_id: - - T1546.011 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: file_path - type: File - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/silentcleanup_uac_bypass.yml b/dev/endpoint/silentcleanup_uac_bypass.yml deleted file mode 100644 index 5f773b75c6..0000000000 --- a/dev/endpoint/silentcleanup_uac_bypass.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: SilentCleanup UAC Bypass -id: 56d7cfcc-da63-11eb-92d4-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of registry that may - related to UAC bypassed. This registry will be trigger once the attacker abuse the - silentcleanup task schedule to gain high privilege execution that will bypass User - control account. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '*.exe*' - TargetObject: '*\\Environment\\windir' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://github.com/hfiref0x/UACME -- https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/slui_runas_elevated.yml b/dev/endpoint/slui_runas_elevated.yml deleted file mode 100644 index 81e12d3a75..0000000000 --- a/dev/endpoint/slui_runas_elevated.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: SLUI RunAs Elevated -id: 8d124810-b3e4-11eb-96c7-acde48001122 -version: 1 -date: '2021-05-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Microsoft Software Licensing User - Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This - particular bypass utilizes a registry key/value. Identified by two sources, the - registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. - To simulate this behavior, multiple POC are available. The analytic identifies the - use of `runas` by `slui.exe`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: slui.exe - selection2: - CommandLine: '*runas*' - selection3: - CommandLine: '*-verb*' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives should be present as this is not commonly - used by legitimate applications. -references: -- https://www.exploit-db.com/exploits/46998 -- https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b -- https://gist.github.com/r00t-3xp10it/0c92cd554d3156fd74f6c25660ccc466 -- https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -tags: - analytic_story: - - DarkSide Ransomware - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A slui process $process_name$ with elevated commandline $process$ in host - $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/slui_spawning_a_process.yml b/dev/endpoint/slui_spawning_a_process.yml deleted file mode 100644 index 4357e3ce29..0000000000 --- a/dev/endpoint/slui_spawning_a_process.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: SLUI Spawning a Process -id: 879c4330-b3e0-11eb-b1b1-acde48001122 -version: 1 -date: '2021-05-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Microsoft Software Licensing User - Interface Tool, `slui.exe`, spawning a child process. This behavior is associated - with publicly known UAC bypass. `slui.exe` is commonly associated with software - updates and is most often spawned by `svchost.exe`. The `slui.exe` process should - not have child processes, and any processes spawning from it will be running with - elevated privileges. During triage, review the child process and additional parallel - processes. Identify any file modifications that may have lead to the bypass. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: slui.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate. - Filtering will be needed to ensure proper monitoring. -references: -- https://www.exploit-db.com/exploits/46998 -- https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -tags: - analytic_story: - - DarkSide Ransomware - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 90 - impact: 70 - message: A slui process $parent_process_name$ spawning child process $process_name$ - in host $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/spike_in_file_writes.yml b/dev/endpoint/spike_in_file_writes.yml deleted file mode 100644 index c98582bf64..0000000000 --- a/dev/endpoint/spike_in_file_writes.yml +++ /dev/null @@ -1,44 +0,0 @@ -name: Spike in File Writes -id: fdb0f805-74e4-4539-8c00-618927333aae -version: 3 -date: '2020-03-16' -author: David Dorsey, Splunk -status: experimental -type: Anomaly -description: The search looks for a sharp increase in the number of files written - to a particular host -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.action: created - condition: selection1 -how_to_implement: In order to implement this search, you must populate the Endpoint - file-system data model node. This is typically populated via endpoint detection - and response product, such as Carbon Black or endpoint data sources such as Sysmon. - The data used for this search is typically generated via logs that report reads - and writes to the file system. -known_false_positives: It is important to understand that if you happen to install - any new applications on your hosts or are copying a large number of files, you can - expect to see a large increase of file modifications. -references: [] -tags: - analytic_story: - - SamSam Ransomware - - Ryuk Ransomware - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/spoolsv_spawning_rundll32.yml b/dev/endpoint/spoolsv_spawning_rundll32.yml deleted file mode 100644 index e69e79397f..0000000000 --- a/dev/endpoint/spoolsv_spawning_rundll32.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Spoolsv Spawning Rundll32 -id: 15d905f6-da6b-11eb-ab82-acde48001122 -version: 2 -date: '2021-07-01' -author: Mauricio Velazco, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious child process, `rundll32.exe`, - with no command-line arguments being spawned from `spoolsv.exe`. This was identified - during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. - Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During - triage, isolate the endpoint and review for source of exploitation. Capture any - additional file modification events. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: spoolsv.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives have been identified. There are limited - instances where `rundll32.exe` may be spawned by a legitimate print driver. -references: -- https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available -- https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675 -- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes -tags: - analytic_story: - - PrintNightmare CVE-2021-34527 - asset_type: Endpoint - confidence: 90 - cve: - - CVE-2021-34527 - impact: 80 - message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. - This behavior is suspicious and related to PrintNightmare. - mitre_attack_id: - - T1547.012 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_id - type: Process - role: - - Parent Process - - Attacker - - name: process_id - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/spoolsv_writing_a_dll.yml b/dev/endpoint/spoolsv_writing_a_dll.yml deleted file mode 100644 index 74c423ebab..0000000000 --- a/dev/endpoint/spoolsv_writing_a_dll.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Spoolsv Writing a DLL -id: d5bf5cf2-da71-11eb-92c2-acde48001122 -version: 1 -date: '2021-07-01' -author: Mauricio Velazco, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. - This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) - or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write - a `.dll`. Current POC code used will write the suspicious DLL to disk within a path - of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source - of exploitation. Capture any additional file modification events. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: spoolsv.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: Unknown. -references: -- https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available -- https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675 -- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes -tags: - analytic_story: - - PrintNightmare CVE-2021-34527 - asset_type: Endpoint - confidence: 90 - cve: - - CVE-2021-34527 - impact: 80 - message: $process_name$ has been identified writing dll's to $file_path$ on endpoint - $dest$. This behavior is suspicious and related to PrintNightmare. - mitre_attack_id: - - T1547.012 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: process_id - type: Process - role: - - Child Process - - name: file_path - type: File - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_copy_on_system32.yml b/dev/endpoint/suspicious_copy_on_system32.yml deleted file mode 100644 index cfa3e6f24a..0000000000 --- a/dev/endpoint/suspicious_copy_on_system32.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Suspicious Copy on System32 -id: ce633e56-25b2-11ec-9e76-acde48001122 -version: 1 -date: '2021-10-05' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious copy of file from systemroot - folder of the windows OS. This technique is commonly used by APT or other malware - as part of execution (LOLBIN) to run its malicious code using the available legitimate - tool in OS. this type of event may seen or may execute of normal user in some instance - but this is really a anomaly that needs to be check within the network. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - cmd.exe - - powershell* - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell_ise.exe - selection2: - OriginalFileName: copy.exe - selection3: - Image|endswith: copy.exe - selection4: - Image|endswith: xcopy.exe - selection5: - OriginalFileName: xcopy.exe - selection6: - CommandLine: - - '*\\Windows\\System32\*' - - '*\\Windows\\SysWow64\\*' - selection7: - CommandLine: '*copy*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 - and selection6 and selection7 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: every user may do this event but very un-ussual. -references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 -tags: - analytic_story: - - Unusual Processes - - Qakbot - - IcedID - asset_type: Endpoint - confidence: 90 - impact: 70 - message: execution of copy exe to copy file from $process$ in $dest$ - mitre_attack_id: - - T1036.003 - - T1036 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_curl_network_connection.yml b/dev/endpoint/suspicious_curl_network_connection.yml deleted file mode 100644 index a33b4729e5..0000000000 --- a/dev/endpoint/suspicious_curl_network_connection.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Suspicious Curl Network Connection -id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f -version: 1 -date: '2021-02-22' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies the use of a curl contacting suspicious - remote domains to checkin to Command And Control servers or download further implants. - In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com. - This particular behavior is common with MacOS adware-malicious software. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: s3.amazonaws.com - Image|endswith: curl - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. Filter as needed. -references: -- https://redcanary.com/blog/clipping-silver-sparrows-wings/ -- https://www.marcosantadev.com/manage-plist-files-plistbuddy/ -tags: - analytic_story: - - Silver Sparrow - - Ingress Tool Transfer - - Linux Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/dev/endpoint/suspicious_dllhost_no_command_line_arguments.yml deleted file mode 100644 index 9b607333e1..0000000000 --- a/dev/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Suspicious DLLHost no Command Line Arguments -id: ff61e98c-0337-4593-a78f-72a676c56f26 -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies DLLHost.exe with no command line arguments. - It is unusual for DLLHost.exe to execute with no command line arguments present. - This particular behavior is common with malicious software, including Cobalt Strike. - During investigation, identify any network connections and parallel processes. Identify - any suspicious module loads related to credential dumping or file writes. DLLHost.exe - is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: dllhost.exe - selection2: - Image|endswith: dllhost.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Suspicious dllhost.exe process with no command line arguments executed - on $dest$ by $user$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/dev/endpoint/suspicious_gpupdate_no_command_line_arguments.yml deleted file mode 100644 index 01b90e7429..0000000000 --- a/dev/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Suspicious GPUpdate no Command Line Arguments -id: f308490a-473a-40ef-ae64-dd7a6eba284a -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies gpupdate.exe with no command line arguments. - It is unusual for gpupdate.exe to execute with no command line arguments present. - This particular behavior is common with malicious software, including Cobalt Strike. - During investigation, identify any network connections and parallel processes. Identify - any suspicious module loads related to credential dumping or file writes. gpupdate.exe - is natively found in C:\Windows\system32 and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: GPUpdate.exe - selection2: - Image|endswith: gpupdate.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile -- https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/ -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Suspicious gpupdate.exe process with no command line arguments executed - on $dest$ by $user$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_image_creation_in_appdata_folder.yml b/dev/endpoint/suspicious_image_creation_in_appdata_folder.yml deleted file mode 100644 index f9634400c5..0000000000 --- a/dev/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Suspicious Image Creation In Appdata Folder -id: f6f904c4-1ac0-11ec-806b-acde48001122 -version: 2 -date: '2022-07-07' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious creation of image in appdata folder - made by process that also has a file reference in appdata folder. This technique - was seen in remcos rat that capture screenshot of the compromised machine and place - it in the appdata and will be send to its C2 server. This TTP is really a good indicator - to check that process because it is in suspicious folder path and image files are - not commonly created by user in this folder path. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*\\appdata\\Roaming\\*' - Image|endswith: '*.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US -- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: process $process_name$ creating image file $file_path$ in $dest$ - mitre_attack_id: - - T1113 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/dev/endpoint/suspicious_microsoft_workflow_compiler_rename.yml deleted file mode 100644 index ab3b1211ce..0000000000 --- a/dev/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Suspicious microsoft workflow compiler rename -id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 4 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. - Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 - and is rarely utilized. When investigating, identify the executed code on disk and - review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. - In any instance, microsoft.workflow.compiler.exe spawning from an Office product - or any living off the land binary is highly suspect. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Microsoft.Workflow.Compiler.exe - Image|endswith: microsoft.workflow.compiler.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of microsoft.workflow.compiler.exe, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution - - Cobalt Strike - - Masquerading - Rename System Utilities - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ - by $user$ - mitre_attack_id: - - T1036 - - T1127 - - T1036.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/dev/endpoint/suspicious_microsoft_workflow_compiler_usage.yml deleted file mode 100644 index d6d4e294e8..0000000000 --- a/dev/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Suspicious microsoft workflow compiler usage -id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies microsoft.workflow.compiler.exe usage. - microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 - and is rarely utilized. When investigating, identify the executed code on disk and - review. It is not a commonly used process by many applications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Microsoft.Workflow.Compiler.exe - selection2: - Image|endswith: microsoft.workflow.compiler.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, limited instances have been identified coming - from native Microsoft utilities similar to SCCM. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ - mitre_attack_id: - - T1127 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_msbuild_path.yml b/dev/endpoint/suspicious_msbuild_path.yml deleted file mode 100644 index 7cfc14ab1d..0000000000 --- a/dev/endpoint/suspicious_msbuild_path.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Suspicious msbuild path -id: f5198224-551c-11eb-ae93-0242ac130002 -version: 3 -date: '2022-03-08' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies msbuild.exe executing from a non-standard - path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 - and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio - will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however - there are instances of build applications that will move or use a copy of MSBuild. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSBuild.exe - selection2: - Image|endswith: msbuild.exe - selection3: - Processes.process_path: '*\\framework*\\v*\\*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe, - triggering a false positive. Baselining of MSBuild.exe usage is recommended to better - understand it's path usage. Visual Studio runs an instance out of a path that will - need to be filtered on. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Cobalt Strike - - Masquerading - Rename System Utilities - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ - mitre_attack_id: - - T1036 - - T1127 - - T1036.003 - - T1127.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_msbuild_rename.yml b/dev/endpoint/suspicious_msbuild_rename.yml deleted file mode 100644 index 35ab9130cb..0000000000 --- a/dev/endpoint/suspicious_msbuild_rename.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Suspicious MSBuild Rename -id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 3 -date: '2022-04-07' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies renamed instances of msbuild.exe executing. - Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and - C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify - the code executed and what is executing a renamed instance of MSBuild. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: MSBuild.exe - Image|endswith: msbuild.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may use a moved - copy of msbuild, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -- https://github.com/infosecn1nja/MaliciousMacroMSBuild/ -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Cobalt Strike - - Masquerading - Rename System Utilities - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ - mitre_attack_id: - - T1036 - - T1127 - - T1036.003 - - T1127.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_msbuild_spawn.yml b/dev/endpoint/suspicious_msbuild_spawn.yml deleted file mode 100644 index 3725e3b744..0000000000 --- a/dev/endpoint/suspicious_msbuild_spawn.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Suspicious MSBuild Spawn -id: a115fba6-5514-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. - This behavior is indicative of a COM object being utilized to spawn msbuild from - wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using - Visual Studio. In this instance, there will be command line arguments and file paths. - In a malicious instance, MSBuild.exe will spawn from non-standard processes and - have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, - powershell.exe is far less common and should be investigated. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: wmiprvse.exe - selection2: - OriginalFileName: MSBuild.exe - selection3: - Image|endswith: msbuild.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md -tags: - analytic_story: - - Trusted Developer Utilities Proxy Execution MSBuild - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 70 - message: Suspicious msbuild.exe process executed on $dest$ by $user$ - mitre_attack_id: - - T1127 - - T1127.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_mshta_child_process.yml b/dev/endpoint/suspicious_mshta_child_process.yml deleted file mode 100644 index 393ffd5313..0000000000 --- a/dev/endpoint/suspicious_mshta_child_process.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Suspicious mshta child process -id: 60023bb6-5500-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies child processes spawning from "mshta.exe". - The search will return the first time and last time these command-line arguments - were used for these executions, as well as the target system, the user, parent process - "mshta.exe" and its child process. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cmd.exe - - powershell.exe - - wscript.exe - - cscript.exe - - scrcons.exe - - searchprotocolhost.exe - - microsoft.workflow.compiler.exe - - msbuild.exe - - colorcpl.exe - - powershell.exe - ParentImage: mshta.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 50 - message: suspicious mshta child process detected on host $dest$ by user $user$. - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process - type: Process Name - role: - - Parent Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/suspicious_mshta_spawn.yml b/dev/endpoint/suspicious_mshta_spawn.yml deleted file mode 100644 index e274b6089a..0000000000 --- a/dev/endpoint/suspicious_mshta_spawn.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Suspicious mshta spawn -id: 4d33a488-5b5f-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-20' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This - behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe - or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn - mshta.exe from svchost.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - svchost.exe - - wmiprvse.exe - selection2: - OriginalFileName: MSHTA.EXE - selection3: - Image|endswith: mshta.exe - condition: (selection1) and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://codewhitesec.blogspot.com/2018/07/lethalhta.html -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 70 - message: mshta.exe spawned by wmiprvse.exe on $dest$ - mitre_attack_id: - - T1218 - - T1218.005 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_plistbuddy_usage.yml b/dev/endpoint/suspicious_plistbuddy_usage.yml deleted file mode 100644 index ad4cd9630d..0000000000 --- a/dev/endpoint/suspicious_plistbuddy_usage.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Suspicious PlistBuddy Usage -id: c3194009-e0eb-4f84-87a9-4070f8688f00 -version: 1 -date: '2021-02-22' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: 'The following analytic identifies the use of a native MacOS utility, - PlistBuddy, creating or modifying a properly list (.plist) file. In the instance - of Silver Sparrow, the following commands were executed: - - * PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist - - * PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist - - Upon triage, capture the property list file being written to disk and review for - further indicators. Contain the endpoint and triage further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*true*' - - '*RunAtLoad*' - - '*LaunchAgents*' - Image|endswith: PlistBuddy - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Some legitimate applications may use PlistBuddy to create or - modify property lists and possibly generate false positives. Review the property - list being modified or created to confirm. -references: -- https://www.marcosantadev.com/manage-plist-files-plistbuddy/ -tags: - analytic_story: - - Silver Sparrow - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1543.001 - - T1543 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/suspicious_process_file_path.yml b/dev/endpoint/suspicious_process_file_path.yml deleted file mode 100644 index 85df202287..0000000000 --- a/dev/endpoint/suspicious_process_file_path.yml +++ /dev/null @@ -1,92 +0,0 @@ -name: Suspicious Process File Path -id: 9be25988-ad82-11eb-a14f-acde48001122 -version: 1 -date: '2021-05-05' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic will detect a suspicious process running in a - file path where a process is not commonly seen and is most commonly used by malicious - software. This behavior has been used by adversaries where they drop and run an - exe in a path that is accessible without admin privileges. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path.file_path: '*\\Users\\Administrator\\Music\\*' - selection2: - Processes.process_path: - - '*\\windows\\fonts\\*' - - '*\\windows\\temp\\*' - - '*\\users\\public\\*' - - '*\\windows\\debug\\*' - selection3: - Processes.process_path.file_path: '*\\Windows\\servicing\\*' - selection4: - Processes.process_path.file_path: '*\\Users\\Default\\*' - selection5: - Processes.process_path.file_path: '*Recycle.bin*' - selection6: - Processes.process_path: '*\\Windows\\Media\\*' - selection7: - Processes.process_path: \\Windows\\repair\\* - selection8: - Processes.process_path: '*\\temp\\*' - selection9: - Processes.process_path: '*\\PerfLogs\\*' - condition: selection1 or selection2 or selection3 or selection4 or selection5 or - selection6 or selection7 or selection8 or selection9 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators may allow execution of specific binaries in - non-standard paths. Filter as needed. -references: -- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://twitter.com/pr0xylife/status/1590394227758104576 -tags: - analytic_story: - - Data Destruction - - Double Zero Destructor - - XMRig - - Remcos - - WhisperGate - - Hermetic Wiper - - Industroyer2 - - DarkCrystal RAT - - Brute Ratel C4 - - AgentTesla - - Qakbot - - IcedID - - Trickbot - - Azorult - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicioues process $Processes.process_path.file_path$ running from suspicious - location - mitre_attack_id: - - T1543 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_reg_exe_process.yml b/dev/endpoint/suspicious_reg_exe_process.yml deleted file mode 100644 index 023853296d..0000000000 --- a/dev/endpoint/suspicious_reg_exe_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Suspicious Reg exe Process -id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -version: 4 -date: '2020-07-22' -author: David Dorsey, Splunk -status: production -type: Anomaly -description: This search looks for reg.exe being launched from a command prompt not - started by the user. When a user launches cmd.exe, the parent process is usually - explorer.exe. This search filters out those instances. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: cmd.exe - ParentImage: explorer.exe - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: It's possible for system administrators to write scripts that - exhibit this behavior. If this is the case, the search will need to be modified - to filter them out. -references: -- https://car.mitre.org/wiki/CAR-2013-03-001/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Disabling Security Tools - - DHS Report TA18-074A - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicious $Processes.process_path.file_path$ process running with an uncommon - parent process $Processes.parent_process_name$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_scheduled_task_from_public_directory.yml b/dev/endpoint/suspicious_scheduled_task_from_public_directory.yml deleted file mode 100644 index 9d71acc874..0000000000 --- a/dev/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Suspicious Scheduled Task from Public Directory -id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: 1 -date: '2021-03-01' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following detection identifies Scheduled Tasks registering (creating - a new task) a binary or script to run from a public directory which includes users\public, - \programdata\ and \windows\temp. Upon triage, review the binary or script in the - command line for legitimacy, whether an approved binary/script or not. In addition, - capture the binary or script in question and analyze for further behaviors. Identify - the source and contain the endpoint. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*windows\\temp*' - - '*\\programdata\\*' - - '*\\users\\public\\*' - Image|endswith: schtasks.exe - selection2: - CommandLine: '*/create*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives may be present. Filter as needed by - parent process or command line argument. -references: -- https://attack.mitre.org/techniques/T1053/005/ -tags: - analytic_story: - - Ransomware - - Ryuk Ransomware - - Windows Persistence Techniques - - Living Off The Land - - Azorult - - DarkCrystal RAT - asset_type: Endpoint - confidence: 50 - impact: 70 - message: Suspicious scheduled task registered on $dest$ - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/dev/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml deleted file mode 100644 index 5b8acbc7b7..0000000000 --- a/dev/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Suspicious SearchProtocolHost no Command Line Arguments -id: f52d2db8-31f9-4aa7-a176-25779effe55c -version: 3 -date: '2022-03-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies searchprotocolhost.exe with no command - line arguments. It is unusual for searchprotocolhost.exe to execute with no command - line arguments present. This particular behavior is common with malicious software, - including Cobalt Strike. During investigation, identify any network connections - and parallel processes. Identify any suspicious module loads related to credential - dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 - and C:\Windows\syswow64. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: searchprotocolhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives may be present in small environments. - Tuning may be required based on parent process. -references: -- https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc -tags: - analytic_story: - - Cobalt Strike - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Suspicious searchprotocolhost.exe process with no command line arguments - executed on $dest$ by $user$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml deleted file mode 100644 index 809447e04f..0000000000 --- a/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Suspicious SQLite3 LSQuarantine Behavior -id: e1997b2e-655f-4561-82fd-aeba8e1c1a86 -version: 1 -date: '2021-02-22' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies the use of a SQLite3 querying the MacOS - preferences to identify the original URL the pkg was downloaded from. This particular - behavior is common with MacOS adware-malicious software. Upon triage, review other - processes in parallel for suspicious activity. Identify any recent package installations. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*LSQuarantine*' - Image|endswith: sqlite3 - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. -references: -- https://redcanary.com/blog/clipping-silver-sparrows-wings/ -- https://www.marcosantadev.com/manage-plist-files-plistbuddy/ -tags: - analytic_story: - - Silver Sparrow - asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd - mitre_attack_id: - - T1074 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/suspicious_wav_file_in_appdata_folder.yml b/dev/endpoint/suspicious_wav_file_in_appdata_folder.yml deleted file mode 100644 index 944550bfe6..0000000000 --- a/dev/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Suspicious WAV file in Appdata Folder -id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 2 -date: '2022-07-07' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious creation of .wav file in appdata - folder. This behavior was seen in Remcos RAT malware where it put the audio recording - in the appdata\audio folde as part of data collection. this recording can be send - to its C2 server as part of its exfiltration to the compromised machine. creation - of wav files in this folder path is not a ussual disk place used by user to save - audio format file. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*\\appdata\\Roaming\\*' - Image|endswith: '*.exe' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, file_name, file_path and command-line - executions from your endpoints. If you are using Sysmon, you must have at least - version 6.0.4 of the Sysmon TA. -known_false_positives: unknown -references: -- https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US -- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: process $process_name$ creating image file $file_path$ in $dest$ - mitre_attack_id: - - T1113 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/dev/endpoint/suspicious_writes_to_windows_recycle_bin.yml deleted file mode 100644 index ebd0e4bda4..0000000000 --- a/dev/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Suspicious writes to windows Recycle Bin -id: b5541828-8ffd-4070-9d95-b3da4de924cb -version: 4 -date: '2020-07-22' -author: Rico Valdez, Splunk -status: production -type: TTP -description: This search detects writes to the recycle bin by a process other than - explorer.exe. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: '*$Recycle.Bin*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on filesystem and process logs responsible for the changes from your endpoints into - the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes. -known_false_positives: Because the Recycle Bin is a hidden folder in modern versions - of Windows, it would be unusual for a process other than explorer.exe to write to - it. Incidents should be investigated as appropriate. -references: [] -tags: - analytic_story: - - Collection and Staging - asset_type: Windows - confidence: 70 - impact: 40 - message: Suspicious writes to windows Recycle Bin process $Processes.process_name$ - mitre_attack_id: - - T1036 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 28 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/svchost_lolbas_execution_process_spawn.yml b/dev/endpoint/svchost_lolbas_execution_process_spawn.yml deleted file mode 100644 index 484c06f9c1..0000000000 --- a/dev/endpoint/svchost_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,109 +0,0 @@ -name: Svchost LOLBAS Execution Process Spawn -id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 2 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing the Task Scheduler - and creating a malicious remote scheduled task, the executed command is spawned - as a child process of `svchost.exe`. The LOLBAS project documents Windows native - binaries that can be abused by threat actors to perform tasks like executing malicious - code. Looking for child processes of svchost.exe that are part of the LOLBAS project - can help defenders identify lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: svchost.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1053/005/ -- https://www.ired.team/offensive-security/persistence/t1053-schtask -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Svchost.exe spawned a LOLBAS process on $dest$ - mitre_attack_id: - - T1053 - - T1053.005 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement_lolbas/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog diff --git a/dev/endpoint/system_info_gathering_using_dxdiag_application.yml b/dev/endpoint/system_info_gathering_using_dxdiag_application.yml deleted file mode 100644 index a560e178ce..0000000000 --- a/dev/endpoint/system_info_gathering_using_dxdiag_application.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: System Info Gathering Using Dxdiag Application -id: f92d74f2-4921-11ec-b685-acde48001122 -version: 1 -date: '2021-11-19' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to detect a suspicious dxdiag.exe process command-line - execution. Dxdiag is used to collect the system info of the target host. This technique - has been used by Remcos RATS, various actors, and other malware to collect information - as part of the recon or collection phase of an attack. This behavior should rarely - be seen in a corporate network, but this command line can be used by a network administrator - to audit host machine specifications. Thus in some rare cases, this detection will - contain false positives in its results. To triage further, analyze what commands - were passed after it pipes out the result to a file for further processing. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: dxdiag.exe - selection2: - Image|endswith: dxdiag.exe - selection3: - CommandLine: '* /t *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` - node. In addition, confirm the latest CIM App 4.20 or higher is installed and the - latest TA for the endpoint product. -known_false_positives: This commandline can be used by a network administrator to - audit host machine specifications. Thus, a filter is needed. -references: -- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/ -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 50 - impact: 50 - message: dxdiag.exe process with commandline $process$ on $dest$ - mitre_attack_id: - - T1592 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_information_discovery_detection.yml b/dev/endpoint/system_information_discovery_detection.yml deleted file mode 100644 index c8d0ef5277..0000000000 --- a/dev/endpoint/system_information_discovery_detection.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: System Information Discovery Detection -id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 2 -date: '2021-09-07' -author: Patrick Bareiss, Splunk -status: production -type: TTP -description: Detect system information discovery techniques used by attackers to understand - configurations of the system to further exploit it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*wmic* qfe*' - - '*systeminfo*' - - '*hostname*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators debugging servers -references: -- https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation -tags: - analytic_story: - - Discovery Techniques - asset_type: Windows - confidence: 50 - impact: 30 - message: Potential system information discovery behavior on $dest$ by $User$ - mitre_attack_id: - - T1082 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_processes_run_from_unexpected_locations.yml b/dev/endpoint/system_processes_run_from_unexpected_locations.yml deleted file mode 100644 index 4dea44a9ab..0000000000 --- a/dev/endpoint/system_processes_run_from_unexpected_locations.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: System Processes Run From Unexpected Locations -id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 6 -date: '2020-12-08' -author: David Dorsey, Michael Haag, Splunk -status: production -type: Anomaly -description: 'This search looks for system processes that typically execute from `C:\Windows\System32\` - or `C:\Windows\SysWOW64`. This may indicate a malicious process that is trying - to hide as a legitimate process. - - This detection utilizes a lookup that is deduped `system32` and `syswow64` directories - from Server 2016 and Windows 10. - - During triage, review the parallel processes - what process moved the native Windows - binary? identify any artifacts on disk and review. If a remote destination is contacted, - what is the reputation?' -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: C:\\Windows\\SysWOW64* - selection2: - Processes.process_path: C:\\Windows\\System32* - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: This detection may require tuning based on third party applications - utilizing native Windows binaries in non-standard paths. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -tags: - analytic_story: - - Suspicious Command-Line Executions - - Unusual Processes - - Ransomware - - Masquerading - Rename System Utilities - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 60 - message: A System process $process_name$ is running from $process_path$ on $dest$, - potentially non-standard. - mitre_attack_id: - - T1036 - - T1036.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - - name: process_path - type: Other - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_user_discovery_with_query.yml b/dev/endpoint/system_user_discovery_with_query.yml deleted file mode 100644 index 96feacc0df..0000000000 --- a/dev/endpoint/system_user_discovery_with_query.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: System User Discovery With Query -id: ad03bfcf-8a91-4bc2-a500-112993deba87 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `query.exe` with command-line - arguments utilized to discover the logged user. Red Teams and adversaries alike - may leverage `query.exe` to identify system users on a compromised endpoint for - situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*user*' - Image|endswith: query.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/system_user_discovery_with_whoami.yml b/dev/endpoint/system_user_discovery_with_whoami.yml deleted file mode 100644 index 3ab6e9c70a..0000000000 --- a/dev/endpoint/system_user_discovery_with_whoami.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: System User Discovery With Whoami -id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `whoami.exe` without any arguments. - This windows native binary prints out the current logged user. Red Teams and adversaries - alike may leverage `whoami.exe` to identify system users on a compromised endpoint - for situational awareness and Active Directory Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: whoami.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/time_provider_persistence_registry.yml b/dev/endpoint/time_provider_persistence_registry.yml deleted file mode 100644 index 9a142255f7..0000000000 --- a/dev/endpoint/time_provider_persistence_registry.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Time Provider Persistence Registry -id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious modification of time provider - registry for persistence and autostart. This technique can allow the attacker to - persist on the compromised host and autostart as soon as the machine boot up. This - TTP can be a good indicator of suspicious behavior since this registry is not commonly - modified by normal user or even an admin. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://pentestlab.blog/2019/10/22/persistence-time-providers/ -- https://attack.mitre.org/techniques/T1547/003/ -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - - Windows Registry Abuse - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - mitre_attack_id: - - T1547.003 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/uninstall_app_using_msiexec.yml b/dev/endpoint/uninstall_app_using_msiexec.yml deleted file mode 100644 index 06e3e3edc1..0000000000 --- a/dev/endpoint/uninstall_app_using_msiexec.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Uninstall App Using MsiExec -id: 1fca2b28-f922-11eb-b2dd-acde48001122 -version: 1 -date: '2021-08-09' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious un-installation of application - using msiexec. This technique was seen in conti leak tool and script where it tries - to uninstall AV product using this commandline. This commandline to uninstall product - is not a common practice in enterprise network. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* /qn *' - Image|endswith: msiexec.exe - selection2: - CommandLine: '*/X*' - selection3: - CommandLine: '*REBOOT=' - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown. -references: -- https://threadreaderapp.com/thread/1423361119926816776.html -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 60 - impact: 50 - message: process $process_name$ with a cmdline $process$ in host $dest$ - mitre_attack_id: - - T1218.007 - - T1218 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/unknown_process_using_the_kerberos_protocol.yml b/dev/endpoint/unknown_process_using_the_kerberos_protocol.yml deleted file mode 100644 index 0f45cb5b68..0000000000 --- a/dev/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Unknown Process Using The Kerberos Protocol -id: c91a0852-9fbb-11ec-af44-acde48001122 -version: 1 -date: '2022-03-09' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies a process performing an outbound connection - on port 88 used by default by the network authentication protocol Kerberos. Typically, - on a regular Windows endpoint, only the lsass.exe process is the one tasked with - connecting to the Kerberos Distribution Center to obtain Kerberos tickets. Identifying - an unknown process using this protocol may be evidence of an adversary abusing the - Kerberos protocol. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: lsass.exe - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting your - endpoint events and populating the Endpoint and Network data models. -known_false_positives: Custom applications may leverage the Kerberos protocol. Filter - as needed. -references: -- https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/ -- https://www.thehacker.recipes/ad/movement/kerberos/ptk -tags: - analytic_story: - - Active Directory Kerberos Attacks - asset_type: Endpoint - confidence: 60 - impact: 60 - message: '' - mitre_attack_id: - - T1550 - observable: - - name: src_ip - type: IP Address - role: - - Attacker - - name: dest_ip - type: IP Address - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/unload_sysmon_filter_driver.yml b/dev/endpoint/unload_sysmon_filter_driver.yml deleted file mode 100644 index d93fdae4de..0000000000 --- a/dev/endpoint/unload_sysmon_filter_driver.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Unload Sysmon Filter Driver -id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe -version: 4 -date: '2022-06-01' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: Attackers often disable security tools to avoid detection. This search - looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop - sysmon from collecting the data. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*unload*' - Image|endswith: fltMC.exe - selection2: - CommandLine: '*SysmonDrv*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, - update this macro to filter out false positives. -known_false_positives: Unknown at the moment -references: -- https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver -tags: - analytic_story: - - Disabling Security Tools - asset_type: Endpoint - confidence: 90 - impact: 50 - message: Possible Sysmon filter driver unloading on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/user_discovery_with_env_vars_powershell.yml b/dev/endpoint/user_discovery_with_env_vars_powershell.yml deleted file mode 100644 index 7b660d6049..0000000000 --- a/dev/endpoint/user_discovery_with_env_vars_powershell.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: User Discovery With Env Vars PowerShell -id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 -version: 1 -date: '2021-09-13' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: This analytic looks for the execution of `powershell.exe` with command-line - arguments that leverage PowerShell environment variables to identify the current - logged user. Red Teams and adversaries may leverage this method to identify the - logged user on a compromised endpoint for situational awareness and Active Directory - Discovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*[System.Environment]::UserName*' - - '*$env:UserName*' - Image|endswith: powershell.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1033/ -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System user discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/usn_journal_deletion.yml b/dev/endpoint/usn_journal_deletion.yml deleted file mode 100644 index bbc9662005..0000000000 --- a/dev/endpoint/usn_journal_deletion.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: USN Journal Deletion -id: b6e0ff70-b122-4227-9368-4cf322ab43c3 -version: 2 -date: '2018-12-03' -author: David Dorsey, Splunk -status: production -type: TTP -description: The fsutil.exe application is a legitimate Windows utility used to perform - tasks related to the file allocation table (FAT) and NTFS file systems. The update - sequence number (USN) change journal provides a log of all changes made to the files - on the disk. This search looks for fsutil.exe deleting the USN journal. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: fsutil.exe - condition: selection1 -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. -known_false_positives: None identified -references: [] -tags: - analytic_story: - - Windows Log Manipulation - - Ransomware - asset_type: Endpoint - confidence: 90 - impact: 50 - message: Possible USN journal deletion on $dest$ - mitre_attack_id: - - T1070 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 45 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/vbscript_execution_using_wscript_app.yml b/dev/endpoint/vbscript_execution_using_wscript_app.yml deleted file mode 100644 index 3d6017631e..0000000000 --- a/dev/endpoint/vbscript_execution_using_wscript_app.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Vbscript Execution Using Wscript App -id: 35159940-228f-11ec-8a49-acde48001122 -version: 1 -date: '2021-10-01' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to detect a suspicious wscript commandline to execute - vbscript. This technique was seen in several malware to execute malicious vbs file - using wscript application. commonly vbs script is associated to cscript process - and this can be a technique to evade process parent child detections or even some - av script emulation system. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*//e:vbscript*' - ParentImage: wscript.exe - selection2: - CommandLine: '*//e:vbscript*' - Image|endswith: wscript.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://www.joesandbox.com/analysis/369332/0/html -tags: - analytic_story: - - FIN7 - - Remcos - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Process name $process_name$ with commandline $process$ to execute vbsscript - mitre_attack_id: - - T1059.005 - - T1059 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/w3wp_spawning_shell.yml b/dev/endpoint/w3wp_spawning_shell.yml deleted file mode 100644 index e1467934d9..0000000000 --- a/dev/endpoint/w3wp_spawning_shell.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: W3WP Spawning Shell -id: 0f03423c-7c6a-11eb-bc47-acde48001122 -version: 2 -date: '2021-03-03' -author: Michael Haag, Splunk -status: production -type: TTP -description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from - W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will - capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, - on publicly available Exchange mail servers. During triage, review the parent process - and child process of the shell being spawned. Review the command-line arguments - and any file modifications that may occur. Identify additional parallel process, - child processes, that may highlight further commands executed. After triaging, work - to contain the threat and patch the system that is vulnerable. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: w3wp.exe - selection2: - OriginalFileName: Cmd.Exe - selection3: - Image|endswith: cmd.exe - selection4: - OriginalFileName: Cmd.Exe - selection5: - Image|endswith: cmd.exe - condition: selection1 and selection2 and selection3 or selection4 or selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Baseline your environment before production. It is possible - build systems using IIS will spawn cmd.exe to perform a software build. Filter as - needed. -references: -- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/ -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://www.youtube.com/watch?v=FC6iHw258RI -- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do -tags: - analytic_story: - - Hermetic Wiper - - HAFNIUM Group - - ProxyShell - - CISA AA22-257A - - ProxyNotShell - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - cve: - - CVE-2021-34473 - - CVE-2021-34523 - - CVE-2021-31207 - impact: 70 - message: Possible Web Shell execution on $dest$ - mitre_attack_id: - - T1505 - - T1505.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wbadmin_delete_system_backups.yml b/dev/endpoint/wbadmin_delete_system_backups.yml deleted file mode 100644 index ecfaebc0ec..0000000000 --- a/dev/endpoint/wbadmin_delete_system_backups.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: WBAdmin Delete System Backups -id: cd5aed7e-5cea-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator - Tool) that delete backup files. This is typically used by ransomware to prevent - recovery. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*delete*' - Image|endswith: wbadmin.exe - selection2: - CommandLine: - - '*systemstatebackup*' - - '*catalog*' - condition: selection1 and selection2 -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. Tune based on parent process names. -known_false_positives: Administrators may modify the boot configuration. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md -- https://thedfirreport.com/2020/10/08/ryuks-return/ -- https://attack.mitre.org/techniques/T1490/ -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin -tags: - analytic_story: - - Ryuk Ransomware - - Ransomware - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 30 - message: System backups deletion on $dest$ - mitre_attack_id: - - T1490 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wget_download_and_bash_execution.yml b/dev/endpoint/wget_download_and_bash_execution.yml deleted file mode 100644 index 294f091fd4..0000000000 --- a/dev/endpoint/wget_download_and_bash_execution.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Wget Download and Bash Execution -id: 35682718-5a85-11ec-b8f7-acde48001122 -version: 1 -date: '2021-12-11' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of wget on Linux or MacOS attempting - to download a file from a remote source and pipe it to bash. This is typically found - with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: wget - selection2: - CommandLine: '*-q *' - selection3: - CommandLine: '*-O- *' - selection4: - CommandLine: '*--quiet*' - selection5: - CommandLine: '*bash*' - selection6: - CommandLine: '*|*' - condition: selection1 and selection2 and selection3 and selection4 or selection5 - or selection6 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is - occurring correctly. If the EDR is not parsing the pipe bash in the command-line, - modifying the analytic will be required. Add parent process name (Processes.parent_process_name) - as needed to filter. -known_false_positives: False positives should be limited, however filtering may be - required. -references: -- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java -- https://www.lunasec.io/docs/blog/log4j-zero-day/ -- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 -tags: - analytic_story: - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ attempting - to download a remote file and run it with bash. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon:linux diff --git a/dev/endpoint/windows_adfind_exe.yml b/dev/endpoint/windows_adfind_exe.yml deleted file mode 100644 index 2b11596aab..0000000000 --- a/dev/endpoint/windows_adfind_exe.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows AdFind Exe -id: bd3b0187-189b-46c0-be45-f52da2bae67f -version: 2 -date: '2021-11-03' -author: Jose Hernandez, Bhavin Patel, Splunk -status: production -type: TTP -description: 'This search looks for the execution of `adfind.exe` with command-line - arguments that it uses by default. Specifically the filter or search functions. - It also considers the arguments necessary like objectcategory, see readme for more - details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been - seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. - AdFind.exe is usually used a recon tool to enumare a domain controller.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*objectcategory*' - - '* -gcb *' - - '* -sc *' - selection2: - CommandLine: - - '* -f *' - - '* -b *' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, and command-line executions from your endpoints. If - you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrators rarely use adfind, usually not used for legitimate - reasons -references: -- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption -tags: - analytic_story: - - NOBELIUM Group - - Domain Trust Discovery - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Windows AdFind Exe - mitre_attack_id: - - T1018 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25.0 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_apache_benchmark_binary.yml b/dev/endpoint/windows_apache_benchmark_binary.yml deleted file mode 100644 index 45fd4ac01f..0000000000 --- a/dev/endpoint/windows_apache_benchmark_binary.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Windows Apache Benchmark Binary -id: 894f48ea-8d85-4dcd-9132-c66cdb407c9b -version: 1 -date: '2022-11-21' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies a default behavior of a MetaSploit - payload. MetaSploit uses Apache Benchmark to generate payloads. The payloads contain - standard artifacts including "Apache Benchmark" and the original file name is always - ab.exe. During triage, review the process and it's path. It is possible network - connections spawned from it. Review parallel processes for further behaviors. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: ab.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as there is a small subset - of binaries that contain the original file name of ab.exe. Filter as needed. -references: -- https://seclists.org/metasploit/2013/q3/13 -tags: - analytic_story: - - MetaSploit - asset_type: Endpoint - confidence: 100 - impact: 100 - message: A known MetaSploit default payload has been identified on $dest$ ran by - $user$, $parent_process_name$ spawning $process_name$. - mitre_attack_id: - - T1059 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/metasploit/apachebench_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/dev/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml deleted file mode 100644 index dadaaac918..0000000000 --- a/dev/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows Autostart Execution LSASS Driver Registry Modification -id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a -version: 1 -date: '2022-08-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the abuse of two undocumented registry - keys that allow for a DLL to load into lsass.exe to potentially capture credentials. - Upon successful modification of \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - or \CurrentControlSet\Services\NTDS\LsaDbExtPt, a DLL either remote or local will - be set as the value and load up into lsass.exe. Based on POC code a text file may - be written to disk with credentials. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt' - - '*\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present on recent Windows Operating - Systems. Filtering may be required based on process_name. In addition, look for - non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by - adding Endpoint.processes process_name to query to identify the process making the - modification. -references: -- https://blog.xpnsec.com/exploring-mimikatz-part-1/ -- https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib -tags: - analytic_story: - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified - on $dest$. - mitre_attack_id: - - T1547.008 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/dev/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml deleted file mode 100644 index b97260411d..0000000000 --- a/dev/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows Binary Proxy Execution Mavinject DLL Injection -id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 -version: 1 -date: '2022-07-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running - processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution - (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition - to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import - descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe - PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an - import table entry consisting of the specified DLL into the module at the given - base address. During triage, review file modifcations and parallel processes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*injectrunning*' - - '*hmodule=' - Image|endswith: mavinject.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter on DLL name or parent - process. -references: -- https://attack.mitre.org/techniques/T1218/013/ -- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting load a DLL. - mitre_attack_id: - - T1218.013 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_cached_domain_credentials_reg_query.yml b/dev/endpoint/windows_cached_domain_credentials_reg_query.yml deleted file mode 100644 index d428a1125c..0000000000 --- a/dev/endpoint/windows_cached_domain_credentials_reg_query.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Windows Cached Domain Credentials Reg Query -id: 40ccb8e0-1785-466e-901e-6a8b75c04ecd -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line related to the - discovery of cache domain credential logon count in the registry. This Technique - was being abused by several post exploitation tool like Winpeas where it query CachedLogonsCount - registry value in Winlogon registry. This value can be good information about the - login caching setting on the Windows OS target host. A value of 0 means login caching - is disable and values > 50 caches only 50 login attempts. By default all versions - of Windows 10 save cached logins except Windows Server 2008. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* query *' - selection4: - CommandLine: '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*' - selection5: - CommandLine: '*CACHEDLOGONSCOUNT*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -- https://learn.microsoft.com/de-de/troubleshoot/windows-server/user-profiles-and-logon/cached-domain-logon-information -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: a process with commandline $process$ tries to retrieve cache domain credential - logon count in $dest$ - mitre_attack_id: - - T1003.005 - - T1003 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_change_default_file_association_for_no_file_ext.yml b/dev/endpoint/windows_change_default_file_association_for_no_file_ext.yml deleted file mode 100644 index c5773a8857..0000000000 --- a/dev/endpoint/windows_change_default_file_association_for_no_file_ext.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Change Default File Association For No File Ext -id: dbdf52ad-d6a1-4b68-975f-0a10939d8e38 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is developed to detect suspicious process commandline to - change or set the default file association of a file without file extension with - notepad.exe. This technique was seen in some APT and ransomware Prestige where it - set/modify the default process to run file association, like .txt to notepad.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* add *' - selection4: - CommandLine: '* HKCR\\*' - selection5: - CommandLine: '*\\shell\\open\\command*' - selection6: - CommandLine: '*Notepad.exe*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 - and selection6 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Prestige Ransomware - asset_type: Endpoint - confidence: 100 - impact: 80 - message: process with commandline $process$ set or change the file association of - a file with no file extension in $dest$ - mitre_attack_id: - - T1546.001 - - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/dev/endpoint/windows_com_hijacking_inprocserver32_modification.yml deleted file mode 100644 index 34facec810..0000000000 --- a/dev/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Windows COM Hijacking InprocServer32 Modification -id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561 -version: 1 -date: '2022-09-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of reg.exe performing an add - to the InProcServer32, which may be related to COM hijacking. Adversaries can use - the COM system to insert malicious code that can be executed in place of legitimate - software through hijacking the COM references and relationships as a means for persistence. - Hijacking a COM object requires a change in the Registry to replace a reference - to a legitimate system component which may cause that component to not work when - executed. When that system component is executed through normal system operation - the adversary's code will be executed instead. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '*inprocserver32*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and some filtering may be required. -references: -- https://attack.mitre.org/techniques/T1546/015/ -- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the - registry. - mitre_attack_id: - - T1546.015 - - T1546 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/dev/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml deleted file mode 100644 index 604cb23107..0000000000 --- a/dev/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Command and Scripting Interpreter Path Traversal Exec -id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 -version: 2 -date: '2022-06-01' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies path traversal command-line execution. - This technique was seen in malicious document that execute malicious code using - msdt.exe and path traversal technique that serve as defense evasion. This TTP is - a good pivot to look for more suspicious process and command-line that runs before - and after this execution. This may help you to find possible downloaded malware - or other lolbin execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*\/..\/..\/..\/*' - - '*\\..\\..\\..\\*' - - '*\/\/..\/\/..\/\/..\/\/*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product -known_false_positives: Not known at this moment. -references: -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - impact: 90 - message: A parent process $parent_process_name$ has spawned a child $process_name$ - with path traversal commandline $process$ in $dest$ - mitre_attack_id: - - T1059 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_command_shell_fetch_env_variables.yml b/dev/endpoint/windows_command_shell_fetch_env_variables.yml deleted file mode 100644 index 36217e7169..0000000000 --- a/dev/endpoint/windows_command_shell_fetch_env_variables.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Command Shell Fetch Env Variables -id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 -version: 1 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious process command line fetching - the environment variables with a non-shell parent process. This technique was seen - in qakbot malware where it fetches the environment variable in the target or compromised - host. This TTP detection is a good pivot of possible malicious behavior since the - command line is executed by a common non-shell process like cmd.exe , powershell.exe - and many more. This can also be a good sign that the parent process has a malicious - code injected to it to execute this command. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*cmd /c set' - - '*cmd.exe /c set' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: shell process that are not included in this search may cause - False positive. Filter is needed. -references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 80 - message: non-shell parent process has a child process $process_name$ with a commandline - $process$ to fetch env variables in $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_credentials_from_password_stores_query.yml b/dev/endpoint/windows_credentials_from_password_stores_query.yml deleted file mode 100644 index eb87fb4ec8..0000000000 --- a/dev/endpoint/windows_credentials_from_password_stores_query.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Credentials from Password Stores Query -id: db02d6b4-5d5b-4c33-8d8f-f0577516a8c7 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process execution of Windows OS cmdkey.exe - tool. This tool is being abused or used by several post exploitation tool such as - winpeas that being used by ransomware prestige to list stored user names, passwords - or credentials in the targeted Windows OS host. This information can be used by - the attacker to gain privilege escalation and persistence in the targeted hosts - for further attacks. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/list*' - OriginalFileName: cmdkey.exe - selection2: - Image|endswith: cmdkey.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this tool for auditing process. -references: -- https://ss64.com/nt/cmdkey.html -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a process $process_name$ was executed in $dest$ to display stored username - and credentials. - mitre_attack_id: - - T1555 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_credentials_in_registry_reg_query.yml b/dev/endpoint/windows_credentials_in_registry_reg_query.yml deleted file mode 100644 index 533c14ae25..0000000000 --- a/dev/endpoint/windows_credentials_in_registry_reg_query.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Windows Credentials in Registry Reg Query -id: a8b3124e-2278-4b73-ae9c-585117079fb2 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line related to the - discovery of possible password or credentials in the registry. This technique is - being abused by adversaries or post exploitation tools like winpeas to steal credentials - in the registry in the targeted host. Registry can contain several sensitive information - like username and credentials that can be used for privilege escalation, persistence - or even in lateral movement. This Anomaly detection can be a good pivot to detect - a suspicious process querying a registry related to password or private keys. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* query *' - selection4: - CommandLine: - - '*\\Software\\ORL\\WinVNC3\\Password*' - - '*\\SOFTWARE\\RealVNC\\WinVNC4 /v password*' - - '*\\CurrentControlSet\\Services\\SNMP*' - - '*\\Software\\TightVNC\\Server*' - - '*\\Software\\SimonTatham\\PuTTY\\Sessions*' - - '*\\Software\\OpenSSH\\Agent\\Keys*' - - '*password*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1552/002/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: reg query commandline $process$ in $dest$ - mitre_attack_id: - - T1552.002 - - T1552 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_curl_download_to_suspicious_path.yml b/dev/endpoint/windows_curl_download_to_suspicious_path.yml deleted file mode 100644 index 64d4740dad..0000000000 --- a/dev/endpoint/windows_curl_download_to_suspicious_path.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Windows Curl Download to Suspicious Path -id: c32f091e-30db-11ec-8738-acde48001122 -version: 1 -date: '2021-10-19' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the use of Windows Curl.exe downloading - a file to a suspicious location. - - -O or --output is used when a file is to be downloaded and placed in a specified - location. - - During triage, review parallel processes for further behavior. In addition, identify - if the download was successful. If a file was downloaded, capture and analyze.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Curl.exe - selection2: - Image|endswith: curl.exe - selection3: - CommandLine: - - '*-O *' - - '*--output*' - selection4: - CommandLine: - - '*\\appdata\\*' - - '*\\programdata\\*' - - '*\\public\\*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible Administrators or super users will use Curl - for legitimate purposes. Filter as needed. -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -- https://attack.mitre.org/techniques/T1105/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md -tags: - analytic_story: - - IcedID - - Ingress Tool Transfer - - Forest Blizzard - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ to download a file to a suspicious directory. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_curl_upload_to_remote_destination.yml b/dev/endpoint/windows_curl_upload_to_remote_destination.yml deleted file mode 100644 index 879ba38f09..0000000000 --- a/dev/endpoint/windows_curl_upload_to_remote_destination.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: Windows Curl Upload to Remote Destination -id: 42f8f1a2-4228-11ec-aade-acde48001122 -version: 1 -date: '2021-11-10' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the use of Windows Curl.exe uploading - a file to a remote destination. - - `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. - - - `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving - web application, and it is, for example, how most common HTML forms on the web work. - - - HTTP multipart formposts are done with `-F`, but this appears to not be compatible - with the Windows version of Curl. Will update if identified adversary tradecraft. - - - Adversaries may use one of the three methods based on the remote destination and - what they are attempting to upload (zip vs txt). During triage, review parallel - processes for further behavior. In addition, identify if the upload was successful - in network logs. If a file was uploaded, isolate the endpoint and review.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: Curl.exe - selection2: - Image|endswith: curl.exe - selection3: - CommandLine: - - '*-T *' - - '*--upload-file *' - - '*-d *' - - '*--data *' - - '*-F *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be limited to source control applications - and may be required to be filtered out. -references: -- https://everything.curl.dev/usingcurl/uploads -- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 -- https://twitter.com/d1r4c/status/1279042657508081664?s=20 -tags: - analytic_story: - - Ingress Tool Transfer - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ uploading a file to a remote destination. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/dev/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml deleted file mode 100644 index c7a293c184..0000000000 --- a/dev/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Defacement Modify Transcodedwallpaper File -id: e11c3d90-5bc7-42ad-94cd-ba75db10d897 -version: 1 -date: '2022-08-25' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a modification to the Transcodedwallpaper - file in the wallpaper theme directory to change the wallpaper of the host machine. - This technique was seen in adversaries attempting to deface or change the desktop - wallpaper of the targeted host. During our testing, the common process that affects - or changes the wallpaper if a user changes it via desktop personalized setting is - explorer.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Processes.process_path: '*\\Windows\\Explorer.EXE' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: 3rd part software application can change the wallpaper. Filter - is needed. -references: -- https://forums.ivanti.com/s/article/Wallpaper-Windows-Settings-Desktop-Settings-and-the-transcodedwallpaper-jpg?language=en_US -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_sifreli.a -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - confidence: 30 - impact: 30 - message: modification or creation of transcodedwallpaper file by $process_name$ - in $dest$ - mitre_attack_id: - - T1491 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_defender_exclusion_registry_entry.yml b/dev/endpoint/windows_defender_exclusion_registry_entry.yml deleted file mode 100644 index 46bf721164..0000000000 --- a/dev/endpoint/windows_defender_exclusion_registry_entry.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows Defender Exclusion Registry Entry -id: 13395a44-4dd9-11ec-9df7-acde48001122 -version: 1 -date: '2021-11-25' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic will detect a suspicious process that modify a registry - related to windows defender exclusion feature. This registry is abused by adversaries, - malware author and red teams to bypassed Windows Defender Anti-Virus product by - excluding folder path, file path, process, extensions and etc. from its real time - or schedule scan to execute their malicious code. This is a good indicator for a - defense evasion and to look further for events after this behavior. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to use this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Remcos - - Windows Defense Evasion Tactics - - Azorult - - Qakbot - asset_type: Endpoint - confidence: 80 - impact: 80 - message: exclusion registry $registry_path$ modified or added on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/dev/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml deleted file mode 100644 index 74b73eb3db..0000000000 --- a/dev/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Deleted Registry By A Non Critical Process File Path -id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2 -version: 1 -date: '2022-03-28' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect deletion of registry with suspicious process - file path. This technique was seen in Double Zero wiper malware where it will delete - all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload - to the targeted hosts. This anomaly detections can catch possible malware or advesaries - deleting registry as part of defense evasion or even payload impact but can also - catch for third party application updates or installation. In this scenario false - positive filter is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.action: deleted - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the registry value name, registry path, and registry value data from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: This detection can catch for third party application updates - or installation. In this scenario false positive filter is needed. -references: -- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html -tags: - analytic_story: - - Double Zero Destructor - asset_type: Endpoint - confidence: 60 - impact: 60 - message: registry was deleted by a suspicious $process_name$ with proces path $process_path - in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 36 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_change_password_through_registry.yml b/dev/endpoint/windows_disable_change_password_through_registry.yml deleted file mode 100644 index c1c8f3c544..0000000000 --- a/dev/endpoint/windows_disable_change_password_through_registry.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Disable Change Password Through Registry -id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - change password feature of the windows host. This registry modification may disables - the Change Password button on the Windows Security dialog box (which appears when - you press Ctrl+Alt+Del). As a result, users cannot change their Windows password - on demand. This technique was seen in some malware family like ransomware to prevent - the user to change the password after ownning the network or a system during attack. - This windows feature may implemented by administrator to prevent normal user to - change the password of a critical host or server, In this type of scenario filter - is needed to minimized false positive. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implemented by administrator to prevent - normal user to change the password of a critical host or server, In this type of - scenario filter is needed to minimized false positive. -references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "DisableChangePassword" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/dev/endpoint/windows_disable_lock_workstation_feature_through_registry.yml deleted file mode 100644 index 61441ae1a4..0000000000 --- a/dev/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Disable Lock Workstation Feature Through Registry -id: c82adbc6-9f00-11ec-a81f-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - Lock Computer windows features. This registry modification prevent the user from - locking its screen or computer that are being abused by several malware for example - ransomware. This technique was used by threat actor to make its payload more impactful - to the compromised host. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ -- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "DisableLockWorkstation" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_logoff_button_through_registry.yml b/dev/endpoint/windows_disable_logoff_button_through_registry.yml deleted file mode 100644 index 2edb0c546c..0000000000 --- a/dev/endpoint/windows_disable_logoff_button_through_registry.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows Disable LogOff Button Through Registry -id: b2fb6830-9ed1-11ec-9fcb-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - logoff feature in windows host. This registry when enable will prevent users to - log off of the system by using any method, including programs run from the command - line, such as scripts. It also disables or removes all menu items and buttons that - log the user off of the system. This technique was seen abused by ransomware malware - to make the compromised host un-useful and hard to remove other registry modification - made on the machine that needs restart to take effect. This windows feature may - implement by administrator in some server where shutdown is critical. In that scenario - filter of machine and users that can modify this registry is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - NoLogOff - - StartMenuLogOff - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some - server where shutdown is critical. In that scenario filter of machine and users - that can modify this registry is needed. -references: -- https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 -- https://malwiki.org/index.php?title=DigiPop.xp -- https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2 -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "NoLogOff" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_memory_crash_dump.yml b/dev/endpoint/windows_disable_memory_crash_dump.yml deleted file mode 100644 index eddabb9a92..0000000000 --- a/dev/endpoint/windows_disable_memory_crash_dump.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows Disable Memory Crash Dump -id: 59e54602-9680-11ec-a8a6-acde48001122 -version: 1 -date: '2022-02-25' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a process that is attempting to disable - the ability on Windows to generate a memory crash dump. This was recently identified - being utilized by HermeticWiper. To disable crash dumps, the value must be set to - 0. This feature is typically modified to perform a memory crash dump when a computer - stops unexpectedly because of a Stop error (also known as a blue screen, system - crash, or bug check). -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` - node. -known_false_positives: unknown -references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html -- https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options -tags: - analytic_story: - - Data Destruction - - Ransomware - - Hermetic Wiper - - Windows Registry Abuse - asset_type: Endpoint - confidence: 100 - impact: 90 - message: A process $process_name$ was identified attempting to disable memory crash - dumps on $dest$. - mitre_attack_id: - - T1485 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_notification_center.yml b/dev/endpoint/windows_disable_notification_center.yml deleted file mode 100644 index 1aff106f83..0000000000 --- a/dev/endpoint/windows_disable_notification_center.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Disable Notification Center -id: 1cd983c8-8fd6-11ec-a09d-acde48001122 -version: 1 -date: '2022-02-17' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following search identifies a modification of registry to disable - the windows notification center feature in a windows host machine. This registry - modification removes notification and action center from the notification area on - the task bar. This modification are seen in RAT malware to cover their tracks upon - downloading other of its component or other payload. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - Registry.registry_value_name: DisableNotificationCenter - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to disable this windows features. -references: -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 60 - message: The Windows notification center was disabled on $dest$ by $user$. - mitre_attack_id: - - T1112 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_shutdown_button_through_registry.yml b/dev/endpoint/windows_disable_shutdown_button_through_registry.yml deleted file mode 100644 index c07a64015d..0000000000 --- a/dev/endpoint/windows_disable_shutdown_button_through_registry.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Disable Shutdown Button Through Registry -id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - shutdown button on the logon user. This technique was seen in several malware especially - in ransomware family like killdisk malware variant to make the compromised host - un-useful and hard to remove other registry modification made on the machine that - needs restart to take effect. This windows feature may implement by administrator - in some server where shutdown is critical. In that scenario filter of machine and - users that can modify this registry is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon' - selection2: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose' - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: This windows feature may implement by administrator in some - server where shutdown is critical. In that scenario filter of machine and users - that can modify this registry is needed. -references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification in "shutdownwithoutlogon" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/dev/endpoint/windows_disable_windows_group_policy_features_through_registry.yml deleted file mode 100644 index 7a9ec14244..0000000000 --- a/dev/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows Disable Windows Group Policy Features Through Registry -id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to disable - windows features. These techniques are seen in several ransomware malware to impair - the compromised host to make it hard for analyst to mitigate or response from the - attack. Disabling these known features make the analysis and forensic response more - hard. Disabling these feature is not so common but can still be implemented by the - administrator for security purposes. In this scenario filters for users that are - allowed doing this is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - NoDesktop - - NoFind - - NoControlPanel - - NoFileMenu - - NoSetTaskbar - - NoTrayContextMenu - - TaskbarLockAll - - NoThemesTab - - NoPropertiesMyDocuments - - NoVisualStyleChoice - - NoColorChoice - - NoPropertiesMyDocuments - TargetObject: - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en -- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis -- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification to disable windows features on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_disableantispyware_registry.yml b/dev/endpoint/windows_disableantispyware_registry.yml deleted file mode 100644 index 6218452336..0000000000 --- a/dev/endpoint/windows_disableantispyware_registry.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows DisableAntiSpyware Registry -id: 23150a40-9301-4195-b802-5bb4f43067fb -version: 2 -date: '2021-03-02' -author: Rod Soto, Jose Hernandez, Michael Haag, Splunk -status: production -type: TTP -description: The search looks for the Registry Key DisableAntiSpyware set to disable. - This is consistent with Ryuk infections across a fleet of endpoints. This particular - behavior is typically executed when an ransomware actor gains access to an endpoint - and beings to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. Endpoint should be isolated. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - Registry.registry_value_name: DisableAntiSpyware - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -tags: - analytic_story: - - Ryuk Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Azorult - - CISA AA22-264A - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_diskcryptor_usage.yml b/dev/endpoint/windows_diskcryptor_usage.yml deleted file mode 100644 index 42ad231949..0000000000 --- a/dev/endpoint/windows_diskcryptor_usage.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows DiskCryptor Usage -id: d56fe0c8-4650-11ec-a8fa-acde48001122 -version: 1 -date: '2021-11-15' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies DiskCryptor process name of dcrypt.exe - or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt - disks manually during an operation. In addition, during install, a dcrypt.sys driver - is installed and requires a reboot in order to take effect. There are no command-line - arguments used. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: dcinst.exe - selection2: - Image|endswith: dcrypt.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: It is possible false positives may be present based on the - internal name dcinst.exe, filter as needed. It may be worthy to alert on the service - name. -references: -- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ -- https://github.com/DavidXanatos/DiskCryptor -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to encrypt disks. - mitre_attack_id: - - T1486 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_diskshadow_proxy_execution.yml b/dev/endpoint/windows_diskshadow_proxy_execution.yml deleted file mode 100644 index 8cb6eaa350..0000000000 --- a/dev/endpoint/windows_diskshadow_proxy_execution.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Diskshadow Proxy Execution -id: 58adae9e-8ea3-11ec-90f6-acde48001122 -version: 1 -date: '2022-02-15' -author: Lou Stella, Splunk -status: production -type: TTP -description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. - It has a scripting mode intended for complex scripted backup operations. This feature - also allows for execution of arbitrary unsigned code. This analytic looks for the - usage of the scripting mode flags in executions of DiskShadow. During triage, compare - to known backup behavior in your environment and then review the scripts called - by diskshadow. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: diskshadow.exe - selection2: - Image|endswith: diskshadow.exe - selection3: - CommandLine: - - '*-s*' - - '*/s*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on processes that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm - the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint - product. -known_false_positives: Administrators using the DiskShadow tool in their infrastructure - as a main backup tool with scripts will cause false positives that can be filtered - with `windows_diskshadow_proxy_execution_filter` -references: -- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Possible Signed Binary Proxy Execution on $dest$ - mitre_attack_id: - - T1218 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_dism_remove_defender.yml b/dev/endpoint/windows_dism_remove_defender.yml deleted file mode 100644 index 9ac9c1e439..0000000000 --- a/dev/endpoint/windows_dism_remove_defender.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Windows DISM Remove Defender -id: 8567da9e-47f0-11ec-99a9-acde48001122 -version: 1 -date: '2021-11-17' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of the Windows Disk Image Utility, - `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable - Defender before completing their objective. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: dism.exe - selection2: - CommandLine: '*/disable-feature*' - selection3: - CommandLine: '*/online*' - selection4: - CommandLine: '*Windows-Defender*' - selection5: - CommandLine: '*/remove*' - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Some legitimate administrative tools leverage `dism.exe` to - manipulate packages and features of the operating system. Filter as needed. -references: -- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to disable Windows Defender. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: access -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_dll_search_order_hijacking_hunt.yml b/dev/endpoint/windows_dll_search_order_hijacking_hunt.yml deleted file mode 100644 index d177f63d71..0000000000 --- a/dev/endpoint/windows_dll_search_order_hijacking_hunt.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows DLL Search Order Hijacking Hunt -id: 79c7d0fc-60c7-41be-a616-ccda752efe89 -version: 1 -date: '2022-08-18' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic is an experimental query built against - a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) - which maps the module load (ImageLoaded) to process_name. This analytic will deprecate - once this is fixed. This hunting analytic identifies known libraries in Windows - that may be used in a DLL search order hijack or DLL Sideloading setting. This may - require recompiling the DLL, moving the DLL or moving the vulnerable process. The - query looks for any running out of system32 or syswow64. Some libraries natively - run out of other application paths and will need to be added to the exclusion as - needed. The lookup is comprised of Microsoft native libraries identified within - the Hijacklibs.net project. -data_source: -- Sysmon Event ID 1 -search: - selection1: - User: unknown - Computer: unknown - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. This may only with with Sysmon data and the Sysmon TA. Your mileage - may vary. -known_false_positives: False positives will be present based on paths. Filter or add - other paths to the exclusion as needed. -references: -- https://hijacklibs.net -tags: - analytic_story: - - Living Off The Land - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 10 - impact: 10 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking. - mitre_attack_id: - - T1574.001 - - T1574 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 1 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/dev/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml deleted file mode 100644 index dd61616c75..0000000000 --- a/dev/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Windows DLL Search Order Hijacking with iscsicpl -id: f39ee679-3b1e-4f47-841c-5c3c580acda2 -version: 1 -date: '2022-07-29' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a recently disclosed search ordler - DLL hijack in iscsicpl.exe. The malicious DLL must be in a new path and iscsicpl.exe, - upon load, will execute the payload. The analytic is restricted to Windows shells. - Two proof of concepts were identified and utilized to determine the behavior. The - command-line is an option to go after, but most likely identifying a child process - off iscsicpl.exe will be more effective. Monitoring for suspicious DLL loads is - also an option. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: iscsicpl.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filtering may be required. - Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe. -references: -- https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -- https://github.com/422926799/csplugin/tree/master/bypassUAC -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to elevate access. - mitre_attack_id: - - T1574.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/dev/endpoint/windows_dll_side_loading_process_child_of_calc.yml deleted file mode 100644 index 7e358727fc..0000000000 --- a/dev/endpoint/windows_dll_side_loading_process_child_of_calc.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows DLL Side-Loading Process Child Of Calc -id: 295ca9ed-e97b-4520-90f7-dfb6469902e1 -version: 1 -date: '2022-10-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies the suspicious child process of calc.exe - due to dll side loading technique to execute another executable. This technique - was seen in qakbot malware that uses dll side loading technique to calc applications - to load its malicious dll code. The malicious dll that abuses dll side loading technique - will load the actual qakbot loader dll using regsvr32.exe application. This TTP - is a good indicator of qakbot since the calc.exe will not load other child processes - aside from win32calc.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: win32calc.exe - ParentImage: calc.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 90 - impact: 90 - message: calc.exe has a child process $process_name$ in $dest$ - mitre_attack_id: - - T1574.002 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/dev/endpoint/windows_execute_arbitrary_commands_with_msdt.yml deleted file mode 100644 index 0fb7cc701a..0000000000 --- a/dev/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Windows Execute Arbitrary Commands with MSDT -id: e1d5145f-38fe-42b9-a5d5-457796715f97 -version: 3 -date: '2022-06-29' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a recently disclosed arbitraty command - execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample - identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve - a remote payload. During triage, review file modifications for html. Identify parallel - process execution that may be related, including an Office Product. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*msdt*' - - '*ms-msdt:*' - - '*ms-msdt:/id*' - - '*ms-msdt:-id*' - - '*/id*' - Image|endswith: msdt.exe - selection2: - CommandLine: '*IT_BrowseForFile=' - selection3: - CommandLine: '*IT_RebrowseForFile=' - condition: selection1 and selection2 or selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter as needed. Added .xml - to potentially capture any answer file usage. Remove as needed. -references: -- https://isc.sans.edu/diary/rss/28694 -- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e -- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection -- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html -tags: - analytic_story: - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2022-30190 - impact: 100 - message: A parent process $parent_process_name$ has spawned a child process $process_name$ - on host $dest$ possibly indicative of indirect command execution. - mitre_attack_id: - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_file_without_extension_in_critical_folder.yml b/dev/endpoint/windows_file_without_extension_in_critical_folder.yml deleted file mode 100644 index 04fbd4cd19..0000000000 --- a/dev/endpoint/windows_file_without_extension_in_critical_folder.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows File Without Extension In Critical Folder -id: 0dbcac64-963c-11ec-bf04-acde48001122 -version: 1 -date: '2022-02-25' -author: Teoderick Contreras, Bhavin Patel, Splunk -status: production -type: TTP -description: This analytic is to look for suspicious file creation in the critical - folder like "System32\Drivers" folder without file extension. This artifacts was - seen in latest hermeticwiper where it drops its driver component in Driver Directory - both the compressed(without file extension) and the actual driver component (with - .sys file extension). This TTP is really a good indication that a host might be - compromised by this destructive malware that wipes the boot sector of the system. -data_source: -- Sysmon Event ID 11 -search: - selection1: - TargetFilename: - - '*\\System32\\drivers\\*' - - '*\\syswow64\\drivers\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: Unknown at this point -references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html -tags: - analytic_story: - - Data Destruction - - Hermetic Wiper - asset_type: Endpoint - confidence: 100 - impact: 90 - message: Driver file with out file extension drop in $file_path$ in $dest$ - mitre_attack_id: - - T1485 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_hide_notification_features_through_registry.yml b/dev/endpoint/windows_hide_notification_features_through_registry.yml deleted file mode 100644 index 4254416ae5..0000000000 --- a/dev/endpoint/windows_hide_notification_features_through_registry.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Hide Notification Features Through Registry -id: cafa4bce-9f06-11ec-a7b2-acde48001122 -version: 1 -date: '2022-03-08' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to detect a suspicious registry modification to hide - common windows notification feature from compromised host. This technique was seen - in some ransomware family to add more impact to its payload that are visually seen - by user aside from the encrypted files and ransomware notes. Even this a good anomaly - detection, administrator may implement this changes for auditing or security reason. - In this scenario filter is needed. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - HideClock - - HideSCAHealth - - HideSCANetwork - - HideSCAPower - - HideSCAVolume - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*' - Details: '0x00000001' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/ -tags: - analytic_story: - - Ransomware - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Registry modification to hide windows notification on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/dev/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml deleted file mode 100644 index 7d85516b02..0000000000 --- a/dev/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Impair Defense Delete Win Defender Context Menu -id: 395ed5fe-ad13-4366-9405-a228427bdd91 -version: 1 -date: '2022-06-07' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The search looks for the deletion of Windows Defender context menu within - the registry. This is consistent behavior with RAT malware across a fleet of endpoints. - This particular behavior is executed when an adversary gains access to an endpoint - and begins to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.action: deleted - TargetObject: '*\\shellex\\ContextMenuHandlers\\EPP' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Windows Defender context menu registry key deleted on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/dev/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml deleted file mode 100644 index 22962145ac..0000000000 --- a/dev/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Impair Defense Delete Win Defender Profile Registry -id: 65d4b105-ec52-48ec-ac46-289d0fbf7d96 -version: 1 -date: '2022-06-07' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The search looks for the deletion of Windows Defender main profile within - the registry. This was used by RAT malware across a fleet of endpoints. This particular - behavior is typically executed when an adversary gains access to an endpoint and - beings to perform execution. Usually, a batch (.bat) will be executed and multiple - registry and scheduled task modifications will occur. During triage, review parallel - processes and identify any further file modifications. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.action: deleted - TargetObject: '*\\Policies\\Microsoft\\Windows Defender' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 80 - message: Windows Defender Logger registry key set to 'disabled' on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/dev/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml deleted file mode 100644 index 53b8f9b82f..0000000000 --- a/dev/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Impair Defense Deny Security Software With Applocker -id: e0b6ca60-9e29-4450-b51a-bba0abae2313 -version: 1 -date: '2022-06-24' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a modification in the Windows registry - by the Applocker utility that contains details or registry data values related to - denying the execution of several security products. This technique was seen in Azorult - malware where it drops an xml Applocker policy that will deny several AV products - and then loaded by using PowerShell Applocker commandlet. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*' - selection2: - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*' - selection3: - Details: '*Action\=' - TargetObject: '*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*' - condition: (selection1 and selection2) or selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: False positives may be present based on organization use of - Applocker. Filter as needed. -references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -- https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11 -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 100 - impact: 100 - message: Applocker registry modification to deny the action of several AV products - on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/dev/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml deleted file mode 100644 index 7668d814f3..0000000000 --- a/dev/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Impair Defenses Disable Win Defender Auto Logging -id: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c -version: 1 -date: '2022-06-07' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger - set to disable. This is consistent with RAT malware across a fleet of endpoints. - This particular behavior is typically executed when an adversary gains access to - an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed - and multiple registry and scheduled task modifications will occur. During triage, - review parallel processes and identify any further file modifications. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: - - '*WMI\\Autologger\\DefenderAuditLogger\\Start' - - '*WMI\\Autologger\\DefenderApiLogger\\Start' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: It is unusual to turn this feature off a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/ -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - asset_type: Endpoint - confidence: 80 - impact: 30 - message: Windows Defender Logger registry key set to 'disabled' on $dest$. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 24 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_indirect_command_execution_via_forfiles.yml b/dev/endpoint/windows_indirect_command_execution_via_forfiles.yml deleted file mode 100644 index cad33e42ae..0000000000 --- a/dev/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Windows Indirect Command Execution Via forfiles -id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787 -version: 1 -date: '2022-04-05' -author: Eric McGinnis, Splunk -status: production -type: TTP -description: The following analytic detects programs that have been started by forfiles.exe. - According to Microsoft, the 'The forfiles command lets you run a command on or pass - arguments to multiple files'. While this tool can be used to start legitimate programs, - usually within the context of a batch script, it has been observed being used to - evade protections on command line execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*forfiles* /c *' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the full process path in the process field of CIM's Process data model. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Tune and filter known instances where forfiles.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly, - forfiles.exe may be used in legitimate batch scripts. Filter these results as needed. -references: -- https://twitter.com/KyleHanslovan/status/912659279806640128 -- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ - mitre_attack_id: - - T1202 - observable: - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_indirect_command_execution_via_pcalua.yml b/dev/endpoint/windows_indirect_command_execution_via_pcalua.yml deleted file mode 100644 index 0a88c6e008..0000000000 --- a/dev/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Windows Indirect Command Execution Via pcalua -id: 3428ac18-a410-4823-816c-ce697d26f7a8 -version: 1 -date: '2022-04-05' -author: Eric McGinnis, Splunk -status: production -type: TTP -description: The following analytic detects programs that have been started by pcalua.exe. - pcalua.exe is the Microsoft Windows Program Compatability Assistant. While this - tool can be used to start legitimate programs, it has been observed being used to - evade protections on command line execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentCommandLine: '*pcalua* -a*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the full process path in the process field of CIM's Process data model. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Tune and filter known instances where pcalua.exe may be used. -known_false_positives: Some legacy applications may be run using pcalua.exe. Filter - these results as needed. -references: -- https://twitter.com/KyleHanslovan/status/912659279806640128 -- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 50 - message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ - mitre_attack_id: - - T1202 - observable: - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_information_discovery_fsutil.yml b/dev/endpoint/windows_information_discovery_fsutil.yml deleted file mode 100644 index 6e3a85c9d3..0000000000 --- a/dev/endpoint/windows_information_discovery_fsutil.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Information Discovery Fsutil -id: 2181f261-93e6-4166-a5a9-47deac58feff -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS built-in - tool FSUTIL to discover file system information. This tool is being abused or used - by several adversaries or threat actor to query/list all drives, drive type, volume - information or volume statistics by using the FSINFO parameter of this tool. This - technique was seen in WINPEAS post exploitation tool that is being used by ransomware - prestige to gain privilege and persistence to the targeted host. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*fsinfo*' - OriginalFileName: fsutil.exe - selection2: - Image|endswith: fsutil.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process $process_name$ with commandline $process$ is executed in $dest$ - mitre_attack_id: - - T1082 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/dev/endpoint/windows_ingress_tool_transfer_using_explorer.yml deleted file mode 100644 index 23ea660351..0000000000 --- a/dev/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows Ingress Tool Transfer Using Explorer -id: 76753bab-f116-4ea3-8fb9-89b638be58a9 -version: 2 -date: '2022-08-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies the Windows Explorer process with a - URL within the command-line. Explorer.exe is known Windows process that handles - start menu, taskbar, desktop and file manager. Many adversaries abuse this process, - like DCRat malware, where it attempts to open the URL with the default browser application - on the target host by putting the URL as a parameter on explorer.exe process. This - anomaly detection might be a good pivot to check which user and how this process - was executed, what is the parent process and what is the URL link. This technique - is not commonly used to open an URL. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: explorer.exe - selection2: - Image|endswith: explorer.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on legitimate applications - or third party utilities. Filter out any additional parent process names. -references: -- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor -tags: - analytic_story: - - DarkCrystal RAT - asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a remote payload. - mitre_attack_id: - - T1105 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_installutil_in_non_standard_path.yml b/dev/endpoint/windows_installutil_in_non_standard_path.yml deleted file mode 100644 index fe88972aa0..0000000000 --- a/dev/endpoint/windows_installutil_in_non_standard_path.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Windows InstallUtil in Non Standard Path -id: dcf74b22-7933-11ec-857c-acde48001122 -version: 1 -date: '2022-01-19' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Windows binary InstallUtil.exe - running from a non-standard location. The analytic utilizes a macro for InstallUtil - and identifies both the process_name and original_file_name. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering may be required. - Certain utilities will run from non-standard paths based on the third-party application - in use. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml -- https://attack.mitre.org/techniques/T1036/003/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Masquerading - Rename System Utilities - - Unusual Processes - - Ransomware - - Signed Binary Proxy Execution InstallUtil - - WhisperGate - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard - path was identified on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1036 - - T1036.003 - - T1218 - - T1218.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_remote_network_connection.yml b/dev/endpoint/windows_installutil_remote_network_connection.yml deleted file mode 100644 index 70f10ed4a7..0000000000 --- a/dev/endpoint/windows_installutil_remote_network_connection.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Windows InstallUtil Remote Network Connection -id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 2 -date: '2022-03-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary - making a remote network connection. This technique may be used to download and execute - code while bypassing application control. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ generating a remote download. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_uninstall_option.yml b/dev/endpoint/windows_installutil_uninstall_option.yml deleted file mode 100644 index 051f1afc44..0000000000 --- a/dev/endpoint/windows_installutil_uninstall_option.yml +++ /dev/null @@ -1,89 +0,0 @@ -name: Windows InstallUtil Uninstall Option -id: cfa7b9ac-43f0-11ec-9b48-acde48001122 -version: 1 -date: '2021-11-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary. - This will execute code while bypassing application control using the `/u` (uninstall) - switch. - - InstallUtil uses the functions install and uninstall within the System.Configuration.Install - namespace to process .net assembly. Install function requires admin privileges, - however, uninstall function can be run as an unprivileged user. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - selection3: - CommandLine: - - '*/u*' - - '*uninstall*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present. Filter as needed - by parent process or application. -references: -- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 -- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ performing an uninstall. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_uninstall_option_with_network.yml b/dev/endpoint/windows_installutil_uninstall_option_with_network.yml deleted file mode 100644 index a98f9eae25..0000000000 --- a/dev/endpoint/windows_installutil_uninstall_option_with_network.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: Windows InstallUtil Uninstall Option with Network -id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 2 -date: '2022-03-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary - making a remote network connection. This technique may be used to download and execute - code while bypassing application control using the `/u` (uninstall) switch. - - InstallUtil uses the functions install and uninstall within the System.Configuration.Install - namespace to process .net assembly. Install function requires admin privileges, - however, uninstall function can be run as an unprivileged user. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - selection3: - CommandLine: - - '*/u*' - - '*uninstall*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -references: -- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 -- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ performing an uninstall. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_installutil_url_in_command_line.yml b/dev/endpoint/windows_installutil_url_in_command_line.yml deleted file mode 100644 index 2d60e59d71..0000000000 --- a/dev/endpoint/windows_installutil_url_in_command_line.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: Windows InstallUtil URL in Command Line -id: 28e06670-43df-11ec-a569-acde48001122 -version: 1 -date: '2021-11-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: 'The following analytic identifies the Windows InstallUtil.exe binary - passing a HTTP request on the command-line. This technique may be used to download - and execute code while bypassing application control. - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on - the filesystem is typically specified. Take note of the parent process. In a suspicious - instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` - or `Explorer.exe`. - - If used by a developer, typically this will be found with multiple command-line - switches/arguments and spawn from Visual Studio. - - During triage review resulting network connections, file modifications, and parallel - processes. Capture any artifacts and review further.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: InstallUtil.exe - selection2: - Image|endswith: installutil.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is - not typically used to download remote files. Filter as needed based on Developers - requirements. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md -- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d -tags: - analytic_story: - - Signed Binary Proxy Execution InstallUtil - - Living Off The Land - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ passing a URL on the command-line. - mitre_attack_id: - - T1218.004 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_iso_lnk_file_creation.yml b/dev/endpoint/windows_iso_lnk_file_creation.yml deleted file mode 100644 index bb72102d92..0000000000 --- a/dev/endpoint/windows_iso_lnk_file_creation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows ISO LNK File Creation -id: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32 -version: 2 -date: '2022-09-19' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies the use of a delivered ISO file that - has been mounted and the afformention lnk or file opened within it. When the ISO - file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the - ISO file is prepended. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: - - '*.iso.lnk' - - '*.img.lnk' - - '*.vhd.lnk' - - '*vhdx.lnk' - TargetFilename: '*\\Microsoft\\Windows\\Recent\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be high depending on the environment and - consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly - used ISO names. Filter as needed. -references: -- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -- https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1 -- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Spearphishing Attachments - - Brute Ratel C4 - - AgentTesla - - Qakbot - - IcedID - - Azorult - - Remcos - asset_type: Endpoint - confidence: 50 - impact: 80 - message: An ISO file was mounted on $dest$ and should be reviewed and filtered as - needed. - mitre_attack_id: - - T1566.001 - - T1566 - - T1204.001 - - T1204 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_java_spawning_shells.yml b/dev/endpoint/windows_java_spawning_shells.yml deleted file mode 100644 index 7ed05c1314..0000000000 --- a/dev/endpoint/windows_java_spawning_shells.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows Java Spawning Shells -id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 1 -date: '2021-12-13' -author: Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies the process name of java.exe and w3wp.exe - spawning a Windows shell. This is potentially indicative of exploitation of the - Java application and may be related to current event CVE-2021-44228 (Log4Shell). - The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review - parallel processes and command-line arguments to determine legitimacy. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - java.exe - - w3wp.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. Restrict the analytic to publicly facing endpoints to reduce false positives. - Add any additional identified web application process name to the query. Add any - further Windows process names to the macro (ex. LOLBins) to further expand this - query. -known_false_positives: Filtering may be required on internal developer build systems - or classify assets as web facing and restrict the analytic based on that. -references: -- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ -- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 -tags: - analytic_story: - - Log4Shell CVE-2021-44228 - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-44228 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation. - mitre_attack_id: - - T1190 - - T1133 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint diff --git a/dev/endpoint/windows_masquerading_explorer_as_child_process.yml b/dev/endpoint/windows_masquerading_explorer_as_child_process.yml deleted file mode 100644 index 598662430e..0000000000 --- a/dev/endpoint/windows_masquerading_explorer_as_child_process.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Masquerading Explorer As Child Process -id: 61490da9-52a1-4855-a0c5-28233c88c481 -version: 1 -date: '2022-10-20' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious parent process of explorer.exe. - Explorer is usually executed by userinit.exe that will exit after execution that - causes the main explorer.exe no parent process. Some malware like qakbot spawn another - explorer.exe to inject its code. This TTP detection is a good indicator that a process - spawning explorer.exe might inject code or masquerading its parent child process - to evade detections. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: explorer.exe - ParentImage: - - cmd.exe - - powershell.exe - - regsvr32.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 90 - impact: 90 - message: explorer.exe hash a suspicious parent process $parent_process_name$ in - $dest$ - mitre_attack_id: - - T1574.002 - - T1574 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 81 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_mimikatz_binary_execution.yml b/dev/endpoint/windows_mimikatz_binary_execution.yml deleted file mode 100644 index 07ccefde0a..0000000000 --- a/dev/endpoint/windows_mimikatz_binary_execution.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Windows Mimikatz Binary Execution -id: a9e0d6d3-9676-4e26-994d-4e0406bb4467 -version: 1 -date: '2022-11-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: As simple as it sounds, this analytic identifies when the native mimikatz.exe - binary executes on Windows. It does look for the original file name as well, just - in case the binary is renamed. Adversaries sometimes bring in the default binary - and run it directly. Benjamin Delpy originally created Mimikatz as a proof of concept - to show Microsoft that its authentication protocols were vulnerable to an attack. - Instead, he inadvertently created one of the most widely used and downloaded threat - actor tools of the past 20 years. Mimikatz is an open-source application that allows - users to view and save authentication credentials such as Kerberos tickets. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: mimikatz.exe - selection2: - Image|endswith: mimikatz.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as this is directly looking - for Mimikatz, the credential dumping utility. -references: -- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf -- https://www.varonis.com/blog/what-is-mimikatz -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -tags: - analytic_story: - - Credential Dumping - - CISA AA22-320A - - Volt Typhoon - asset_type: Endpoint - confidence: 100 - impact: 100 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting dump credentials. - mitre_attack_id: - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disable_toast_notifications.yml b/dev/endpoint/windows_modify_registry_disable_toast_notifications.yml deleted file mode 100644 index 5188442594..0000000000 --- a/dev/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Disable Toast Notifications -id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to disable toast notifications. This Windows Operating System feature is responsible - for alerting or notifying user if application or OS need some updates. Adversaries - and malwares like Azorult abuse this technique to disable important update notification - in compromised host. This anomaly detection is a good pivot to look for further - events related to defense evasion and execution. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for DisallowRun settings was modified to enable in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/dev/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml deleted file mode 100644 index 9056c4522a..0000000000 --- a/dev/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Disable Win Defender Raw Write Notif -id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b -version: 1 -date: '2022-06-23' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a modification in the Windows registry - to disable Windows Defender raw write notification feature. This policy controls - whether raw volume write notifications are sent to behavior monitoring or not. This - registry was recently identified in Azorult malware to bypass Windows Defender detections - or behavior monitoring in terms of volume write. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may - cause some false positive. Filter as needed. -references: -- https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The registry for raw write notification settings was modified to disable - in $dest$. - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/dev/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml deleted file mode 100644 index 5ee490f66a..0000000000 --- a/dev/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Modify Registry Disable Windows Security Center Notif -id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to disable windows center notifications. This Windows Operating System feature is - responsible for alerting or notifying user if application or OS need some updates. - Adversaries and malwares like Azorult abuse this technique to disable important - update notification in compromised host. This anomaly detection is a good pivot - to look for further events related to defense evasion and execution. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for security center notification settings was modified to - disable mode in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disabling_wer_settings.yml b/dev/endpoint/windows_modify_registry_disabling_wer_settings.yml deleted file mode 100644 index 0536e3687d..0000000000 --- a/dev/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Modify Registry Disabling WER Settings -id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a modification in the Windows registry - to disable Windows error reporting settings. This Windows feature allows the user - to report bugs, errors, failure or problems encountered in specific application - or processes. Adversaries use this technique to hide any error or failure that some - of its malicious components trigger. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may - cause some false positive, however is not common. Filter as needed. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for WER settings was modified to be disabled on $dest$. - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_disallow_windows_app.yml b/dev/endpoint/windows_modify_registry_disallow_windows_app.yml deleted file mode 100644 index 3ea6d17514..0000000000 --- a/dev/endpoint/windows_modify_registry_disallow_windows_app.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Modify Registry DisAllow Windows App -id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies modification in the Windows registry - to prevent user running specific computer programs that could aid them in manually - removing malware or detecting it using security products. This technique was recently - identified in Azorult malware where it uses this registry value to prevent several - AV products to execute on the compromised host machine. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators may enable or disable this feature that may - cause some false positive. Filter as needed. -references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: The registry for DisallowRun settings was modified to enable in $dest$. - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/dev/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml deleted file mode 100644 index 60d521f3e9..0000000000 --- a/dev/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Qakbot Binary Data Registry -id: 2e768497-04e0-4188-b800-70dd2be0e30d -version: 1 -date: '2022-11-10' -author: Teoderick Contreras, Bhavin Patel, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious registry entry created - by Qakbot malware as part of its malicious execution. This "Binary Data" Registry was - created by newly spawn explorer.exe where its malicious code is injected to it. - The registry consist of 8 random registry value name with encrypted binary data - on its registry value data. This anomaly detections can be a good pivot for possible - Qakbot malware infection or other malware that uses registry to save or store there - config or malicious code on the registry data stream. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: Binary Data - TargetObject: '*\\SOFTWARE\\Microsoft\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/ -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 70 - message: registry with binary data $registry_path$ created by $process_name$ in - $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_reg_restore.yml b/dev/endpoint/windows_modify_registry_reg_restore.yml deleted file mode 100644 index 63b91baca8..0000000000 --- a/dev/endpoint/windows_modify_registry_reg_restore.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows Modify Registry Reg Restore -id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e -version: 1 -date: '2022-12-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of reg.exe with - "restore" parameter. This reg.exe parameter is commonly used to restore registry - backup data in a targeted host. This approach or technique was also seen in post-exploitation - tool like winpeas where it uses "reg save" and "reg restore" to check the registry - modification restriction in targeted host after gaining access to it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* restore *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this command tool to backup registry - before updates or modifying critical registries. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ - mitre_attack_id: - - T1012 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/dev/endpoint/windows_modify_registry_suppress_win_defender_notif.yml deleted file mode 100644 index 47035483ce..0000000000 --- a/dev/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Modify Registry Suppress Win Defender Notif -id: e3b42daf-fff4-429d-bec8-2a199468cea9 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to suppress windows defender notification. This technique was abuse by adversaries - and threat actor to bypassed windows defender on the targeted host. Azorult malware - is one of the malware use this technique that also disable toast notification and - other windows features as part of its malicious behavior. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\Windows Defender\\UX Configuration\\Notification_Suppress*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for suppresing windows fdefender notification settings was - modified to disabled in $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/dev/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml deleted file mode 100644 index 736bb71bfb..0000000000 --- a/dev/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Modify Show Compress Color And Info Tip Registry -id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 1 -date: '2022-03-02' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to look for suspicious registry modification related - to file compression color and information tips. This IOC was seen in hermetic wiper - where it has a thread that will create this registry entry to change the color of - compressed or encrypted files in NTFS file system as well as the pop up information - tips. This is a good indicator that a process tries to modified one of the registry - GlobalFolderOptions related to file compression attribution in terms of color in - NTFS file system. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - ShowCompColor - - ShowInfoTip - TargetObject: '*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. -known_false_positives: unknown -references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html -tags: - analytic_story: - - Data Destruction - - Windows Defense Evasion Tactics - - Hermetic Wiper - - Windows Registry Abuse - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ - mitre_attack_id: - - T1112 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/dev/endpoint/windows_mof_event_triggered_execution_via_wmi.yml deleted file mode 100644 index afec810115..0000000000 --- a/dev/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Windows MOF Event Triggered Execution via WMI -id: e59b5a73-32bf-4467-a585-452c36ae10c1 -version: 1 -date: '2022-07-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following anaytic identifies MOFComp.exe loading a MOF file. The - Managed Object Format (MOF) compiler parses a file containing MOF statements and - adds the classes and class instances defined in the file to the WMI repository. - Typically, MOFComp.exe does not reach out to the public internet or load a MOF file - from User Profile paths. A filter and consumer is typically registered in WMI. Review - parallel processes and query WMI subscriptions to gather artifacts. The default - path of mofcomp.exe is C:\Windows\System32\wbem. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: mofcomp.exe - ParentImage: - - cmd.exe - - powershell.exe - selection2: - CommandLine: - - '*\\AppData\\Local\\*' - - '*\\Users\\Public\\*' - - '*\\WINDOWS\\Temp\\*' - Image|endswith: mofcomp.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present from automation based applications - (SCCM), filtering may be required. In addition, break the query out based on volume - of usage. Filter process names or f -references: -- https://attack.mitre.org/techniques/T1546/003/ -- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ -- https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp -- https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ -- https://www.sakshamdixit.com/wmi-events/ -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ loading a MOF file. - mitre_attack_id: - - T1546.003 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_mshta_execution_in_registry.yml b/dev/endpoint/windows_mshta_execution_in_registry.yml deleted file mode 100644 index 62ccbd455f..0000000000 --- a/dev/endpoint/windows_mshta_execution_in_registry.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Mshta Execution In Registry -id: e13ceade-b673-4d34-adc4-4d9c01729753 -version: 1 -date: '2022-10-14' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of mshta.exe Windows binary - in registry to execute malicious script. This technique was seen in kovter malware - where it create several registry entry which is a encoded javascript and will be - executed by another registry containing mshta and javascript activexobject to execute - the encoded script using wscript.shell. This TTP is a good indication of kovter - malware or other adversaries or threat actors leveraging fileless detection that - survive system reboot. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: - - '*mshta*' - - '*javascript:*' - - '*vbscript:*' - - '*WScript.Shell*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://redcanary.com/threat-detection-report/techniques/mshta/ -- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/fileless-threats?view=o365-worldwide -tags: - analytic_story: - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 90 - impact: 80 - message: a registry $registry_path$ contains mshta $registry_value_data$ in $dest$ - mitre_attack_id: - - T1218.005 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 72 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_dllregisterserver.yml b/dev/endpoint/windows_msiexec_dllregisterserver.yml deleted file mode 100644 index 24a8e13ed9..0000000000 --- a/dev/endpoint/windows_msiexec_dllregisterserver.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows MSIExec DLLRegisterServer -id: fdb59aef-d88f-4909-8369-ec2afbd2c398 -version: 1 -date: '2022-06-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of msiexec.exe using the - /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - selection3: - CommandLine: - - '*/y*' - - '*-y*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based - on legitimate usage of msiexec.exe. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to register a file. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_remote_download.yml b/dev/endpoint/windows_msiexec_remote_download.yml deleted file mode 100644 index 377014020b..0000000000 --- a/dev/endpoint/windows_msiexec_remote_download.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows MSIExec Remote Download -id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda -version: 1 -date: '2022-06-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies msiexec.exe with http in the command-line. - This procedure will utilize msiexec.exe to download a remote file and load it. During - triage, review parallel processes and capture any artifacts on disk for review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present, filter by destination or parent - process as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download a remote file. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_spawn_discovery_command.yml b/dev/endpoint/windows_msiexec_spawn_discovery_command.yml deleted file mode 100644 index 78a49b8d02..0000000000 --- a/dev/endpoint/windows_msiexec_spawn_discovery_command.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Windows MSIExec Spawn Discovery Command -id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee -version: 1 -date: '2022-06-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies MSIExec spawning multiple discovery - commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes - are not common from MSIExec other than MSIExec spawning itself. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - powershell.exe - - cmd.exe - - nltest.exe - - ipconfig.exe - - systeminfo.exe - ParentImage: msiexec.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present with MSIExec spawning Cmd or - PowerShell. Filtering will be needed. In addition, add other known discovery processes - to enhance query. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ running different discovery commands. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/dev/endpoint/windows_msiexec_unregister_dllregisterserver.yml deleted file mode 100644 index 0ae294c82a..0000000000 --- a/dev/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows MSIExec Unregister DLLRegisterServer -id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 -version: 1 -date: '2022-06-14' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the usage of msiexec.exe using the - /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. - Upon triage, review parent process and capture any artifacts for further review. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - selection3: - CommandLine: - - '*/z*' - - '*-z*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: This analytic will need to be tuned for your environment based - on legitimate usage of msiexec.exe. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to unregister a file. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_msiexec_with_network_connections.yml b/dev/endpoint/windows_msiexec_with_network_connections.yml deleted file mode 100644 index 07143a5831..0000000000 --- a/dev/endpoint/windows_msiexec_with_network_connections.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows MSIExec With Network Connections -id: 827409a1-5393-4d8d-8da4-bbb297c262a7 -version: 1 -date: '2022-06-16' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies MSIExec with any network connection - over port 443 or 80. Typically, MSIExec does not perform network communication to - the internet. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: msiexec.exe - selection2: - Image|endswith: msiexec.exe - condition: (selection1 or selection2) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. Add parent process as a filter, filter known good processes. This - may be voluminous due to the join on process_id. All_Traffic does not have process_guid, - yet. -known_false_positives: False positives will be present and filtering is required. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - confidence: 50 - impact: 70 - message: An instance of $process_name$ was identified on endpoint $dest$ contacting - a remote destination. - mitre_attack_id: - - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 35 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_ngrok_reverse_proxy_usage.yml b/dev/endpoint/windows_ngrok_reverse_proxy_usage.yml deleted file mode 100644 index 5ec8ee1485..0000000000 --- a/dev/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Windows Ngrok Reverse Proxy Usage -id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 1 -date: '2022-11-16' -author: Michael Haag, Splunk -status: production -type: Anomaly -description: The following analytic identifies the use of ngrok.exe being utilized - on the Windows operating system. Unfortunately, there is no original file name for - Ngrok, so it may be worth an additional hunt to identify any command-line arguments. - The sign of someone using Ngrok is not malicious, however, more recenctly it has - become an adversary tool. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*start*' - - '*--config*' - - '*http*' - - '*authtoken*' - - '*http*' - - (*tcp* - Image|endswith: ngrok.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present based on organizations that - allow the use of Ngrok. Filter or monitor as needed. -references: -- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf -tags: - analytic_story: - - Reverse Network Proxy - - CISA AA22-320A - asset_type: Endpoint - confidence: 100 - impact: 50 - message: A reverse proxy was identified spawning from $parent_process_name$ - $process_name$ - on endpoint $dest$ by user $user$. - mitre_attack_id: - - T1572 - - T1090 - - T1102 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 50 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_nirsoft_advancedrun.yml b/dev/endpoint/windows_nirsoft_advancedrun.yml deleted file mode 100644 index 9d9add0019..0000000000 --- a/dev/endpoint/windows_nirsoft_advancedrun.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Windows NirSoft AdvancedRun -id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 1 -date: '2022-01-21' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe - has similar capabilities as other remote programs like psexec. AdvancedRun may also - ingest a configuration file with all settings defined and perform its activity. - The analytic is written in a way to identify a renamed binary and also the common - command-line arguments. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: advancedrun.exe - selection2: - Image|endswith: advancedrun.exe - selection3: - CommandLine: - - '*EXEFilename*' - - '*/cfg*' - - '*RunAs*' - - '*WindowState*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as it is specific to AdvancedRun. - Filter as needed based on legitimate usage. -references: -- http://www.nirsoft.net/utils/advanced_run.html -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - Unusual Processes - - Ransomware - - WhisperGate - asset_type: Endpoint - confidence: 100 - impact: 60 - message: An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ - on $dest$ by $user$. - mitre_attack_id: - - T1588.002 - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 60 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_odbcconf_hunting.yml b/dev/endpoint/windows_odbcconf_hunting.yml deleted file mode 100644 index 347150579e..0000000000 --- a/dev/endpoint/windows_odbcconf_hunting.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows Odbcconf Hunting -id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 -version: 1 -date: '2022-06-30' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following analytic identifies Odbcconf.exe running in the environment - to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: odbcconf.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be present as this is meant to assist - with filtering and tuning. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 20 - impact: 30 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to circumvent controls. - mitre_attack_id: - - T1218.008 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 6 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_odbcconf_load_dll.yml b/dev/endpoint/windows_odbcconf_load_dll.yml deleted file mode 100644 index 640426438a..0000000000 --- a/dev/endpoint/windows_odbcconf_load_dll.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows Odbcconf Load DLL -id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b -version: 1 -date: '2022-06-28' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies odbcconf.exe, Windows Open Database - Connectivity utility, utilizing the action function of regsvr to load a DLL. An - example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, - review parent process, parallel procesess and file modifications. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*/a *' - - '*-a*' - Image|endswith: odbcconf.exe - selection2: - CommandLine: '*regsvr*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering may need to occur - based on legitimate application usage. Filter as needed. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to circumvent controls. - mitre_attack_id: - - T1218.008 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_odbcconf_load_response_file.yml b/dev/endpoint/windows_odbcconf_load_response_file.yml deleted file mode 100644 index 65ad99df02..0000000000 --- a/dev/endpoint/windows_odbcconf_load_response_file.yml +++ /dev/null @@ -1,73 +0,0 @@ -name: Windows Odbcconf Load Response File -id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 -version: 1 -date: '2022-06-30' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the odbcconf.exe, Windows Open Database - Connectivity utility, loading up a resource file. The file extension is arbitrary - and may be named anything. The resource file itself may have different commands - supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. - During triage, review file modifications and parallel processes. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-f *' - - '*/f *' - Image|endswith: odbcconf.exe - selection2: - CommandLine: '*.rsp*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering may need to occur - based on legitimate application usage. Filter as needed. -references: -- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html -- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 70 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to circumvent controls. - mitre_attack_id: - - T1218.008 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_office_product_spawning_msdt.yml b/dev/endpoint/windows_office_product_spawning_msdt.yml deleted file mode 100644 index 200ba04428..0000000000 --- a/dev/endpoint/windows_office_product_spawning_msdt.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Windows Office Product Spawning MSDT -id: 127eba64-c981-40bf-8589-1830638864a7 -version: 1 -date: '2022-05-30' -author: Michael Haag, Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a Microsoft Office product spawning - the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native - to Windows. This behavior is related to a recently identified sample utilizing protocol - handlers to evade preventative controls, including if macros are disabled in the - document. During triage, review file modifications for html. In addition, parallel - processes including PowerShell and CertUtil. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: msdt.exe - ParentImage: - - winword.exe - - excel.exe - - powerpnt.exe - - outlook.exe - - mspub.exe - - visio.exe - condition: selection1 -how_to_implement: how To successfully implement this search you need to be ingesting - information on process that include the name of the process responsible for the - changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: False positives should be limited, however filter as needed. -references: -- https://isc.sans.edu/diary/rss/28694 -- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e -- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A -- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ -- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection -- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html -tags: - analytic_story: - - Spearphishing Attachments - - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: Endpoint - confidence: 100 - cve: - - CVE-2022-30190 - impact: 100 - message: Office parent process $parent_process_name$ has spawned a child process - $process_name$ on host $dest$. - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 100 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_os_credential_dumping_security_manager_reg.yml b/dev/endpoint/windows_os_credential_dumping_security_manager_reg.yml deleted file mode 100644 index b817d0a08c..0000000000 --- a/dev/endpoint/windows_os_credential_dumping_security_manager_reg.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Windows OS Credential Dumping Security Account Manager Reg -id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 6 -date: '2021-09-16' -author: Patrick Bareiss, Splunk -type: TTP -status: production -description: Monitor for execution of reg.exe with parameters specifying an export - of keys that contain hashed credentials that attackers may try to crack offline. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cmd.exe - - reg.exe - CommandLine|contains: - - HKEY_LOCAL_MACHINE\\Security - - HKEY_LOCAL_MACHINE\\SAM - - HKEY_LOCAL_MACHINE\\System - - HKLM\\Security - - HKLM\\System - - HKLM\\SAM - selection2: - CommandLine|contains: save - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: None identified. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets -tags: - analytic_story: - - Credential Dumping - - DarkSide Ransomware - - Windows Registry Abuse - - Industroyer2 - asset_type: Endpoint - atomic_guid: - - 5c2571d0-1572-416d-9676-812e64ca9f44 - confidence: 100 - impact: 90 - drilldown_search: spl here - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to export the registry keys. - mitre_attack_id: - - T1003.002 - - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - - Splunk Behavioral Analytics - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file diff --git a/dev/endpoint/windows_password_managers_discovery.yml b/dev/endpoint/windows_password_managers_discovery.yml deleted file mode 100644 index bb2123caf4..0000000000 --- a/dev/endpoint/windows_password_managers_discovery.yml +++ /dev/null @@ -1,75 +0,0 @@ -name: Windows Password Managers Discovery -id: a3b3bc96-1c4f-4eba-8218-027cac739a48 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process command line that retrieves - information related to password manager software. This technique was seen in several - post exploitation tools like winpeas that are being used by Ransomware Prestige - to gather this type of information. Password Managers applications are designed - to store user credentials, normally in an encrypted database. Credentials are typically - accessible after a user provides a master password that unlocks the database. After - the database is unlocked, these credentials may be copied to memory. These databases - can be stored as files on disk. Due to this password manager software designed adversaries - may find or look for keywords related to the Password Manager databases that can - be stolen or extracted for further attacks. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*dir *' - selection2: - CommandLine: - - '*.kdbx*' - - '*credential*' - - '*key3.db*' - - '*pass*' - - '*cred*' - - '*key4.db*' - - '*accessTokens*' - - '*access_tokens*' - - '*.htpasswd*' - - '*Ntds.dit*' - selection3: - CommandLine: '*findstr*' - condition: selection1 or selection2 or selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1555/005/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a process with commandline $process$ that can retrieve information related - to password manager databases in $dest$ - mitre_attack_id: - - T1555.005 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_phishing_recent_iso_exec_registry.yml b/dev/endpoint/windows_phishing_recent_iso_exec_registry.yml deleted file mode 100644 index 40887ce100..0000000000 --- a/dev/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Windows Phishing Recent ISO Exec Registry -id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c -version: 2 -date: '2022-09-19' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following hunting analytic identifies registry artifacts when an - ISO container is opened, clicked or mounted on the Windows operating system. As - Microsoft makes changes to macro based document execution, adversaries have begun - to utilize container based initial access based phishing campaigns to evade preventative - controls. Once the ISO is clicked or mounted it will create a registry artifact - related to this event as a recent application executed or opened. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_key_name: - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso' - - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be high depending on the environment and - consistent use of ISOs. Restrict to servers, or filter out based on commonly used - ISO names. Filter as needed. -references: -- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ -- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 -- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html -tags: - analytic_story: - - Brute Ratel C4 - - AgentTesla - - Qakbot - - IcedID - - Azorult - - Remcos - asset_type: Endpoint - confidence: 80 - impact: 50 - message: An ISO file was mounted on $dest$ and should be reviewed and filtered as - needed. - mitre_attack_id: - - T1566.001 - - T1566 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 40 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_private_keys_discovery.yml b/dev/endpoint/windows_private_keys_discovery.yml deleted file mode 100644 index f48ccb725c..0000000000 --- a/dev/endpoint/windows_private_keys_discovery.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Windows Private Keys Discovery -id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line that retrieves - information related to private keys files. This technique was seen in several post - exploitation tools like winpeas that are being used by Ransomware Prestige to search - for private key certificates on the compromised host for insecurely stored credentials. - This files can be used by adversaries to gain privileges, persistence or remote - service authentication to collect more sensitive information. Some private keys - required password for operation, so in this case adversaries may need to have that - passphrase either via keylogging or brute force attack. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*dir *' - selection2: - CommandLine: - - '*.rdg*' - - '*.gpg*' - - '*.pgp*' - - '*.p12*' - - '*.der*' - - '*.csr*' - - '*.cer*' - - '*.ovpn*' - - '*.key*' - - '*.ppk*' - - '*.p12*' - - '*.pem*' - - '*.pfx*' - - '*.p7b*' - - '*.asc*' - selection3: - CommandLine: '*findstr*' - condition: selection1 or selection2 or selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1552/004/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 50 - impact: 50 - message: a process with commandline $process$ that can retrieve information related - to private keys in $dest$ - mitre_attack_id: - - T1552.004 - - T1552 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_process_injection_wermgr_child_process.yml b/dev/endpoint/windows_process_injection_wermgr_child_process.yml deleted file mode 100644 index a99ad3ead3..0000000000 --- a/dev/endpoint/windows_process_injection_wermgr_child_process.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Process Injection Wermgr Child Process -id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17 -version: 1 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a suspicious wermgr.exe parent process - having a child process not related to error, fault or windows werfault event. This - technique was seen in Qakbot malware where it inject its malicious code in wermgr - to evade detections and hide from the analyst to execute its recon and its malicious - behavior. This Anomaly detection can be a good pivot to start investigating a possible - qakbot infection in the network. The Wermgr.exe process is not known to have other - child processes aside from itself or werfault.exe -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: wermgr.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 70 - impact: 80 - message: wermgr parent process has a child process $process_name$ in $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_process_with_namedpipe_commandline.yml b/dev/endpoint/windows_process_with_namedpipe_commandline.yml deleted file mode 100644 index a73b10ce94..0000000000 --- a/dev/endpoint/windows_process_with_namedpipe_commandline.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows Process With NamedPipe CommandLine -id: e64399d4-94a8-11ec-a9da-acde48001122 -version: 1 -date: '2022-02-23' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic is to look for process commandline that contains named - pipe. This technique was seen in some adversaries, threat actor and malware like - olympic destroyer to communicate to its other child processes after process injection - that serve as defense evasion and privilege escalation. On the other hand this analytic - may catch some normal process that using this technique for example browser application. - In that scenario we include common process path we've seen during testing that cause - false positive which is the program files. False positive may still be arise if - the normal application is in other folder path. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*\\\\.\\pipe\\*' - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Normal browser application may use this technique. Please update - the filter macros to remove false positives. -references: -- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 70 - impact: 70 - message: Process with named pipe in $process$ on $dest$ - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_protocol_tunneling_with_plink.yml b/dev/endpoint/windows_protocol_tunneling_with_plink.yml deleted file mode 100644 index 6b781bfc77..0000000000 --- a/dev/endpoint/windows_protocol_tunneling_with_plink.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Windows Protocol Tunneling with Plink -id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed -version: 1 -date: '2022-09-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of Plink being utilized to - proxy egress or laterally in an organization. The analytic is limited to specific - Plink options on the command-line, including -R -L and -D which will have the remote - and local IP address or port and -l for a username. Modify the options as seen fit - for your organization. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*-R *' - - '*-L *' - - '*-D *' - - '*-l *' - OriginalFileName: Plink - selection2: - Image|endswith: plink.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present if the organization allows for - SSH tunneling outbound or internally. Filter as needed. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html -- https://attack.mitre.org/techniques/T1572/ -- https://documentation.help/PuTTY/using-cmdline-portfwd.html#S3.8.3.5 -tags: - analytic_story: - - CISA AA22-257A - asset_type: Endpoint - confidence: 80 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination. - mitre_attack_id: - - T1572 - - T1021.004 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 56 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_query_registry_reg_save.yml b/dev/endpoint/windows_query_registry_reg_save.yml deleted file mode 100644 index c44eee4ac6..0000000000 --- a/dev/endpoint/windows_query_registry_reg_save.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Query Registry Reg Save -id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 -version: 1 -date: '2022-12-12' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of reg.exe with - "save" parameter. This reg.exe parameter is commonly being abused by threat actors, - adversaries and red-teamers to dump credentials or to check the registry modification - capabilities of certain users or administrators in targeted hosts. This approach - was seen in post-exploitation tool like winpeas where it uses "reg save" and "reg - restore" to check registry modification restriction in targeted host after gaining - access to it. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* save *' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this command tool to backup registry - before updates or modifying critical registries. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ - mitre_attack_id: - - T1012 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_raccine_scheduled_task_deletion.yml b/dev/endpoint/windows_raccine_scheduled_task_deletion.yml deleted file mode 100644 index 73557d09de..0000000000 --- a/dev/endpoint/windows_raccine_scheduled_task_deletion.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Raccine Scheduled Task Deletion -id: c9f010da-57ab-11ec-82bd-acde48001122 -version: 1 -date: '2021-12-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Raccine Rules Updater scheduled - task being deleted. Adversaries may attempt to remove this task in order to prevent - the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher - Florian Roth, designed to intercept and prevent precursors and active ransomware - behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*delete*' - Image|endswith: schtasks.exe - selection2: - CommandLine: '*Raccine*' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, however filter as needed. -references: -- https://redcanary.com/blog/blackbyte-ransomware/ -- https://github.com/Neo23x0/Raccine -tags: - analytic_story: - - Ransomware - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. - mitre_attack_id: - - T1562.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_rasautou_dll_execution.yml b/dev/endpoint/windows_rasautou_dll_execution.yml deleted file mode 100644 index 54924e2566..0000000000 --- a/dev/endpoint/windows_rasautou_dll_execution.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Rasautou DLL Execution -id: 6f42b8be-8e96-11ec-ad5a-acde48001122 -version: 1 -date: '2022-02-15' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the Windows Windows Remote Auto Dialer, - rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary - shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review - parent and child process behavior including file and image loads. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* -d *' - Image|endswith: rasautou.exe - selection2: - CommandLine: '* -p *' - condition: selection1 and selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be limited to applications that require - Rasautou.exe to load a DLL from disk. Filter as needed. -references: -- https://github.com/mandiant/DueDLLigence -- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1 -- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 -- https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode -tags: - analytic_story: - - Windows Defense Evasion Tactics - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ attempting to load a DLL in a suspicious manner. - mitre_attack_id: - - T1055.001 - - T1218 - - T1055 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_registry_certificate_added.yml b/dev/endpoint/windows_registry_certificate_added.yml deleted file mode 100644 index 9224370dd1..0000000000 --- a/dev/endpoint/windows_registry_certificate_added.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows Registry Certificate Added -id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 -version: 1 -date: '2022-03-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies installation of a root CA certificate - by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). - In short, there are specific certificate registry paths that will be written to - (SetValue) when a new certificate is added. The high-fidelity events to pay attention - to are SetValue events where the TargetObject property ends with "\Blob" - as this indicates the direct installation or modification of a root certificate - binary blob. The other high fidelity reference will be which process is making the - registry modifications. There are very few processes that modify these day to day, - therefore monitoring for all to start (hunting) provides a great beginning. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: Blob - TargetObject: '*\\certificates\\*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. -known_false_positives: False positives will be limited to a legitimate business applicating - consistently adding new root certificates to the endpoint. Filter by user, process, - or thumbprint. -references: -- https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec -- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004 -tags: - analytic_story: - - Windows Drivers - - Windows Registry Abuse - asset_type: Endpoint - confidence: 70 - impact: 60 - message: A root certificate was added on $dest$. - mitre_attack_id: - - T1553.004 - - T1553 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_registry_delete_task_sd.yml b/dev/endpoint/windows_registry_delete_task_sd.yml deleted file mode 100644 index f8278f66f4..0000000000 --- a/dev/endpoint/windows_registry_delete_task_sd.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows Registry Delete Task SD -id: ffeb7893-ff06-446f-815b-33ca73224e92 -version: 1 -date: '2022-04-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a process attempting to delete a scheduled - task SD (Security Descriptor) from within the registry path of that task. This may - occur from a non-standard process running and may not come from reg.exe. This particular - behavior will remove the actual Task Name from the Task Scheduler GUI and from the - command-line query - schtasks.exe /query. In addition, in order to perform this - action, the user context will need to be SYSTEM. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.user: SYSTEM - TargetObject: '*\\Schedule\\TaskCache\\Tree\\*' - Registry.registry_value_name: SD - Registry.action: - - modified - - Deleted - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as the activity is not common - to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified - or Deleted values based on product that is in the datamodel. -references: -- https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ -- https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728 -- https://gist.github.com/MHaggis/b246e2fae6213e762a6e694cabaf0c17 -tags: - analytic_story: - - Windows Registry Abuse - - Windows Persistence Techniques - asset_type: Endpoint - confidence: 70 - impact: 70 - message: A scheduled task security descriptor was deleted from the registry on $dest$. - mitre_attack_id: - - T1053.005 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/dev/endpoint/windows_registry_modification_for_safe_mode_persistence.yml deleted file mode 100644 index 935eb4eab9..0000000000 --- a/dev/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Windows Registry Modification for Safe Mode Persistence -id: c6149154-c9d8-11eb-9da7-acde48001122 -version: 3 -date: '2022-03-31' -author: Teoderick Contreras, Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies a modification or registry add to the - safeboot registry as an autostart mechanism. This technique is utilized by adversaries - to persist a driver or service into Safe Mode. Two keys are monitored in this analytic, Minimal - and Network. adding values to Minimal will load into Safe Mode and by adding into - Network it will provide the service or drive the ability to perform network connections - in Safe Mode. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: - - '*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*' - - '*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*' - condition: selection1 -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: updated windows application needed in safe boot may used this - registry -references: -- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365 -- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md -- https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ -tags: - analytic_story: - - Ransomware - - Windows Registry Abuse - - Windows Drivers - asset_type: Endpoint - confidence: 70 - impact: 60 - message: Safeboot registry $registry_path$ was added or modified with a new value - $registry_value_name$ on $dest$ - mitre_attack_id: - - T1547.001 - - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 42 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_regsvr32_renamed_binary.yml b/dev/endpoint/windows_regsvr32_renamed_binary.yml deleted file mode 100644 index c17a84a3a9..0000000000 --- a/dev/endpoint/windows_regsvr32_renamed_binary.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Windows Regsvr32 Renamed Binary -id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a -version: 1 -date: '2022-10-27' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following hunting analytic identifies renamed instances of regsv32.exe - executing. regsv32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. - During investigation, validate if it is the legitimate regsv32.exe executing and - what dll module content it is loading. This query relies on the original filename - or internal name from the PE meta data. Expand the query as needed by looking for - specific command line arguments outlined in other analytics. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: regsvr32.exe - Image|endswith: regsvr32.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: unknown -references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 80 - impact: 80 - message: regsvr32 was renamed as $process_name$ in $dest$ - mitre_attack_id: - - T1218.010 - - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_3/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_access_software_hunt.yml b/dev/endpoint/windows_remote_access_software_hunt.yml deleted file mode 100644 index 02ee149fa4..0000000000 --- a/dev/endpoint/windows_remote_access_software_hunt.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows Remote Access Software Hunt -id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a -version: 1 -date: '2022-08-22' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic is meant to help organizations understand - what remote access software is being used in the environment. When reviewing this - hunt, confirm the software identified is authorized to be utilized. Based on fidelity, - create a new analytic for specific utilities banned within the organization. Adversaries - use these utilities to retain remote access capabilities to the environment. Utilities - in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review - the lookup for the entire list and add any others. -data_source: -- Sysmon Event ID 1 -search: - selection1: - User: unknown - Computer: unknown - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be found. Filter as needed and create - higher fidelity analytics based off banned remote access software. -references: -- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md -- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ -tags: - analytic_story: - - Insider Threat - - Command And Control - - Ransomware - asset_type: Endpoint - confidence: 10 - impact: 10 - message: The following Remote Access Software $process_name$ was identified on $dest$. - mitre_attack_id: - - T1219 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 1 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_access_software_rms_registry.yml b/dev/endpoint/windows_remote_access_software_rms_registry.yml deleted file mode 100644 index fda7cfa581..0000000000 --- a/dev/endpoint/windows_remote_access_software_rms_registry.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Windows Remote Access Software RMS Registry -id: e5b7b5a9-e471-4be8-8c5d-4083983ba329 -version: 1 -date: '2022-06-22' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to identify a modification or creation of Windows - registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is - a legitimate tool developed by russian organization TektonIT and has been observed - being abused by adversaries to gain remote access to the targeted host. Azorult - malware utilized RMS to gain remote access. -data_source: -- Sysmon Event ID 13 -search: - selection1: - TargetObject: '*\\SYSTEM\\Remote Manipulator System*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -- https://malpedia.caad.fkie.fraunhofer.de/details/win.rms -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 90 - impact: 100 - message: the registry related to RMS tool is created in $dest$ - mitre_attack_id: - - T1219 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_assistance_spawning_process.yml b/dev/endpoint/windows_remote_assistance_spawning_process.yml deleted file mode 100644 index 05d8176244..0000000000 --- a/dev/endpoint/windows_remote_assistance_spawning_process.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows Remote Assistance Spawning Process -id: ced50492-8849-11ec-9f68-acde48001122 -version: 1 -date: '2022-02-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the use of Microsoft Remote Assistance, - msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default - has no command-line arguments and typically spawns itself. It will generate a network - connection to the remote system that is connected. This behavior is indicative of - another process injected into msra.exe. Review the parent process or cross process - events to identify source. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: msra.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, filter as needed. Add additional - shells as needed. -references: -- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$, generating behavior not common with msra.exe. - mitre_attack_id: - - T1055 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_remote_services_allow_remote_assistance.yml b/dev/endpoint/windows_remote_services_allow_remote_assistance.yml deleted file mode 100644 index f009b59cd7..0000000000 --- a/dev/endpoint/windows_remote_services_allow_remote_assistance.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Remote Services Allow Remote Assistance -id: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb -version: 1 -date: '2022-06-21' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic is to identify a modification in the Windows registry - to enable remote desktop assistance on a targeted machine. This technique was seen - in several adversaries, malware or red teamer like azorult to remotely access the - compromised or targeted host by enabling this protocol in registry. Even this protocol - might be allowed in some production environment, This Anomaly behavior is a good - pivot to check who and why the user want to enable this feature through registry - which is un-common. And as per stated in microsoft documentation the default value - of this registry is false that makes this a good indicator of suspicious behavior. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - TargetObject: '*\\Control\\Terminal Server\\fAllowToGetHelp*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for rdp protocol was modified to enable in $dest$ - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_remote_services_rdp_enable.yml b/dev/endpoint/windows_remote_services_rdp_enable.yml deleted file mode 100644 index 71e8e1ce51..0000000000 --- a/dev/endpoint/windows_remote_services_rdp_enable.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Remote Services Rdp Enable -id: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0 -version: 1 -date: '2022-06-21' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic is to identify a modification in the Windows registry - to enable remote desktop protocol on a targeted machine. This technique was seen - in several adversaries, malware or red teamer to remotely access the compromised - or targeted host by enabling this protocol in registry. Even this protocol might - be allowed in some production environment, This TTP behavior is a good pivot to - check who and why the user want to enable this feature through registry which is - un-common. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000000' - TargetObject: '*\\Control\\Terminal Server\\fDenyTSConnections*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may - cause some false positive. -references: -- https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100 -tags: - analytic_story: - - Azorult - asset_type: Endpoint - confidence: 70 - impact: 70 - message: the registry for rdp protocol was modified to enable in $dest$ - mitre_attack_id: - - T1021.001 - - T1021 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_schtasks_create_run_as_system.yml b/dev/endpoint/windows_schtasks_create_run_as_system.yml deleted file mode 100644 index 7f3a346c77..0000000000 --- a/dev/endpoint/windows_schtasks_create_run_as_system.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Windows Schtasks Create Run As System -id: 41a0e58e-884c-11ec-9976-acde48001122 -version: 1 -date: '2022-02-07' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies Schtasks.exe creating a new task to - start and run as an elevated user - SYSTEM. This is commonly used by adversaries - to spawn a process in an elevated state. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: schtasks.exe - selection2: - Image|endswith: schtasks.exe - selection3: - CommandLine: '*/create *' - selection4: - CommandLine: '*/ru *' - selection5: - CommandLine: '*system*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives will be limited to legitimate applications - creating a task to run as SYSTEM. Filter as needed based on parent process, or modify - the query to have world writeable paths to restrict it. -references: -- https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/ -- https://www.ired.team/offensive-security/persistence/t1053-schtask -- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ -tags: - analytic_story: - - Windows Persistence Techniques - - Qakbot - asset_type: Endpoint - confidence: 60 - impact: 80 - message: An $process_name$ was created on endpoint $dest$ attempting to spawn as - SYSTEM. - mitre_attack_id: - - T1053.005 - - T1053 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_security_support_provider_reg_query.yml b/dev/endpoint/windows_security_support_provider_reg_query.yml deleted file mode 100644 index e25716b3e7..0000000000 --- a/dev/endpoint/windows_security_support_provider_reg_query.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows Security Support Provider Reg Query -id: 31302468-93c9-4eca-9ae3-2d41f53a4e2b -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a process command line related to the - discovery of possible Security Support Providers in the registry. This technique - is being abused by adversaries or post exploitation tools like winpeas to gather - LSA protection and configuration in the registry in the targeted host. This registry - entry can contain several information related to LSA that validates users for local - and remote sign-ins and enforces local security policies. Understanding LSA protection - may give a good information in accessing LSA content in memory which is commonly - attack by adversaries and tool like mimikatz to scrape password hashes or clear - plain text passwords. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: reg.exe - selection2: - Image|endswith: reg.exe - selection3: - CommandLine: '* query *' - selection4: - CommandLine: - - '*RunAsPPL*' - - '*LsaCfgFlags*' - selection5: - CommandLine: '*\\SYSTEM\\CurrentControlSet\\Control\\LSA*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process with reg query command line $process$ in $dest$ - mitre_attack_id: - - T1547.005 - - T1547 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_service_create_kernel_mode_driver.yml b/dev/endpoint/windows_service_create_kernel_mode_driver.yml deleted file mode 100644 index 002322709e..0000000000 --- a/dev/endpoint/windows_service_create_kernel_mode_driver.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Service Create Kernel Mode Driver -id: 0b4e3b06-1b2b-4885-b752-cf06d12a90cb -version: 1 -date: '2022-05-05' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifes a new kernel driver being added to Windows - using sc.exe. Adding a Kernel driver is not common day to day and should be investigated - to further understand the source. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*kernel*' - Image|endswith: sc.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present based on common applications - adding new drivers, however, filter as needed. -references: -- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ -tags: - analytic_story: - - Windows Drivers - - CISA AA22-320A - asset_type: Endpoint - confidence: 80 - impact: 60 - message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ - by $user$. - mitre_attack_id: - - T1543.003 - - T1543 - - T1068 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 48 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sc_kernel.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_service_creation_on_remote_endpoint.yml b/dev/endpoint/windows_service_creation_on_remote_endpoint.yml deleted file mode 100644 index c4b6edaeef..0000000000 --- a/dev/endpoint/windows_service_creation_on_remote_endpoint.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows Service Creation on Remote Endpoint -id: e0eea4fa-4274-11ec-882b-3e22fbd008af -version: 1 -date: '2021-11-10' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `sc.exe` with command-line arguments - utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries - alike may abuse the Service Control Manager for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: sc.exe - selection2: - Image|endswith: sc.exe - selection3: - CommandLine: '*create*' - selection4: - CommandLine: '*\\\\*' - selection5: - CommandLine: '*binpath*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may create Windows Services on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager -- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Service was created on a remote endpoint from $dest - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_service_creation_using_registry_entry.yml b/dev/endpoint/windows_service_creation_using_registry_entry.yml deleted file mode 100644 index f522ee10fc..0000000000 --- a/dev/endpoint/windows_service_creation_using_registry_entry.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Service Creation Using Registry Entry -id: 25212358-948e-11ec-ad47-acde48001122 -version: 1 -date: '2022-02-23' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic is to look for suspicious modification or creation of registry - to have service entry. This technique is abused by adversaries or threat actor to - persist, gain privileges in the machine or even lateral movement. This technique - can be executed using reg.exe application or using windows API like for example - the CrashOveride malware. This detection is a good indicator that a process is trying - to create a service entry using registry ImagePath. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: ImagePath - TargetObject: '*\\SYSTEM\\CurrentControlSet\\Services*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Third party tools may used this technique to create services - but not so common. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md -tags: - analytic_story: - - Active Directory Lateral Movement - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - - Windows Registry Abuse - - Brute Ratel C4 - asset_type: Endpoint - confidence: 80 - impact: 80 - message: A Windows Service was created on a endpoint from $dest$ - mitre_attack_id: - - T1574.011 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_service_deletion_in_registry.yml b/dev/endpoint/windows_service_deletion_in_registry.yml deleted file mode 100644 index 8e39fa666a..0000000000 --- a/dev/endpoint/windows_service_deletion_in_registry.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Windows Service Deletion In Registry -id: daed6823-b51c-4843-a6ad-169708f1323e -version: 1 -date: '2022-08-24' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies a service being deleted from the Windows - Registry under CurrentControlSet\Services. Adversaries may delete a service as part - of defense evasion. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Details: '0x00000001' - Registry.registry_value_name: DeleteFlag - Registry.action: - - modified - - deleted - TargetObject: '*\\SYSTEM\\CurrentControlSet\\Services*' - condition: ((selection1)) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: This event can be seen when administrator delete a service - or uninstall/reinstall a software that creates service entry, but it is still recommended - to check this alert with high priority. -references: -- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - confidence: 30 - impact: 60 - message: A service was deleted on $dest$ within the Windows registry. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 18 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_service_initiation_on_remote_endpoint.yml b/dev/endpoint/windows_service_initiation_on_remote_endpoint.yml deleted file mode 100644 index c78d34d96a..0000000000 --- a/dev/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows Service Initiation on Remote Endpoint -id: 3f519894-4276-11ec-ab02-3e22fbd008af -version: 1 -date: '2021-11-10' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: This analytic looks for the execution of `sc.exe` with command-line arguments - utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries - alike may abuse the Service Control Manager for lateral movement and remote code - execution. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: sc.exe - selection2: - Image|endswith: sc.exe - selection3: - CommandLine: '*start*' - selection4: - CommandLine: '*\\\\*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Administrators may start Windows Services on remote systems, - but this activity is usually limited to a small set of hosts or users. -references: -- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc -- https://attack.mitre.org/techniques/T1543/003/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: A Windows Service was started on a remote endpoint from $dest - mitre_attack_id: - - T1543 - - T1543.003 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/windows_service_stop_via_net__and_sc_application.yml b/dev/endpoint/windows_service_stop_via_net__and_sc_application.yml deleted file mode 100644 index c7be7829f6..0000000000 --- a/dev/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Service Stop Via Net and SC Application -id: 827af04b-0d08-479b-9b84-b7d4644e4b80 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: This analytic identifies suspicious attempts to stop services on a system - using either `net.exe` or `sc.exe`. This technique is used by adversaries to terminate - security services or other related services to continue their objective and evade - detections. This technique is also commonly used by ransomware threat actors to - successfully encrypt databases or files being processed or used by Windows OS Services. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: net.exe - selection2: - Image|endswith: net.exe - selection3: - Image|endswith: net1.exe - selection4: - OriginalFileName: net1.exe - selection5: - Image|endswith: sc.exe - selection6: - CommandLine: '*stop*' - OriginalFileName: sc.exe - condition: (selection1 or selection2 or selection3 or selection4) or selection5 - or selection6 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Windows OS or software may stop and restart services due to - some critical update. -references: -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Prestige Ransomware - asset_type: Endpoint - confidence: 70 - impact: 70 - message: $process$ was executed on $dest$ attempting to stop service. - mitre_attack_id: - - T1489 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/dev/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml deleted file mode 100644 index 9a511149f3..0000000000 --- a/dev/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Windows Steal or Forge Kerberos Tickets Klist -id: 09d88404-1e29-46cb-806c-1eedbc85ad5d -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS klist.exe - tool. This tool is being abused or used by several post exploitation tool such as - winpeas that being used by ransomware prestige to display or gather list of currently - cached kerberos ticket. This cahced data can be used for lateral movement or even - privilege escalation on the targeted host. This hunting query can be a good pivot - in possible kerberos attack or pass the hash technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: - - cmd.exe - - powershell* - OriginalFileName: klist.exe - selection2: - Image|endswith: klist.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process klist.exe executed in $dest$ - mitre_attack_id: - - T1558 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dev/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml deleted file mode 100644 index f0ca8ca4a5..0000000000 --- a/dev/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows System Binary Proxy Execution Compiled HTML File Decompile -id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d -version: 1 -date: '2022-08-31' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the decompile parameter with the HTML - Help application, HH.exe. This is a uncommon command to see ran and behavior. Most - recently this was seen in a APT41 campaign where a CHM file was delivered and a - script inside used a technique for running an arbitrary command in a CHM file via - an ActiveX object. This unpacks an HTML help file to a specified path for launching - the next stage. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: HH.EXE - selection2: - Image|endswith: hh.exe - selection3: - CommandLine: '*-decompile*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, filter as needed. -references: -- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ -- https://redcanary.com/blog/introducing-atomictestharnesses/ -- https://attack.mitre.org/techniques/T1218/001/ -- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa -tags: - analytic_story: - - Suspicious Compiled HTML Activity - - Living Off The Land - asset_type: Endpoint - confidence: 90 - impact: 100 - message: $process_name$ has been identified using decompile against a CHM on $dest$ - under user $user$. - mitre_attack_id: - - T1218.001 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 90 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/dev/endpoint/windows_system_discovery_using_ldap_nslookup.yml deleted file mode 100644 index 3f2e7acc6b..0000000000 --- a/dev/endpoint/windows_system_discovery_using_ldap_nslookup.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows System Discovery Using ldap Nslookup -id: 2418780f-7c3e-4c45-b8b4-996ea850cd49 -version: 1 -date: '2022-10-21' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of nslookup.exe tool - to get domain information. Nslookup.exe is a command-line tool that can display - information to diagnose domain name systems. This Nslookup feature is being abused - by Qakbot malware to gather domain information such as SRV service location records, - server name and many more. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: nslookup.exe - selection2: - Image|endswith: nslookup.exe - selection3: - CommandLine: '*_ldap._tcp.dc._msdcs*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: dministrator may execute this commandline tool for auditing - purposes. Filter as needed. -references: -- https://securelist.com/qakbot-technical-analysis/103931/ -- https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/verify-srv-dns-records-have-been-created -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 50 - message: System nslookup domain discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_discovery_using_qwinsta.yml b/dev/endpoint/windows_system_discovery_using_qwinsta.yml deleted file mode 100644 index e44d8fe6f3..0000000000 --- a/dev/endpoint/windows_system_discovery_using_qwinsta.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Windows System Discovery Using Qwinsta -id: 2e765c1b-144a-49f0-93d0-1df4287cca04 -version: 1 -date: '2022-10-21' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of qwinsta.exe executable - in Windows Operating System. This Windows executable file can display information - about sessions on a remote desktop session host server. The information includes - servername, sessionname, username and many more. This tool is being abused of Qakbot - malware to gather information to the targeted or compromised host that will be send - back to its Command And Control server. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: qwinsta.exe - selection2: - Image|endswith: qwinsta.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Administrator may execute this commandline tool for auditing - purposes. Filter as needed. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/qwinsta -- https://securelist.com/qakbot-technical-analysis/103931/ -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 50 - message: System qwinsta domain discovery on $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_file_on_disk.yml b/dev/endpoint/windows_system_file_on_disk.yml deleted file mode 100644 index f1bc450da3..0000000000 --- a/dev/endpoint/windows_system_file_on_disk.yml +++ /dev/null @@ -1,55 +0,0 @@ -name: Windows System File on Disk -id: 993ce99d-9cdd-42c7-a2cf-733d5954e5a6 -version: 2 -date: '2022-05-16' -author: Michael Haag, Splunk -status: production -type: Hunting -description: The following hunting analytic will assist with identifying new .sys - files introduced in the environment. This query is meant to identify sys file creates - on disk. There will be noise, but reducing common process names or applications - should help to limit any volume. The idea is to identify new sys files written to - disk and identify them before they're added as a new kernel mode driver. -data_source: -- Sysmon Event ID 11 -search: - selection1: - Filesystem.file_name: '*.sys*' - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. - In addition, confirm the latest CIM App 4.20 or higher is installed and the latest - TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path - IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). - This will level out the noise generated to potentally lead to generating notables. -known_false_positives: False positives will be present. Filter as needed. -references: -- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ -tags: - analytic_story: - - Windows Drivers - - CISA AA22-264A - asset_type: Endpoint - confidence: 50 - impact: 20 - message: A new driver is present on $dest$. - mitre_attack_id: - - T1068 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 10 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_network_config_discovery_display_dns.yml b/dev/endpoint/windows_system_network_config_discovery_display_dns.yml deleted file mode 100644 index 22c07667ed..0000000000 --- a/dev/endpoint/windows_system_network_config_discovery_display_dns.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Windows System Network Config Discovery Display DNS -id: e24f0a0e-41a9-419f-9999-eacab15efc36 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process command line that retrieves - dns reply information using Windows OS built-in tool IPConfig. This technique is - being abused by threat actors, adversaries and post exploitation tools like WINPEAS - to retrieve DNS information for the targeted host. This IPConfig parameter (/displaydns) - can show dns server resource record, record name, record type, time to live data - length and dns reply. This hunting detection can be a good pivot to check which - process is executing this command line in specific host system that may lead to - malware or adversaries gathering network information. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*/displaydns*' - OriginalFileName: ipconfig.exe - selection2: - Image|endswith: ipconfig.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: unknown -references: -- https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: process $process_name$ with commandline $process$ is executed in $dest$ - mitre_attack_id: - - T1016 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_network_connections_discovery_netsh.yml b/dev/endpoint/windows_system_network_connections_discovery_netsh.yml deleted file mode 100644 index 25ca26a428..0000000000 --- a/dev/endpoint/windows_system_network_connections_discovery_netsh.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Windows System Network Connections Discovery Netsh -id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS built-in - tool netsh.exe to show state, configuration and profile of host firewall. This tool - is being used or abused by several adversaries or even post exploitation tool to - bypass firewall rules or to discover firewall settings. This hunting detection can - help to detect a possible suspicious usage of netsh.exe to retrieve firewall settings - or even firewall wlan profile. We recommend checking which parent process and process - name execute this command. Also check the process file path for verification that - may lead to further TTP's threat behavior. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: netsh.exe - selection2: - Image|endswith: netsh.exe - selection3: - CommandLine: - - '*state*' - - '*config*' - - '*wlan*' - - '*profile*' - selection4: - CommandLine: '* show *' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this tool for auditing process. -references: -- https://attack.mitre.org/techniques/T1049/ -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: netsh process with command line $process$ in $dest$ - mitre_attack_id: - - T1049 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/dev/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml deleted file mode 100644 index 7bdbfcdcb8..0000000000 --- a/dev/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Windows System Script Proxy Execution Syncappvpublishingserver -id: 8dd73f89-682d-444c-8b41-8e679966ad3c -version: 1 -date: '2022-09-26' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies the abuse of Syncappvpublishingserver.vbs, - which is a native script on Windows that may be utilized to download remote files - or perform privilege escalation. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*syncappvpublishingserver.vbs*' - Image|endswith: - - wscript.exe - - cscript.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present if the vbscript syncappvpublishingserver - is used for legitimate purposes. Filter as needed. Adding a n; to the command-line - arguments may help reduce any noise. -references: -- https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution -tags: - analytic_story: - - Living Off The Land - asset_type: Endpoint - confidence: 50 - impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to download files or evade critical - controls. - mitre_attack_id: - - T1216 - - T1218 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 30 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_system_user_discovery_via_quser.yml b/dev/endpoint/windows_system_user_discovery_via_quser.yml deleted file mode 100644 index 4ec18a59a8..0000000000 --- a/dev/endpoint/windows_system_user_discovery_via_quser.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Windows System User Discovery Via Quser -id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic identifies a process execution of Windows OS quser.exe - tool. This tool is being abused or used by several post exploitation tool such as - winpeas that being used by ransomware prestige to display or gather information - about user sessions on a Remote Desktop Session Host server. This command can find - out if a specific user is logged on to a specific Remote Desktop Session Host server. - This tool can retrieve some RDP information that can be use by attacker for further - attack like Name of the user , Name of the session on the Remote Desktop Session - Host server, Session ID, State of the session (active or disconnected), Idle time - (the number of minutes since the last keystroke or mouse movement at the session) - and Date and time the user logged on. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: quser.exe - selection2: - Image|endswith: quser.exe - condition: selection1 or selection2 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: network administrator can use this command tool to audit RDP - access of user in specific network or host. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ - mitre_attack_id: - - T1033 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 9 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_wmi_process_and_service_list.yml b/dev/endpoint/windows_wmi_process_and_service_list.yml deleted file mode 100644 index 526919dcb1..0000000000 --- a/dev/endpoint/windows_wmi_process_and_service_list.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Windows WMI Process And Service List -id: ef3c5ef2-3f6d-4087-aa75-49bf746dc907 -version: 1 -date: '2022-11-30' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies suspicious process command line, where - WMI is performing an event query looking for running processes or running services. - This technique is commonly found where the adversary will identify services and - system information on the compromised machine. During triage, review parallel processes - within the same timeframe. Review the full script block to identify other related - artifacts. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: - - '*process list*' - - '*service list*' - condition: (selection1 or selection2) and selection3 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -known_false_positives: netowrk administrator or IT may execute this command for auditing - processes and services. -references: -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - confidence: 20 - impact: 20 - message: wmi command $process$ to list processes and services in $dest$ - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 4 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true diff --git a/dev/endpoint/windows_wmi_process_call_create.yml b/dev/endpoint/windows_wmi_process_call_create.yml deleted file mode 100644 index cd9d38c459..0000000000 --- a/dev/endpoint/windows_wmi_process_call_create.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Windows WMI Process Call Create -id: 0661c2de-93de-11ec-9833-acde48001122 -version: 1 -date: '2022-02-22' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic is to look for wmi commandlines to execute or create process. - This technique was used by adversaries or threat actor to execute their malicious - payload in local or remote host. This hunting query is a good pivot to start to - look further which process trigger the wmi or what process it execute locally or - remotely. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '* process *' - selection4: - CommandLine: '* call *' - selection5: - CommandLine: '* create *' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators may execute this command for testing or auditing. -references: -- https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml -- https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md -tags: - analytic_story: - - Suspicious WMI Use - - Qakbot - asset_type: Endpoint - confidence: 50 - impact: 50 - message: process with $process$ commandline executed in $dest$ - mitre_attack_id: - - T1047 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winhlp32_spawning_a_process.yml b/dev/endpoint/winhlp32_spawning_a_process.yml deleted file mode 100644 index 75abe361eb..0000000000 --- a/dev/endpoint/winhlp32_spawning_a_process.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Winhlp32 Spawning a Process -id: d17dae9e-2618-11ec-b9f5-acde48001122 -version: 1 -date: '2021-10-05' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, - spawning a child process that loads a file out of appdata, programdata, or temp. - Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added - to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the - ".hlp" file name extension. This particular instance is related to a Remcos sample - where dynwrapx.dll is added to the registry under inprocserver32, and later module - loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During - triage, review parallel processes to identify further suspicious behavior. Review - module loads for unsuspecting unsigned modules. Capture any file modifications and - analyze. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: - - '*\\appdata\\*' - - '*\\programdata\\*' - - '*\\temp\\*' - ParentImage: winhlp32.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited as winhlp32.exe is typically - not used with the latest flavors of Windows OS. However, filter as needed. -references: -- https://www.exploit-db.com/exploits/16541 -- https://tria.ge/210929-ap75vsddan -- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 -tags: - analytic_story: - - Remcos - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$, and is not typical activity for this process. - mitre_attack_id: - - T1055 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winrm_spawning_a_process.yml b/dev/endpoint/winrm_spawning_a_process.yml deleted file mode 100644 index a8cf2f42de..0000000000 --- a/dev/endpoint/winrm_spawning_a_process.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: WinRM Spawning a Process -id: a081836a-ba4d-11eb-8593-acde48001122 -version: 1 -date: '2021-05-21' -author: Drew Church, Michael Haag, Splunk -status: experimental -type: TTP -description: The following analytic identifies suspicious processes spawning from - WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166. - which is a kernel-mode device driver http.sys vulnerability. Current proof of concept - code will blue-screen the operating system. However, http.sys used by many different - Windows processes, including WinRM. In this case, identifying suspicious process - create (child processes) from `wsmprovhost.exe` is what this analytic is identifying. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cmd.exe - - sh.exe - - bash.exe - - powershell.exe - - pwsh.exe - - schtasks.exe - - certutil.exe - - whoami.exe - - bitsadmin.exe - - scp.exe - ParentImage: wsmprovhost.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Unknown. Add new processes or filter as needed. It is possible - system management software may spawn processes from `wsmprovhost.exe`. -references: -- https://github.com/SigmaHQ/sigma/blob/9b7fb0c0f3af2e53ed483e29e0d0f88ccf1c08ca/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml -- https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys -- https://github.com/0vercl0k/CVE-2021-31166/blob/main/cve-2021-31166.py -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - confidence: 50 - cve: - - CVE-2021-31166 - impact: 50 - message: tbd - mitre_attack_id: - - T1190 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint diff --git a/dev/endpoint/winword_spawning_cmd.yml b/dev/endpoint/winword_spawning_cmd.yml deleted file mode 100644 index 493a5faaa4..0000000000 --- a/dev/endpoint/winword_spawning_cmd.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Winword Spawning Cmd -id: 6fcbaedc-a37b-11eb-956b-acde48001122 -version: 2 -date: '2021-04-22' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Word spawning `cmd.exe`. - Typically, this is not common behavior and not default with winword.exe. Winword.exe - will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` - (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line will indicate what is - being executed. During triage, review parallel processes and identify any files - that may have been written. It is possible that COM is utilized to trampoline the - child process to `explorer.exe` or `wmiprvse.exe`. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: winword.exe - selection2: - OriginalFileName: Cmd.Exe - selection3: - Image|endswith: cmd.exe - condition: selection1 and selection2 and selection3 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ -tags: - analytic_story: - - Spearphishing Attachments - - DarkCrystal RAT - asset_type: Endpoint - confidence: 100 - impact: 70 - message: '$parent_process_name$ on $dest$ by $user$ launched command: $process_name$ - which is very common in spearphishing attacks.' - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winword_spawning_powershell.yml b/dev/endpoint/winword_spawning_powershell.yml deleted file mode 100644 index 2abaf88ed2..0000000000 --- a/dev/endpoint/winword_spawning_powershell.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Winword Spawning PowerShell -id: b2c950b8-9be2-11eb-8658-acde48001122 -version: 2 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Word spawning PowerShell. - Typically, this is not common behavior and not default with winword.exe. Winword.exe - will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` - (version will vary). PowerShell spawning from winword.exe is common for a spearphishing - attachment and is actively used. Albeit, the command executed will most likely be - encoded and captured via another detection. During triage, review parallel processes - and identify any files that may have been written. -data_source: -- Sysmon Event ID 1 -search: - selection1: - ParentImage: winword.exe - selection2: - OriginalFileName: pwsh.dll - selection3: - Image|endswith: - - pwsh.exe - - sqlps.exe - - sqltoolsps.exe - - powershell.exe - - powershell_ise.exe - selection4: - OriginalFileName: PowerShell.EXE - selection5: - OriginalFileName: powershell_ise.EXE - condition: selection1 and selection2 and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives should be limited, but if any are present, - filter as needed. -references: -- https://redcanary.com/threat-detection-report/techniques/powershell/ -- https://attack.mitre.org/techniques/T1566/001/ -- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ -- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/ -tags: - analytic_story: - - Spearphishing Attachments - - DarkCrystal RAT - asset_type: Endpoint - confidence: 100 - impact: 70 - message: '$parent_process_name$ on $dest$ by $user$ launched the following powershell - process: $process_name$ which is very common in spearphishing attacks' - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/winword_spawning_windows_script_host.yml b/dev/endpoint/winword_spawning_windows_script_host.yml deleted file mode 100644 index 034cfc6932..0000000000 --- a/dev/endpoint/winword_spawning_windows_script_host.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Winword Spawning Windows Script Host -id: 637e1b5c-9be1-11eb-9c32-acde48001122 -version: 1 -date: '2021-04-12' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following detection identifies Microsoft Winword.exe spawning Windows - Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior - and not default with Winword.exe. Winword.exe will generally be found in the following - path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` - or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. - `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing - attachment and is actively used. Albeit, the command-line executed will most likely - be obfuscated and captured via another detection. During triage, review parallel - processes and identify any files that may have been written. Review the reputation - of the remote destination and block accordingly. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - cscript.exe - - wscript.exe - ParentImage: winword.exe - condition: selection1 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: There will be limited false positives and it will be different - for every environment. Tune by child process or command-line as needed. -references: -- https://attack.mitre.org/techniques/T1566/001/ -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - confidence: 100 - impact: 70 - message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe - mitre_attack_id: - - T1566 - - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 70 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmic_group_discovery.yml b/dev/endpoint/wmic_group_discovery.yml deleted file mode 100644 index 088e595d4b..0000000000 --- a/dev/endpoint/wmic_group_discovery.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Wmic Group Discovery -id: 83317b08-155b-11ec-8e00-acde48001122 -version: 1 -date: '2021-09-14' -author: Michael Haag, Splunk -status: production -type: Hunting -description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating - local groups on the endpoint. - - Typically, by itself, is not malicious but may raise suspicion based on time of - day, endpoint and username. - - During triage, review parallel processes and identify any further suspicious behavior.' -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '*group get name*' - Image|endswith: wmic.exe - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local group discovery on $dest$ by $user$. - mitre_attack_id: - - T1069 - - T1069.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmic_noninteractive_app_uninstallation.yml b/dev/endpoint/wmic_noninteractive_app_uninstallation.yml deleted file mode 100644 index ca4f52c35e..0000000000 --- a/dev/endpoint/wmic_noninteractive_app_uninstallation.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Wmic NonInteractive App Uninstallation -id: bff0e7a0-317f-11ec-ab4e-acde48001122 -version: 2 -date: '2022-07-19' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: This analytic indentifies WMIC command-line attempting to uninstall application - non-interactively. This technique was seen in IcedID to uninstall AV products on - the compromised host to evade detection. This Hunting query maybe a good indicator - that some process tries to uninstall application using wmic which is not a common - behavior. This approach may seen in some script or third part appication to uninstall - their application but it is a good thing to check what it uninstall and why. -data_source: -- Sysmon Event ID 1 -search: - selection1: - CommandLine: '* product *' - Image|endswith: wmic.exe - selection2: - CommandLine: '*where name*' - selection3: - CommandLine: '*call uninstall*' - selection4: - CommandLine: '*/nointeractive*' - condition: selection1 and selection2 and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Third party application may use this approach to uninstall - applications. -references: -- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ -tags: - analytic_story: - - IcedID - - Azorult - asset_type: Endpoint - confidence: 50 - impact: 50 - message: Wmic $process_name$ with command-line $process$ on $dest$ attempting to - uninstall software. - mitre_attack_id: - - T1562.001 - - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 25 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmic_xsl_execution_via_url.yml b/dev/endpoint/wmic_xsl_execution_via_url.yml deleted file mode 100644 index b8bcedbe15..0000000000 --- a/dev/endpoint/wmic_xsl_execution_via_url.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: WMIC XSL Execution via URL -id: 787e9dd0-4328-11ec-a029-acde48001122 -version: 1 -date: '2021-11-11' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible - Stylesheet Language) script. This originally was identified by Casey Smith, dubbed - Squiblytwo, as an application control bypass. Many adversaries will utilize this - technique to invoke JScript or VBScript within an XSL file. This technique can also - execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, - leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows - Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying - a suspicious execution, review for confirmed network connnection and script download. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: - - '*http://*' - - '*https://*' - selection4: - CommandLine: '*/format:*' - condition: (selection1 or selection2) and selection3 and selection4 -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives are limited as legitimate applications typically - do not download files or xsl using WMIC. Filter as needed. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md -- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file -tags: - analytic_story: - - Suspicious WMI Use - asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. - mitre_attack_id: - - T1220 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 80 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wmiprsve_lolbas_execution_process_spawn.yml b/dev/endpoint/wmiprsve_lolbas_execution_process_spawn.yml deleted file mode 100644 index 7a45818116..0000000000 --- a/dev/endpoint/wmiprsve_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,111 +0,0 @@ -name: Wmiprsve LOLBAS Execution Process Spawn -id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af -version: 1 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution - process. When adversaries execute code on remote endpoints abusing Windows Management - Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. - The LOLBAS project documents Windows native binaries that can be abused by threat - actors to perform tasks like executing malicious code. Looking for child processes - of wmiprvse.exe that are part of the LOLBAS project can help defenders identify - lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: wmiprvse.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1047/ -- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement -- https://lolbas-project.github.io/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Wmiprsve.exe spawned a LOLBAS process on $dest$. - mitre_attack_id: - - T1047 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wscript_or_cscript_suspicious_child_process.yml b/dev/endpoint/wscript_or_cscript_suspicious_child_process.yml deleted file mode 100644 index 8657786e76..0000000000 --- a/dev/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Wscript Or Cscript Suspicious Child Process -id: 1f35e1da-267b-11ec-90a9-acde48001122 -version: 1 -date: '2021-10-06' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This analytic identifies a suspicious spawned process by WScript or CScript - process. This technique was a common technique used by adversaries and malware to - execute different LOLBIN, other scripts like PowerShell or spawn a suspended process - to inject its code as a defense evasion. This TTP may detect some normal script - that using several application tool that are in the list of the child process it - detects but a good pivot and indicator that a script is may execute suspicious code. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - regsvr32.exe - - rundll32.exe - - winhlp32.exe - - certutil.exe - - msbuild.exe - - cmd.exe - - powershell* - - wmic.exe - - mshta.exe - ParentImage: - - cscript.exe - - wscript.exe - condition: selection1 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Administrators may create vbs or js script that use several - tool as part of its execution. Filter as needed. -references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -tags: - analytic_story: - - FIN7 - - Remcos - - Unusual Processes - - WhisperGate - asset_type: Endpoint - confidence: 70 - impact: 70 - message: wscript or cscript parent process spawned $process_name$ in $dest$ - mitre_attack_id: - - T1055 - - T1543 - - T1134.004 - - T1134 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/dev/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml deleted file mode 100644 index 81a3fc51d2..0000000000 --- a/dev/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml +++ /dev/null @@ -1,112 +0,0 @@ -name: Wsmprovhost LOLBAS Execution Process Spawn -id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af -version: 1 -date: '2021-11-22' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS - execution process. When adversaries execute code on remote endpoints abusing the - Windows Remote Management (WinRm) protocol, the executed command is spawned as a - child processs of `Wsmprovhost.exe`. The LOLBAS project documents Windows native - binaries that can be abused by threat actors to perform tasks like executing malicious - code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS - project can help defenders identify lateral movement activity. -data_source: -- Sysmon Event ID 1 -search: - selection1: - Image|endswith: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe - ParentImage: wsmprovhost.exe - condition: (selection1) -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. -known_false_positives: Legitimate applications may trigger this behavior, filter as - needed. -references: -- https://attack.mitre.org/techniques/T1021/006/ -- https://lolbas-project.github.io/ -- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ -tags: - analytic_story: - - Active Directory Lateral Movement - asset_type: Endpoint - confidence: 60 - impact: 90 - message: Wsmprovhost.exe spawned a LOLBAS process on $dest$. - mitre_attack_id: - - T1021 - - T1021.006 - observable: - - name: dest - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 54 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/wsreset_uac_bypass.yml b/dev/endpoint/wsreset_uac_bypass.yml deleted file mode 100644 index 1d03e9a4d9..0000000000 --- a/dev/endpoint/wsreset_uac_bypass.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: WSReset UAC Bypass -id: 8b5901bc-da63-11eb-be43-acde48001122 -version: 2 -date: '2020-01-28' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious modification of registry related - to UAC bypass. This technique is to modify the registry in this detection, create - a registry value with the path of the payload and run WSreset.exe to bypass User - account Control. -data_source: -- Sysmon Event ID 13 -search: - selection1: - Registry.registry_value_name: - - DelegateExecute - - (Default) - TargetObject: '*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*' - condition: (selection1) -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure - that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: unknown -references: -- https://github.com/hfiref0x/UACME -- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass -tags: - analytic_story: - - Windows Defense Evasion Tactics - - Living Off The Land - - Windows Registry Abuse - asset_type: Endpoint - confidence: 90 - impact: 70 - message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ - mitre_attack_id: - - T1548.002 - - T1548 - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 63 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/dev/endpoint/xsl_script_execution_with_wmic.yml b/dev/endpoint/xsl_script_execution_with_wmic.yml deleted file mode 100644 index bfb7c5b194..0000000000 --- a/dev/endpoint/xsl_script_execution_with_wmic.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: XSL Script Execution With WMIC -id: 004e32e2-146d-11ec-a83f-acde48001122 -version: 1 -date: '2021-09-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: This search is to detect a suspicious wmic.exe process or renamed wmic - process to execute malicious xsl file. This technique was seen in FIN7 to execute - its malicous jscript using the .xsl as the loader with the help of wmic.exe process. - This TTP is really a good indicator for you to hunt further for FIN7 or other attacker - that known to used this technique. -data_source: -- Sysmon Event ID 1 -search: - selection1: - OriginalFileName: wmic.exe - selection2: - Image|endswith: wmic.exe - selection3: - CommandLine: '*os get*' - selection4: - CommandLine: '*/format:*' - selection5: - CommandLine: '*.xsl*' - condition: (selection1 or selection2) and selection3 and selection4 and selection5 -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file -tags: - analytic_story: - - FIN7 - - Suspicious WMI Use - asset_type: Endpoint - confidence: 70 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script. - mitre_attack_id: - - T1220 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog