tag more content

detections/endpoint/excessive_usage_of_cacls_app.yml

@@ -1,7 +1,7 @@
 name: Excessive Usage Of Cacls App
 id: 0bdf6092-af17-11eb-939a-acde48001122
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-12-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -30,6 +30,7 @@ tags:
   - Azorult
   - Windows Post-Exploitation
   - Prestige Ransomware
+  - Defense Evasion or Unauthorized Access Via SDDL Tampering
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/icacls_deny_command.yml

@@ -1,7 +1,7 @@
 name: Icacls Deny Command
 id: cf8d753e-a8fe-11eb-8f58-acde48001122
-version: '4'
-date: '2024-11-28'
+version: 5
+date: '2024-12-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -56,6 +56,7 @@ tags:
   - Sandworm Tools
   - XMRig
   - Compromised Windows Host
+  - Defense Evasion or Unauthorized Access Via SDDL Tampering
   asset_type: Endpoint
   confidence: 80
   impact: 90

detections/endpoint/icacls_grant_command.yml

@@ -1,7 +1,7 @@
 name: ICACLS Grant Command
 id: b1b1e316-accc-11eb-a9b4-acde48001122
-version: 3
-date: '2024-09-30'
+version: 4
+date: '2024-12-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - XMRig
   - Ransomware
+  - Defense Evasion or Unauthorized Access Via SDDL Tampering
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/modify_acl_permission_to_files_or_folder.yml

@@ -1,7 +1,7 @@
 name: Modify ACL permission To Files Or Folder
 id: 7e8458cc-acca-11eb-9e3f-acde48001122
-version: 4
-date: '2024-09-30'
+version: 5
+date: '2024-12-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -27,6 +27,7 @@ drilldown_searches:
 tags:
   analytic_story:
   - XMRig
+  - Defense Evasion or Unauthorized Access Via SDDL Tampering
   asset_type: Endpoint
   confidence: 80
   impact: 40

detections/endpoint/new_custom_security_descriptor_set_on_eventlog_channel.yml

@@ -8,7 +8,7 @@ type: Anomaly
 description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs.
 data_source:
 - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" AND Registry.registry_value_name=CustomSD BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_custom_security_descriptor_set_on_eventlog_channel_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" AND Registry.registry_value_name=CustomSD BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_custom_security_descriptor_set_on_eventlog_channel_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: None identified, setting up the "CustomSD" value is considered a legacy option and shouldn't be a common activity.
 references:

detections/endpoint/new_eventlog_channelaccess_registry_value_set.yml

@@ -8,7 +8,7 @@ type: Anomaly
 description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs.
 data_source:
 - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_eventlog_channelaccess_registry_value_set_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_eventlog_channelaccess_registry_value_set_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: False positives may be triggered from newly installed event providers or windows updates, new "ChannelAccess" values must be investigated.
 references:

detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml

@@ -1,7 +1,7 @@
 name: Windows Files and Dirs Access Rights Modification Via Icacls
 id: c76b796c-27e1-4520-91c4-4a58695c749e
-version: 3
-date: '2024-09-30'
+version: 4
+date: '2024-12-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -27,6 +27,7 @@ drilldown_searches:
 tags:
   analytic_story:
   - Amadey
+  - Defense Evasion or Unauthorized Access Via SDDL Tampering
   asset_type: Endpoint
   atomic_guid:
   - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9

stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml

@@ -3,7 +3,7 @@ id: 8ccdd852-3878-4871-ae37-e5af5c67baf3
 version: 1
 date: '2024-12-06'
 author: Nasreddine Bencherchali, Michael Haag, Splunk
-description: This analytic story focuses on detecting potential defense evasion or unauthorized access attempts through tampering with Security Descriptor Definition Language (SDDL) settings. Attackers may modify SDDL configurations to alter permissions on critical system components, such as event logs and services, to obscure their activities or gain unauthorized access. This story includes detections for changes to 'ChannelAccess' and 'CustomSD' registry values, as well as the use of tools like 'sc.exe sdset' and 'subinacl' to modify service permissions.
+description: This analytic story focuses on detecting potential defense evasion or unauthorized access attempts through tampering with Security Descriptor Definition Language (SDDL) settings. Attackers may modify SDDL configurations to alter permissions on critical system components, such as event logs and services, to obscure their activities or gain unauthorized access. This story includes detections for changes to 'ChannelAccess' and 'CustomSD' registry values, as well as the use of tools like 'sc.exe sdset', 'icacls' and 'subinacl' to modify securable objects (files, registry, services, etc) permissions.
 narrative: Adversaries may attempt to evade detection or gain unauthorized access by modifying ACLs or Security Descriptors of different securable objects on the Windows operating system. By altering these settings, attackers can grant themselves elevated privileges or suppress logging mechanisms, thereby hindering detection and response efforts. Monitoring changes to critical registry values and the execution of specific tools used for SDDL modifications can help identify such malicious activities.
 references:
 - https://web.archive.org/web/20220710181255/https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness