diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index c68c383ee9..63c454e9da 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -1,7 +1,7 @@ name: Excessive Usage Of Cacls App id: 0bdf6092-af17-11eb-939a-acde48001122 -version: 4 -date: '2024-09-30' +version: 5 +date: '2024-12-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ tags: - Azorult - Windows Post-Exploitation - Prestige Ransomware + - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint confidence: 100 impact: 80 diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index bbb37ece01..9ee94c4cdc 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,7 +1,7 @@ name: Icacls Deny Command id: cf8d753e-a8fe-11eb-8f58-acde48001122 -version: '4' -date: '2024-11-28' +version: 5 +date: '2024-12-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -56,6 +56,7 @@ tags: - Sandworm Tools - XMRig - Compromised Windows Host + - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint confidence: 80 impact: 90 diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 9445ecf5d7..f4618f0bfb 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -1,7 +1,7 @@ name: ICACLS Grant Command id: b1b1e316-accc-11eb-a9b4-acde48001122 -version: 3 -date: '2024-09-30' +version: 4 +date: '2024-12-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -28,6 +28,7 @@ tags: analytic_story: - XMRig - Ransomware + - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index abcc1f260d..eb0eb14dc1 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -1,7 +1,7 @@ name: Modify ACL permission To Files Or Folder id: 7e8458cc-acca-11eb-9e3f-acde48001122 -version: 4 -date: '2024-09-30' +version: 5 +date: '2024-12-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ drilldown_searches: tags: analytic_story: - XMRig + - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint confidence: 80 impact: 40 diff --git a/detections/endpoint/new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/new_custom_security_descriptor_set_on_eventlog_channel.yml index ab669ebe5e..a85f2dead0 100644 --- a/detections/endpoint/new_custom_security_descriptor_set_on_eventlog_channel.yml +++ b/detections/endpoint/new_custom_security_descriptor_set_on_eventlog_channel.yml @@ -8,7 +8,7 @@ type: Anomaly description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" AND Registry.registry_value_name=CustomSD BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_custom_security_descriptor_set_on_eventlog_channel_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" AND Registry.registry_value_name=CustomSD BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_custom_security_descriptor_set_on_eventlog_channel_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: None identified, setting up the "CustomSD" value is considered a legacy option and shouldn't be a common activity. references: diff --git a/detections/endpoint/new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/new_eventlog_channelaccess_registry_value_set.yml index e4a1573858..fae933bb17 100644 --- a/detections/endpoint/new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/new_eventlog_channelaccess_registry_value_set.yml @@ -8,7 +8,7 @@ type: Anomaly description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_eventlog_channelaccess_registry_value_set_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `new_eventlog_channelaccess_registry_value_set_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: False positives may be triggered from newly installed event providers or windows updates, new "ChannelAccess" values must be investigated. references: diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index 58b87f0109..dccf14431e 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -1,7 +1,7 @@ name: Windows Files and Dirs Access Rights Modification Via Icacls id: c76b796c-27e1-4520-91c4-4a58695c749e -version: 3 -date: '2024-09-30' +version: 4 +date: '2024-12-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -27,6 +27,7 @@ drilldown_searches: tags: analytic_story: - Amadey + - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint atomic_guid: - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9 diff --git a/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml b/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml index 2123a41ab0..10ab15d858 100644 --- a/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml +++ b/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml @@ -3,7 +3,7 @@ id: 8ccdd852-3878-4871-ae37-e5af5c67baf3 version: 1 date: '2024-12-06' author: Nasreddine Bencherchali, Michael Haag, Splunk -description: This analytic story focuses on detecting potential defense evasion or unauthorized access attempts through tampering with Security Descriptor Definition Language (SDDL) settings. Attackers may modify SDDL configurations to alter permissions on critical system components, such as event logs and services, to obscure their activities or gain unauthorized access. This story includes detections for changes to 'ChannelAccess' and 'CustomSD' registry values, as well as the use of tools like 'sc.exe sdset' and 'subinacl' to modify service permissions. +description: This analytic story focuses on detecting potential defense evasion or unauthorized access attempts through tampering with Security Descriptor Definition Language (SDDL) settings. Attackers may modify SDDL configurations to alter permissions on critical system components, such as event logs and services, to obscure their activities or gain unauthorized access. This story includes detections for changes to 'ChannelAccess' and 'CustomSD' registry values, as well as the use of tools like 'sc.exe sdset', 'icacls' and 'subinacl' to modify securable objects (files, registry, services, etc) permissions. narrative: Adversaries may attempt to evade detection or gain unauthorized access by modifying ACLs or Security Descriptors of different securable objects on the Windows operating system. By altering these settings, attackers can grant themselves elevated privileges or suppress logging mechanisms, thereby hindering detection and response efforts. Monitoring changes to critical registry values and the execution of specific tools used for SDDL modifications can help identify such malicious activities. references: - https://web.archive.org/web/20220710181255/https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness