njrat2

detections/endpoint/disable_registry_tool.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 100
   impact: 40

detections/endpoint/disabling_cmd_application.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/disabling_task_manager.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Windows Registry Abuse
+  - NjRAT
   asset_type: Endpoint
   confidence: 60
   impact: 70

detections/endpoint/windows_abused_web_services.yml

@@ -0,0 +1,67 @@
+name: Windows Abused Web Services
+id: 01f0aef4-8591-4daa-a53d-0ed49823b681
+version: 1
+date: '2023-09-20'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 22
+description: This analytic detects a suspicious process making a DNS query via known,
+  abused text-paste web services, VoIP, internet via secure tunneling,instant messaging, and digital distribution
+  platforms used to download external files. This technique is abused by adversaries,
+  malware actors, and red teams to download a malicious file on the target host. This
+  is a good TTP indicator for possible initial access techniques. A user will experience
+  false positives if the following instant messaging is allowed or common applications
+  like telegram or discord are allowed in the corporate network.
+search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*",""*textbin*"", "*ngrok.io*", "*discord*", "*duckdns.org*", "*pasteio.com*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_abused_web_services_filter`'
+how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query.
+  We suggest you run this detection at least once a day over the last 14 days.
+known_false_positives: Noise and false positive can be seen if the following instant
+  messaging is allowed to use within corporate network. In this case, a filter is
+  needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 60
+  impact: 60
+  message: a network connection on known abused web services from $dest$
+  mitre_attack_id:
+  - T1102
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 36
+  required_fields:
+  - _time
+  - Image
+  - QueryName
+  - QueryStatus
+  - process_name
+  - QueryResults
+  - Computer
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_admin_permission_discovery.yml

@@ -0,0 +1,74 @@
+name: Windows Admin Permission Discovery
+id: e08620cb-9488-4052-832d-97bcc0afd414
+version: 1
+date: '2023-09-19'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 11
+description: This analytic is developed to identify suspicious file creation in the root drive (C:\). 
+  This tactic was observed in NjRAT as a means to ascertain whether its malware instance running on 
+  the compromised host possesses administrative privileges.
+  The methodology involves an attempt to create a 'win.dat' file in the C:\ directory. 
+  If this file is successfully created, it serves as an indicator that the process indeed holds administrative privileges.
+  This anomaly detection mechanism serves as a valuable pivot point for detecting NjRAT and other malware strains employing 
+  similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets.
+search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem 
+  where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") 
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.user 
+  | `drop_dm_object_name(Filesystem)` 
+  | eval dropped_file_path = split(file_path, "\\") 
+  | eval dropped_file_path_split_count = mvcount(dropped_file_path) 
+  | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2  
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_admin_permission_discovery_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that 
+  include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: administrator is capable of dropping files in root C drive.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
+tags:
+  analytic_story:
+  - NjRAT
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: a file was created in root drive c in $dest$
+  mitre_attack_id:
+  - T1069.001
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_id
+    type: Process
+    role:
+    - Attacker
+  - name: file_name
+    type: File Name
+    role:
+    - Other
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true