From 71e6ae840674361ef487e33f0c6016bba20e8a67 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 21 Sep 2023 10:56:06 +0200 Subject: [PATCH] njrat2 --- detections/endpoint/disable_registry_tool.yml | 1 + .../endpoint/disabling_cmd_application.yml | 1 + .../disabling_systemrestore_in_registry.yml | 1 + .../endpoint/disabling_task_manager.yml | 1 + .../endpoint/windows_abused_web_services.yml | 67 +++++++++++++++++ .../windows_admin_permission_discovery.yml | 74 +++++++++++++++++++ 6 files changed, 145 insertions(+) create mode 100644 detections/endpoint/windows_abused_web_services.yml create mode 100644 detections/endpoint/windows_admin_permission_discovery.yml diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 92db5125fe..64d5484233 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 100 impact: 40 diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 817240a760..f76ee91f89 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 82c83ff3ff..c54d46907b 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index f1fca5a4c6..19e51f98d7 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 60 impact: 70 diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/endpoint/windows_abused_web_services.yml new file mode 100644 index 0000000000..e3578a6827 --- /dev/null +++ b/detections/endpoint/windows_abused_web_services.yml @@ -0,0 +1,67 @@ +name: Windows Abused Web Services +id: 01f0aef4-8591-4daa-a53d-0ed49823b681 +version: 1 +date: '2023-09-20' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 22 +description: This analytic detects a suspicious process making a DNS query via known, + abused text-paste web services, VoIP, internet via secure tunneling,instant messaging, and digital distribution + platforms used to download external files. This technique is abused by adversaries, + malware actors, and red teams to download a malicious file on the target host. This + is a good TTP indicator for possible initial access techniques. A user will experience + false positives if the following instant messaging is allowed or common applications + like telegram or discord are allowed in the corporate network. +search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*",""*textbin*"", "*ngrok.io*", "*discord*", "*duckdns.org*", "*pasteio.com*") + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_abused_web_services_filter`' +how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. + We suggest you run this detection at least once a day over the last 14 days. +known_false_positives: Noise and false positive can be seen if the following instant + messaging is allowed to use within corporate network. In this case, a filter is + needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a network connection on known abused web services from $dest$ + mitre_attack_id: + - T1102 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults + - Computer + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml new file mode 100644 index 0000000000..0a9e36204a --- /dev/null +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -0,0 +1,74 @@ +name: Windows Admin Permission Discovery +id: e08620cb-9488-4052-832d-97bcc0afd414 +version: 1 +date: '2023-09-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 11 +description: This analytic is developed to identify suspicious file creation in the root drive (C:\). + This tactic was observed in NjRAT as a means to ascertain whether its malware instance running on + the compromised host possesses administrative privileges. + The methodology involves an attempt to create a 'win.dat' file in the C:\ directory. + If this file is successfully created, it serves as an indicator that the process indeed holds administrative privileges. + This anomaly detection mechanism serves as a valuable pivot point for detecting NjRAT and other malware strains employing + similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") + | eval dropped_file_path_split_count = mvcount(dropped_file_path) + | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_admin_permission_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that + include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: administrator is capable of dropping files in root C drive. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a file was created in root drive c in $dest$ + mitre_attack_id: + - T1069.001 + observable: + - name: user + type: User + role: + - Victim + - name: process_id + type: Process + role: + - Attacker + - name: file_name + type: File Name + role: + - Other + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true