Branch was auto-updated.

bin/generate.py

@@ -636,7 +636,7 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     except Exception as e:
         print('Error: ' + str(e))
         print("WARNING: Generation of Mitre lookup failed.")
-        
+
     lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
     lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
     lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)

detections/endpoint/attacker_tools_on_endpoint.yml

@@ -0,0 +1,59 @@
+name: Attacker Tools On Endpoint
+id: a51bfe1a-94f0-48cc-b4e4-16a110145893
+version: 1
+date: '2021-06-21'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search looks for execution of commonly used attacker tools on an
+  endpoint.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime values(Processes.process) as process values(Processes.parent_process)
+  as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown
+  Processes.user!=unknown by Processes.dest Processes.user Processes.process_name
+  Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
+  process_name OUTPUT description | search description=* | `attacker_tools_on_endpoint_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is usually generated via logs that report process tracking
+  in your Windows audit settings.
+known_false_positives: Some administrator activity can be potentially triggered, please
+  add those users to the filter macro.
+references: []
+tags:
+  analytic_story:
+  - Monitor for Unauthorized Software
+  - XMRig
+  - SamSam Ransomware
+  - Unusual Processes
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1036.005
+  - T1595
+  - T1003
+  cis20:
+  - CIS 2
+  kill_chain_phases:
+  - Installation
+  - Command and Control
+  - Actions on Objectives
+  nist:
+  - ID.AM
+  - PR.DS
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log

lookups/attacker_tools.csv

@@ -0,0 +1,26 @@
+attacker_tool_names,description
+remcom.exe,This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
+pwdump.exe,This process is associated with a tool used to dump password hashes on a Windows system.
+pwdump2.exe,This process is associated with a tool used to dump password hashes on a Windows system.
+nc.exe,This process is an open source tool used for network communications.
+wce.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
+cain.exe,This process is associated with a tool used to collect user credentials and execute attacks.
+nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network.
+kidlogger.exe,This process is associated with a tool used to collect keyboard input on a host.
+isass.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+svch0st.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+at.exe,This process is used to schedule other processes to run.  schtasks.exe should be used instead as it provides more flexibility.
+getmail.exe,This process is seen to be used by attackers to extract email files from host machines.
+ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A.
+netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
+WebBrowserPassView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
+OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
+mailpv.exe,This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
+NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
+selfdel.exe,This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
+masscan.exe,This executable was delivered in the XMRig Crypto Miner
+Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner
+KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet
+NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
+ns.exe,A commonly used tool used by attackers to scan and map file shares
+SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.

lookups/attacker_tools.yml

@@ -0,0 +1,7 @@
+description: A list of tools used by attackers
+filename: attacker_tools.csv
+name: attacker_tools
+default_match: 'false'
+match_type: WILDCARD(attacker_tool_names)
+min_matches: 1
+case_sensitive_match: 'false'

tests/endpoint/attacker_tools_on_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Attacker Tools On Endpoint Unit Test
+tests:
+- name: Attacker Tools On Endpoint
+  file: endpoint/attacker_tools_on_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog