From a0a57ab60048aee144be3f9a04b5fe9df0951a02 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 12 Jul 2021 18:54:24 -0500 Subject: [PATCH 1/6] atttacker_tools_files --- .../endpoint/attacker_tools_on_endpoint.yml | 54 +++++++++++++++++++ lookups/attacker_tools.csv | 25 +++++++++ lookups/attacker_tools.yml | 3 ++ .../attacker_tools_on_endpoint.test.yml | 12 +++++ 4 files changed, 94 insertions(+) create mode 100644 detections/endpoint/attacker_tools_on_endpoint.yml create mode 100644 lookups/attacker_tools.csv create mode 100644 lookups/attacker_tools.yml create mode 100644 tests/endpoint/attacker_tools_on_endpoint.test.yml diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml new file mode 100644 index 0000000000..30e8240cef --- /dev/null +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -0,0 +1,54 @@ +name: Attacker Tools On Endpoint +id: a51bfe1a-94f0-48cc-b4e4-16a110145893 +version: 1 +date: '2021-06-21' +author: Bhavin Patel, Splunk +type: batch +datamodel: +- Endpoint +description: This search looks for execution of commonly used attacker tools on an endpoint. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` + | lookup attacker_tools attacker_tool_names as process_name OUTPUT description + | search description=* + | `attacker_tools_on_endpoint_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is usually generated via logs that report process tracking + in your Windows audit settings. +known_false_positives: Some administrator activity can be potentially triggered, please add those users to the filter macro. +references: [] +tags: + analytic_story: + - Monitor for Unauthorized Software + - XMRig + - SamSam Ransomware + - Unusual Processes + asset_type: Endpoint + mitre_attack_id: + - T1036.005 + - T1595 + - T1003 + cis20: + - CIS 2 + kill_chain_phases: + - Installation + - Command and Control + - Actions on Objectives + nist: + - ID.AM + - PR.DS + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Processes.dest + - Processes.user + - Processes.process_name + - Processes.parent_process_name + security_domain: endpoint \ No newline at end of file diff --git a/lookups/attacker_tools.csv b/lookups/attacker_tools.csv new file mode 100644 index 0000000000..738b65aa35 --- /dev/null +++ b/lookups/attacker_tools.csv @@ -0,0 +1,25 @@ +attacker_tool_names,description +remcom.exe,This process is an open source replacement to psexec and is not typically seen in an enterprise environment. +pwdump.exe,This process is associated with a tool used to dump password hashes on a Windows system. +pwdump2.exe,This process is associated with a tool used to dump password hashes on a Windows system. +nc.exe,This process is an open source tool used for network communications. +wce.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks. +cain.exe,This process is associated with a tool used to collect user credentials and execute attacks. +nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network. +kidlogger.exe,This process is associated with a tool used to collect keyboard input on a host. +isass.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process. +svch0st.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process. +at.exe,This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility. +getmail.exe,This process is seen to be used by attackers to extract email files from host machines. +ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A. +netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user. +WebBrowserPassView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers. +OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook. +mailpv.exe,This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients. +NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords. +selfdel.exe,This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities. +masscan.exe,This executable was delivered in the XMRig Crypto Miner +Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner +KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet +NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits +ns.exe, A commonly used tool used by attackers to scan and map file shares \ No newline at end of file diff --git a/lookups/attacker_tools.yml b/lookups/attacker_tools.yml new file mode 100644 index 0000000000..a1c5e8cdbc --- /dev/null +++ b/lookups/attacker_tools.yml @@ -0,0 +1,3 @@ +description: A list of tools used by attackers +filename: attacker_tools.csv +name: attacker_tools \ No newline at end of file diff --git a/tests/endpoint/attacker_tools_on_endpoint.test.yml b/tests/endpoint/attacker_tools_on_endpoint.test.yml new file mode 100644 index 0000000000..2ce6d32949 --- /dev/null +++ b/tests/endpoint/attacker_tools_on_endpoint.test.yml @@ -0,0 +1,12 @@ +name: Attacker Tools On Endpoint Unit Test +tests: +- name: Attacker Tools On Endpoint + file: endpoint/attacker_tools_on_endpoint.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-30d' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From bcbe0bd5a277332d70ed6539c63e3f5905b6eb04 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 12 Jul 2021 18:55:39 -0500 Subject: [PATCH 2/6] spl --- detections/endpoint/attacker_tools_on_endpoint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 30e8240cef..acedb376ea 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -11,7 +11,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup attacker_tools attacker_tool_names as process_name OUTPUT description + | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description | search description=* | `attacker_tools_on_endpoint_filter`' how_to_implement: To successfully implement this search, you must be ingesting data From 50bdf277c64a353be1bc33085a8b4da643e853b9 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 12 Jul 2021 19:02:32 -0500 Subject: [PATCH 3/6] lookup definitions --- lookups/attacker_tools.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lookups/attacker_tools.yml b/lookups/attacker_tools.yml index a1c5e8cdbc..0c40ac2992 100644 --- a/lookups/attacker_tools.yml +++ b/lookups/attacker_tools.yml @@ -1,3 +1,7 @@ description: A list of tools used by attackers filename: attacker_tools.csv -name: attacker_tools \ No newline at end of file +name: attacker_tools +default_match: 'false' +match_type: WILDCARD(attacker_tool_names) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file From c3db57948063b9b3eeb14af0fac398790057d93d Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 13 Jul 2021 11:52:17 -0500 Subject: [PATCH 4/6] lookup bug in generate --- bin/generate.py | 21 +++++++++++++-------- lookups/attacker_tools.csv | 3 ++- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index c769122bcf..3cb8601a48 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -14,6 +14,7 @@ from jinja2 import Environment, FileSystemLoader import re from attackcti import attack_client import csv +import shutil def load_objects(file_path, VERBOSE, REPO_PATH): @@ -45,6 +46,16 @@ def load_file(file_path): sys.exit("ERROR: reading {0}".format(file_path)) return file +def generate_lookup_files(lookups, TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH): + sorted_lookups = sorted(lookups, key=lambda i: i['name']) + utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() + for i in sorted_lookups: + for k,v in i.items(): + if k == 'filename': + lookup_file = REPO_PATH +'/lookups/'+ v + dist_lookup_dir = OUTPUT_PATH +'/lookups' + shutil.copy(lookup_file,dist_lookup_dir) + return sorted_lookups def generate_transforms_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH): sorted_lookups = sorted(lookups, key=lambda i: i['name']) @@ -618,16 +629,10 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE) - try: - if VERBOSE: - print("generating Mitre lookups") - generate_mitre_lookup(OUTPUT_PATH) - except Exception as e: - print('Error: ' + str(e)) - print("WARNING: Generation of Mitre lookup failed.") - + lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) + lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH) detection_path = generate_savedsearches_conf(objects["detections"], objects["response_tasks"], objects["baselines"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) diff --git a/lookups/attacker_tools.csv b/lookups/attacker_tools.csv index 738b65aa35..1a579552b6 100644 --- a/lookups/attacker_tools.csv +++ b/lookups/attacker_tools.csv @@ -22,4 +22,5 @@ masscan.exe,This executable was delivered in the XMRig Crypto Miner Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits -ns.exe, A commonly used tool used by attackers to scan and map file shares \ No newline at end of file +ns.exe,A commonly used tool used by attackers to scan and map file shares +SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts. \ No newline at end of file From fac27a643da0c4cf9917647ee8053d56ec039fb3 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 14 Jul 2021 13:33:44 +0000 Subject: [PATCH 5/6] Added detection testing service results inAttacker Tools On Endpoint --- .../endpoint/attacker_tools_on_endpoint.yml | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index acedb376ea..acce9785f0 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -6,21 +6,23 @@ author: Bhavin Patel, Splunk type: batch datamodel: - Endpoint -description: This search looks for execution of commonly used attacker tools on an endpoint. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` - | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description - | search description=* - | `attacker_tools_on_endpoint_filter`' +description: This search looks for execution of commonly used attacker tools on an + endpoint. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.process) as process values(Processes.parent_process) + as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown + Processes.user!=unknown by Processes.dest Processes.user Processes.process_name + Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS + process_name OUTPUT description | search description=* | `attacker_tools_on_endpoint_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. -known_false_positives: Some administrator activity can be potentially triggered, please add those users to the filter macro. +known_false_positives: Some administrator activity can be potentially triggered, please + add those users to the filter macro. references: [] tags: analytic_story: @@ -47,8 +49,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_name - Processes.parent_process_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log From f4aa1d7d48530e4139ad478cc8be17519e75e4c0 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 14 Jul 2021 17:05:49 +0200 Subject: [PATCH 6/6] bug fix test file --- ..._on_endpoint.test.yml => attacker_tools_on_endpoint.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{attacker_tools_on_endpoint.test.yml => attacker_tools_on_endpoint.test.yml} (100%) diff --git a/tests/endpoint/attacker_tools_on_endpoint.test.yml b/tests/endpoint/attacker_tools_on_endpoint.test.yml similarity index 100% rename from tests/endpoint/attacker_tools_on_endpoint.test.yml rename to tests/endpoint/attacker_tools_on_endpoint.test.yml