diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 59e0e60ef8..e35ed603dc 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -7,10 +7,10 @@ type: TTP datamodel: - Endpoint description: This analytic is developed to detect suspicious registry modification - to change the default file association of windows to malicious payload. This techninique + to change the default file association of windows to malicious payload. This technique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other - payload that will load malicious command to the compromised host. + payload that will load malicious commands to the compromised host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user @@ -32,6 +32,7 @@ tags: - Windows Privilege Escalation - Windows Registry Abuse - Hermetic Wiper + - Prestige Ransomware confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index c81155fd0c..63385a522d 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -27,6 +27,8 @@ tags: analytic_story: - Hidden Cobra Malware - CISA AA22-277A + - Windows Post-Exploitation + - Prestige Ransomware asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index 3dc044760e..536eae105c 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -25,6 +25,8 @@ references: tags: analytic_story: - Active Directory Discovery + - Windows Post-Exploitation + - Prestige Ransomware confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 8e9522442c..629017c24b 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -28,6 +28,8 @@ tags: analytic_story: - XMRig - Azorult + - Windows Post-Exploitation + - Prestige Ransomware confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index cb8852cdb9..f71354c946 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -29,6 +29,8 @@ tags: - XMRig - Ransomware - Azorult + - Windows Post-Exploitation + - Prestige Ransomware confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index eb48b3e57d..1f09937e9b 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -30,6 +30,8 @@ tags: - Active Directory Discovery - Windows Discovery Techniques - Azorult + - Windows Post-Exploitation + - Prestige Ransomware confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml index 7b14d9b4ef..013bf6920c 100644 --- a/detections/endpoint/network_connection_discovery_arp.yml +++ b/detections/endpoint/network_connection_discovery_arp.yml @@ -25,6 +25,8 @@ tags: analytic_story: - Active Directory Discovery - Qakbot + - Windows Post-Exploitation + - Prestige Ransomware confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_connection_discovery_net.yml b/detections/endpoint/network_connection_discovery_net.yml index 29133265c6..67d07c8f12 100644 --- a/detections/endpoint/network_connection_discovery_net.yml +++ b/detections/endpoint/network_connection_discovery_net.yml @@ -26,6 +26,8 @@ tags: analytic_story: - Active Directory Discovery - Azorult + - Windows Post-Exploitation + - Prestige Ransomware confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml index 8fada46320..0e0673058d 100644 --- a/detections/endpoint/network_connection_discovery_netstat.yml +++ b/detections/endpoint/network_connection_discovery_netstat.yml @@ -27,6 +27,8 @@ tags: - Active Directory Discovery - Qakbot - CISA AA22-277A + - Windows Post-Exploitation + - Prestige Ransomware confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index 3173958bb3..d21c7f43b9 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -30,6 +30,8 @@ tags: - Active Directory Discovery - Qakbot - CISA AA22-277A + - Windows Post-Exploitation + - Prestige Ransomware confidence: 30 context: - Source:Endpoint diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 2fc2c7e3f6..7aec61f75f 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -35,6 +35,8 @@ tags: - Ransomware - Malicious PowerShell - Qakbot + - Windows Post-Exploitation + - Prestige Ransomware confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml new file mode 100644 index 0000000000..f8da948401 --- /dev/null +++ b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml @@ -0,0 +1,78 @@ +name: Windows Change Default File Association For No File Ext +id: dbdf52ad-d6a1-4b68-975f-0a10939d8e38 +version: 1 +date: '2022-11-30' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is developed to detect suspicious process commandline + to change or set the default file association of a file without file extension with notepad.exe. This technique + was seen in some APT and ransomware Prestige where it set/modify the default process to run file association, + like .txt to notepad.exe. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_reg` AND Processes.process="* add *" AND Processes.process="* HKCR\\*" AND Processes.process="*\\shell\\open\\command*" AND Processes.process= *Notepad.exe* + by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | rex field=process "Notepad\.exe (?.*$)" + | rex field=file_name_association "\.(?[^\.]*$)" + | where isnull(extension) and isnotnull(file_name_association) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_change_default_file_association_for_no_file_ext_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +tags: + analytic_story: + - Prestige Ransomware + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: process with commandline $process$ set or change the file association of a file with no file extension in $dest$ + mitre_attack_id: + - T1546.001 + - T1546 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/tests/endpoint/windows_change_default_file_association_for_no_file_ext.test.yml b/tests/endpoint/windows_change_default_file_association_for_no_file_ext.test.yml new file mode 100644 index 0000000000..ffcd68676e --- /dev/null +++ b/tests/endpoint/windows_change_default_file_association_for_no_file_ext.test.yml @@ -0,0 +1,13 @@ +name: Windows Change Default File Association For No File Ext Unit Test +tests: +- name: Windows Change Default File Association For No File Ext + file: endpoint/windows_change_default_file_association_for_no_file_ext.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true