mbr_and_more

detections/endpoint/raw_access_to_master_boot_record_drive.yml

@@ -0,0 +1,62 @@
+name: Raw Access To Master Boot Record Drive
+id: 7b83f666-900c-11ec-a2d9-acde48001122
+version: 1
+date: '2022-02-17'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious raw access read to drive where master boot record is place.
+  This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code 
+  as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector.
+search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest Image Device ProcessGuid ProcessId EventDescription EventCode
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `raw_access_to_master_boot_record_drive_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: This event is really notable but we found minimal number of normal application from system32 folder like 
+  svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
+references:
+-  https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html
+-  https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/
+-  https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1561.002
+  - T1561
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context: 
+  - source:endpoint
+  - stage:Impact
+  message: process accessing MBR $device$ in $dest$
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

tests/endpoint/raw_access_to_master_boot_record_drive.test.yml

@@ -0,0 +1,12 @@
+name: Raw Access To Master Boot Record Drive Unit Test
+tests:
+- name: Raw Access To Master Boot Record Drive
+  file: endpoint/raw_access_to_master_boot_record_drive.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog