From 5d8af6f24231283d1230759bb165c1e7bd64efa4 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 20 Sep 2021 13:41:30 +0000 Subject: [PATCH] Added detection testing service results inMS Scripting Process Loading WMI Module --- ...s_scripting_process_loading_wmi_module.yml | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 242b7ffa27..930a359778 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -6,21 +6,25 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process - wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 - server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may - give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. -search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") - | stats min(_time) as firstTime max(_time) as lastTime count - by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious MS scripting process such as wscript.exe + or cscript.exe that loading wmi module to process wmi query. This behavior was seen + in FIN7 implant where it uses javascript to execute wmi query to parse host information + that will send to its C2 server. this anomaly detections is a good initial step + to hunt further a suspicious wmi query or wmi related events to the host that may + give you good information regarding process that are commonly using wmi query or + modules or might be an attacker using this technique. +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded + IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , + "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) + as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer + ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: automation scripting language may used by network operator to do ldap query. +known_false_positives: automation scripting language may used by network operator + to do ldap query. references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -44,14 +48,13 @@ tags: - process_name - ProcessId - ProcessGuid - - Computer + - Computer - ImageLoaded security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 - context: + context: - Source:Endpoint - Stage:Execution message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$ @@ -59,4 +62,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed