Merge pull request #1351 from splunk/trickbot

trickbot

detections/endpoint/account_discovery_with_net_app.yml

@@ -0,0 +1,56 @@
+name: Account Discovery With Net App
+id: 339805ce-ac30-11eb-b87d-acde48001122
+version: 1
+date: '2021-05-03'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect a potential account discovery series of command
+  used by several malware or attack to recon the target machine. This technique is
+  also seen in some note worthy malware like trickbot where it runs a cmd process,
+  or even drop its module that will execute the said series of net command. This series
+  of command are good correlation search and indicator of attacker recon if seen in
+  the machines within a none technical user or department (HR, finance, ceo and etc)
+  network.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.parent_process) as parent_process values(Processes.process_id)
+  as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
+  (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view
+  /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
+  | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: admin or power user may used this series of command.
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+tags:
+  analytic_story:
+  - Trickbot
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_guid
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log

detections/endpoint/attempt_to_stop_security_service.yml

@@ -31,6 +31,7 @@ references: []
 tags:
   analytic_story:
   - Disabling Security Tools
+  - Trickbot
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/cobalt_strike_named_pipes.yml

@@ -39,6 +39,7 @@ references:
 tags:
   analytic_story:
   - Cobalt Strike
+  - Trickbot
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -13,8 +13,8 @@ description: this detection was designed to identifies suspicious spawned proces
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
-  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name
-  = "wordpad.exe") Processes.process_name=rundll32.exe  by Processes.parent_process
+  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") 
+  Processes.process_name=rundll32.exe  by Processes.parent_process
   Processes.process_name Processes.process_id Processes.process_guid Processes.user
   Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `office_application_spawn_rundll32_process_filter`'
@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Trickbot
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log

detections/endpoint/office_document_creating_schedule_task.yml

@@ -19,8 +19,8 @@ description: this search detects a potential malicious office document that crea
   source. Was it schtasks.exe or via TaskService? Review the job created and the Command
   to be executed. Capture any artifacts on disk and review. Identify any parallel
   processes within the same timeframe to identify source.'
-search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE",
-  "wordpad.exe")  ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime
+search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") 
+  ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime
   max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode
   Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` |
   `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`'

detections/endpoint/office_document_executing_macro_code.yml

@@ -13,8 +13,8 @@ description: this detection was designed to identifies suspicious office documen
   or other malware component. It is really good practice to disable macro by default
   to avoid automatically execute macro code while opening or closing a office document
   files.
-search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE",
-  "wordpad.exe")  ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
+search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")  
+  ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
   | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded
   count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Trickbot
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log

detections/endpoint/office_document_spawned_child_process_to_download.yml

@@ -11,7 +11,7 @@ description: this search is to detect potential malicious office document execut
   abused the capability of office document to execute living on land application to
   blend it to the normal noise in the infected machine to cover its track.
 search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
-  "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*")  NOT(OriginalFileName
+  "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*")  NOT(OriginalFileName
   IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
   min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
   parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode

detections/endpoint/powershell_remote_thread_to_known_windows_process.yml

@@ -0,0 +1,53 @@
+name: Powershell Remote Thread To Known Windows Process
+id: ec102cb2-a0f5-11eb-9b38-acde48001122
+version: 1
+date: '2021-04-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is designed to detect suspicious powershell process that
+  tries to inject code and to known/critical windows process and execute it using
+  CreateRemoteThread. This technique is seen in several malware like trickbot and
+  offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to
+  execute reverse shell to c2 and download another payload
+search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe")
+  TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
+  | stats  min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
+  SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress
+  Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `powershell_remote_thread_to_known_windows_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, Create Remote thread from your endpoints. If you are
+  using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter
+  known instances of create remote thread may be used.
+known_false_positives: unknown
+references:
+- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
+tags:
+  analytic_story:
+  - Trickbot
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage
+  - process_name
+  - SourceProcessId
+  - SourceProcessGuid
+  - TargetImage
+  - TargetProcessId
+  - NewThreadId
+  - StartAddress
+  - Computer
+  - EventCode
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log

detections/endpoint/schedule_task_with_rundll32_command_trigger.yml

@@ -0,0 +1,58 @@
+name: Schedule Task with Rundll32 Command Trigger
+id: 75b00fd8-a0ff-11eb-8b31-acde48001122
+version: 1
+date: '2021-04-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following query utilizes Windows Security EventCode 4698, `A scheduled
+  task was created`, to identify suspicious tasks registered on Windows either via
+  schtasks.exe OR TaskService with a command to be executed with a Rundll32. This
+  technique is common in new trickbot that uses rundll32 to load is trickbot downloader.
+  The search will return the first time and last time the task was registered, as
+  well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
+  it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32`
+  and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or
+  TaskService is launched -`taskschd.dll`. If found loaded by another process, it
+  is possible a scheduled task is being registered within that process context in
+  memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or
+  via TaskService? Review the job created and the Command to be executed. Capture
+  any artifacts on disk and review. Identify any parallel processes within the same
+  timeframe to identify source.'
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
+  ("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
+  Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `schedule_task_with_rundll32_command_trigger_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
+  filter known instances of Task schedule used in your environment.
+known_false_positives: unknown
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Trickbot
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1053
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Command
+  - Author
+  - Enabled
+  - Hidden
+  - Arguments
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log

detections/endpoint/suspicious_rundll32_startw.yml

@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Cobalt Strike
+  - Trickbot
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/trickbot_named_pipe.yml

@@ -0,0 +1,46 @@
+name: Trickbot Named Pipe
+id: 1804b0a4-a682-11eb-8f68-acde48001122
+version: 1
+date: '2021-04-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect potential trickbot infection through the create/connected
+  named pipe to the system. This technique is used by trickbot to communicate to its
+  c2 to post or get command during infection.
+search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats  min(_time)
+  as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName
+  signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `trickbot_named_pipe_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and pipename from your endpoints. If you are using Sysmon,
+  you must have at least version 6.0.4 of the Sysmon TA. .
+known_false_positives: unknown
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+tags:
+  analytic_story:
+  - Trickbot
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - user_id
+  - EventCode
+  - PipeName
+  - signature
+  - Image
+  - process_id
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log

detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml

@@ -0,0 +1,55 @@
+name: Wermgr Process Connecting To IP Check Web Services
+id: ed313326-a0f9-11eb-a89c-acde48001122
+version: 1
+date: '2021-04-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is designed to detect suspicious wermgr.exe process that
+  tries to connect to known IP web services. This technique is know for trickbot and
+  other trojan spy malware to recon the infected machine and look for its ip address
+  without so much finger print on the commandline process. Since wermgr.exe is designed
+  for error handling process of windows it is really suspicious that this process
+  is trying to connect to this IP web services cause that maybe cause of some malicious
+  code injection.
+search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com",
+  "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com",
+  "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org",
+  "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net")
+  |  stats  min(_time) as firstTime max(_time) as lastTime count by  process_path
+  process_name process_id QueryName QueryStatus QueryResults Computer EventCode |
+  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, dns query name process path , and query ststus from
+  your endpoints like EventCode 22. If you are using Sysmon, you must have at least
+  version 12 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+tags:
+  analytic_story:
+  - Trickbot
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1590.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_path
+  - process_name
+  - process_id
+  - QueryName
+  - QueryStatus
+  - QueryResults
+  - Computer
+  - EventCode
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log

detections/endpoint/wermgr_process_create_executable_file.yml

@@ -0,0 +1,49 @@
+name: Wermgr Process Create Executable File
+id: ab3bcce0-a105-11eb-973c-acde48001122
+version: 1
+date: '2021-04-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is designed to detect potential malicious wermgr.exe process
+  that drops or create executable file. Since wermgr.exe is an application trigger
+  when error encountered in a process, it is really un ussual to this process to drop
+  executable file. This technique is commonly seen in trickbot malware where it injects
+  it code to this process to execute it malicious behavior like downloading other
+  payload
+search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
+  | stats  min(_time) as firstTime max(_time) as lastTime count by  Image TargetFilename
+  process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `wermgr_process_create_executable_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: unknown
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+tags:
+  analytic_story:
+  - Trickbot
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1027
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - TargetFilename
+  - process_name
+  - dest
+  - EventCode
+  - ProcessId
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log

detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml

@@ -0,0 +1,52 @@
+name: Wermgr Process Spawned CMD Or Powershell Process
+id: e8fc95bc-a107-11eb-a978-acde48001122
+version: 1
+date: '2021-04-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is designed to detect suspicious cmd and powershell process
+  spawned by wermgr.exe process. This suspicious behavior are commonly seen in code
+  injection technique technique like trickbot to execute a shellcode, dll modules
+  to run malicious behavior.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe"
+  OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id  Processes.process_name
+  Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `wermgr_process_spawned_cmd_or_powershell_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+tags:
+  analytic_story:
+  - Trickbot
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_guid
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log

detections/endpoint/write_executable_in_smb_share.yml

@@ -0,0 +1,49 @@
+name: Write Executable in SMB Share
+id: f63c34fe-a435-11eb-935a-acde48001122
+version: 1
+date: '2021-04-23'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect suspicious dropping or creating an executable
+  file in known sensitive SMB share. This technique is commonly used for lateral movement
+  like how trickbot try to infect other machine in the infected network. This detection
+  catch the access event (FILE WRITE) access to a share.
+search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
+  Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
+  "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
+  Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
+  required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: unknown
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+tags:
+  analytic_story:
+  - Trickbot
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Share_Name
+  - Relative_Target_Name
+  - Object_Type
+  - Access_Mask
+  - user
+  - src_port
+  - Source_Address
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log

stories/trickbot.yml

@@ -0,0 +1,24 @@
+name: Trickbot
+id: 16f93769-8342-44c0-9b1d-f131937cce8e
+version: 1
+date: '2021-04-20'
+author: Rod Soto, Teoderick Contreras, Splunk
+type: batch
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the trickbot banking trojan, including looking for file writes associated
+  with its payload, process injection, shellcode execution and data collection even in LDAP environment.
+narrative: trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known
+  in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal 
+  Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data. 
+references:
+- https://en.wikipedia.org/wiki/Trickbot
+- https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
+tags:
+  analytic_story: Trickbot
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/account_discovery_with_net_app.test.yml

@@ -0,0 +1,12 @@
+name: Account Discovery With Net App Unit Test
+tests:
+- name: Account Discovery With Net App
+  file: endpoint/account_discovery_with_net_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml

@@ -0,0 +1,12 @@
+name: Powershell Remote Thread To Known Windows Process Unit Test
+tests:
+- name: Powershell Remote Thread To Known Windows Process
+  file: endpoint/powershell_remote_thread_to_known_windows_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml

@@ -0,0 +1,12 @@
+name: Schedule Task with Rundll32 Command Trigger Unit Test
+tests:
+- name: Schedule Task with Rundll32 Command Trigger
+  file: endpoint/schedule_task_with_rundll32_command_trigger.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/trickbot_named_pipe.test.yml

@@ -0,0 +1,12 @@
+name: Trickbot Named Pipe Unit Test
+tests:
+- name: Trickbot Named Pipe
+  file: endpoint/trickbot_named_pipe.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml

@@ -0,0 +1,12 @@
+name: Wermgr Process Connecting To IP Check Web Services Unit Test
+tests:
+- name: Wermgr Process Connecting To IP Check Web Services
+  file: endpoint/wermgr_process_connecting_to_ip_check_web_services.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/wermgr_process_create_executable_file.test.yml

@@ -0,0 +1,12 @@
+name: Wermgr Process Create Executable File Unit Test
+tests:
+- name: Wermgr Process Create Executable File
+  file: endpoint/wermgr_process_create_executable_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml

@@ -0,0 +1,12 @@
+name: Wermgr Process Spawned CMD Or Powershell Process Unit Test
+tests:
+- name: Wermgr Process Spawned CMD Or Powershell Process
+  file: endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/write_executable_in_smb_share.test.yml

@@ -0,0 +1,12 @@
+name: Write Executable in SMB Share Unit Test
+tests:
+- name: Write Executable in SMB Share
+  file: endpoint/write_executable_in_smb_share.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog