diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml new file mode 100644 index 0000000000..748ec8b65a --- /dev/null +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -0,0 +1,56 @@ +name: Account Discovery With Net App +id: 339805ce-ac30-11eb-b87d-acde48001122 +version: 1 +date: '2021-05-03' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect a potential account discovery series of command + used by several malware or attack to recon the target machine. This technique is + also seen in some note worthy malware like trickbot where it runs a cmd process, + or even drop its module that will execute the said series of net command. This series + of command are good correlation search and indicator of attacker recon if seen in + the machines within a none technical user or department (HR, finance, ceo and etc) + network. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND + (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view + /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name + | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: admin or power user may used this series of command. +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process_id + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index d20d1cc89a..6c0655b9d5 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -31,6 +31,7 @@ references: [] tags: analytic_story: - Disabling Security Tools + - Trickbot asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 79999603b7..e8b8cd15e7 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -39,6 +39,7 @@ references: tags: analytic_story: - Cobalt Strike + - Trickbot asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index ed86253761..c1664fec36 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -13,8 +13,8 @@ description: this detection was designed to identifies suspicious spawned proces search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name - = "wordpad.exe") Processes.process_name=rundll32.exe by Processes.parent_process + = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") + Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`' @@ -29,6 +29,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Trickbot automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index 5bb6b7f560..bd66ddc533 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -19,8 +19,8 @@ description: this search detects a potential malicious office document that crea source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", - "wordpad.exe") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") + ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 5f3ea89876..b72b4aefb4 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -13,8 +13,8 @@ description: this detection was designed to identifies suspicious office documen or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", - "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") + ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' @@ -28,6 +28,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Trickbot automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index f3608c78e7..41a8700f93 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -11,7 +11,7 @@ description: this search is to detect potential malicious office document execut abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", - "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName + "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml new file mode 100644 index 0000000000..2ce7201b9d --- /dev/null +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -0,0 +1,53 @@ +name: Powershell Remote Thread To Known Windows Process +id: ec102cb2-a0f5-11eb-9b38-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect suspicious powershell process that + tries to inject code and to known/critical windows process and execute it using + CreateRemoteThread. This technique is seen in several malware like trickbot and + offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to + execute reverse shell to c2 and download another payload +search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") + TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") + | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name + SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress + Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_remote_thread_to_known_windows_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, Create Remote thread from your endpoints. If you are + using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter + known instances of create remote thread may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - process_name + - SourceProcessId + - SourceProcessGuid + - TargetImage + - TargetProcessId + - NewThreadId + - StartAddress + - Computer + - EventCode + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml new file mode 100644 index 0000000000..4a054d44b5 --- /dev/null +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -0,0 +1,58 @@ +name: Schedule Task with Rundll32 Command Trigger +id: 75b00fd8-a0ff-11eb-8b31-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with a command to be executed with a Rundll32. This + technique is common in new trickbot that uses rundll32 to load is trickbot downloader. + The search will return the first time and last time the task was registered, as + well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or + TaskService is launched -`taskschd.dll`. If found loaded by another process, it + is possible a scheduled task is being registered within that process context in + memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or + via TaskService? Review the job created and the Command to be executed. Capture + any artifacts on disk and review. Identify any parallel processes within the same + timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN + ("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, + Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `schedule_task_with_rundll32_command_trigger_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and + filter known instances of Task schedule used in your environment. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Windows Persistence Techniques + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Command + - Author + - Enabled + - Hidden + - Arguments + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index b5846eae39..1c24057ef8 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -36,6 +36,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Cobalt Strike + - Trickbot asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml new file mode 100644 index 0000000000..6296d6fc9b --- /dev/null +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -0,0 +1,46 @@ +name: Trickbot Named Pipe +id: 1804b0a4-a682-11eb-8f68-acde48001122 +version: 1 +date: '2021-04-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential trickbot infection through the create/connected + named pipe to the system. This technique is used by trickbot to communicate to its + c2 to post or get command during infection. +search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats min(_time) + as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName + signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `trickbot_named_pipe_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and pipename from your endpoints. If you are using Sysmon, + you must have at least version 6.0.4 of the Sysmon TA. . +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - user_id + - EventCode + - PipeName + - signature + - Image + - process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml new file mode 100644 index 0000000000..693331f4be --- /dev/null +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -0,0 +1,55 @@ +name: Wermgr Process Connecting To IP Check Web Services +id: ed313326-a0f9-11eb-a89c-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect suspicious wermgr.exe process that + tries to connect to known IP web services. This technique is know for trickbot and + other trojan spy malware to recon the infected machine and look for its ip address + without so much finger print on the commandline process. Since wermgr.exe is designed + for error handling process of windows it is really suspicious that this process + is trying to connect to this IP web services cause that maybe cause of some malicious + code injection. +search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", + "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", + "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", + "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") + | stats min(_time) as firstTime max(_time) as lastTime count by process_path + process_name process_id QueryName QueryStatus QueryResults Computer EventCode | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, dns query name process path , and query ststus from + your endpoints like EventCode 22. If you are using Sysmon, you must have at least + version 12 of the Sysmon TA. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1590.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_path + - process_name + - process_id + - QueryName + - QueryStatus + - QueryResults + - Computer + - EventCode + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml new file mode 100644 index 0000000000..9f1862211d --- /dev/null +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -0,0 +1,49 @@ +name: Wermgr Process Create Executable File +id: ab3bcce0-a105-11eb-973c-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect potential malicious wermgr.exe process + that drops or create executable file. Since wermgr.exe is an application trigger + when error encountered in a process, it is really un ussual to this process to drop + executable file. This technique is commonly seen in trickbot malware where it injects + it code to this process to execute it malicious behavior like downloading other + payload +search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" + | stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename + process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `wermgr_process_create_executable_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - process_name + - dest + - EventCode + - ProcessId + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml new file mode 100644 index 0000000000..d3fa042588 --- /dev/null +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -0,0 +1,52 @@ +name: Wermgr Process Spawned CMD Or Powershell Process +id: e8fc95bc-a107-11eb-a978-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is designed to detect suspicious cmd and powershell process + spawned by wermgr.exe process. This suspicious behavior are commonly seen in code + injection technique technique like trickbot to execute a shellcode, dll modules + to run malicious behavior. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" + OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `wermgr_process_spawned_cmd_or_powershell_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process_id + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/write_executable_in_smb_share.yml new file mode 100644 index 0000000000..d48051c4d8 --- /dev/null +++ b/detections/endpoint/write_executable_in_smb_share.yml @@ -0,0 +1,49 @@ +name: Write Executable in SMB Share +id: f63c34fe-a435-11eb-935a-acde48001122 +version: 1 +date: '2021-04-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious dropping or creating an executable + file in known sensitive SMB share. This technique is commonly used for lateral movement + like how trickbot try to infect other machine in the infected network. This detection + catch the access event (FILE WRITE) access to a share. +search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") + Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= + "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode + Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also + required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Share_Name + - Relative_Target_Name + - Object_Type + - Access_Mask + - user + - src_port + - Source_Address + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log diff --git a/stories/trickbot.yml b/stories/trickbot.yml new file mode 100644 index 0000000000..13f988bd86 --- /dev/null +++ b/stories/trickbot.yml @@ -0,0 +1,24 @@ +name: Trickbot +id: 16f93769-8342-44c0-9b1d-f131937cce8e +version: 1 +date: '2021-04-20' +author: Rod Soto, Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the trickbot banking trojan, including looking for file writes associated + with its payload, process injection, shellcode execution and data collection even in LDAP environment. +narrative: trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known + in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal + Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data. +references: +- https://en.wikipedia.org/wiki/Trickbot +- https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/ +tags: + analytic_story: Trickbot + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/account_discovery_with_net_app.test.yml b/tests/endpoint/account_discovery_with_net_app.test.yml new file mode 100644 index 0000000000..3295365172 --- /dev/null +++ b/tests/endpoint/account_discovery_with_net_app.test.yml @@ -0,0 +1,12 @@ +name: Account Discovery With Net App Unit Test +tests: +- name: Account Discovery With Net App + file: endpoint/account_discovery_with_net_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml new file mode 100644 index 0000000000..7434e8c567 --- /dev/null +++ b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml @@ -0,0 +1,12 @@ +name: Powershell Remote Thread To Known Windows Process Unit Test +tests: +- name: Powershell Remote Thread To Known Windows Process + file: endpoint/powershell_remote_thread_to_known_windows_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml b/tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml new file mode 100644 index 0000000000..77411b2298 --- /dev/null +++ b/tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml @@ -0,0 +1,12 @@ +name: Schedule Task with Rundll32 Command Trigger Unit Test +tests: +- name: Schedule Task with Rundll32 Command Trigger + file: endpoint/schedule_task_with_rundll32_command_trigger.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/trickbot_named_pipe.test.yml b/tests/endpoint/trickbot_named_pipe.test.yml new file mode 100644 index 0000000000..a83bc0136f --- /dev/null +++ b/tests/endpoint/trickbot_named_pipe.test.yml @@ -0,0 +1,12 @@ +name: Trickbot Named Pipe Unit Test +tests: +- name: Trickbot Named Pipe + file: endpoint/trickbot_named_pipe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml new file mode 100644 index 0000000000..fe866594fe --- /dev/null +++ b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml @@ -0,0 +1,12 @@ +name: Wermgr Process Connecting To IP Check Web Services Unit Test +tests: +- name: Wermgr Process Connecting To IP Check Web Services + file: endpoint/wermgr_process_connecting_to_ip_check_web_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_create_executable_file.test.yml b/tests/endpoint/wermgr_process_create_executable_file.test.yml new file mode 100644 index 0000000000..0cf6b31dfb --- /dev/null +++ b/tests/endpoint/wermgr_process_create_executable_file.test.yml @@ -0,0 +1,12 @@ +name: Wermgr Process Create Executable File Unit Test +tests: +- name: Wermgr Process Create Executable File + file: endpoint/wermgr_process_create_executable_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml new file mode 100644 index 0000000000..02fd800a52 --- /dev/null +++ b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml @@ -0,0 +1,12 @@ +name: Wermgr Process Spawned CMD Or Powershell Process Unit Test +tests: +- name: Wermgr Process Spawned CMD Or Powershell Process + file: endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/write_executable_in_smb_share.test.yml b/tests/endpoint/write_executable_in_smb_share.test.yml new file mode 100644 index 0000000000..83a55cd08a --- /dev/null +++ b/tests/endpoint/write_executable_in_smb_share.test.yml @@ -0,0 +1,12 @@ +name: Write Executable in SMB Share Unit Test +tests: +- name: Write Executable in SMB Share + file: endpoint/write_executable_in_smb_share.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file