From 765e2cc3115296884046eed46afdca556c74e457 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 26 Apr 2021 17:01:03 +0200 Subject: [PATCH 01/17] trickbot --- ...remote_thread_to_known_windows_process.yml | 46 ++++++++++++++++ ...ule_task_with_rundll32_command_trigger.yml | 52 +++++++++++++++++++ detections/endpoint/trickbot_named_pipe.yml | 44 ++++++++++++++++ ...ss_connecting_to_ip_check_web_services.yml | 47 +++++++++++++++++ .../wermgr_process_create_executable_file.yml | 43 +++++++++++++++ ...cess_spawned_cmd_or_powershell_process.yml | 47 +++++++++++++++++ .../write_executable_in_smb_share.yml | 45 ++++++++++++++++ stories/trickbot.yml | 24 +++++++++ ...e_thread_to_known_windows_process.test.yml | 12 +++++ ...ask_with_rundll32_command_trigger.test.yml | 12 +++++ tests/endpoint/trickbot_named_pipe.test.yml | 12 +++++ ...nnecting_to_ip_check_web_services.test.yml | 12 +++++ ...gr_process_create_executable_file.test.yml | 12 +++++ ...spawned_cmd_or_powershell_process.test.yml | 12 +++++ .../write_executable_in_smb_share.test.yml | 12 +++++ 15 files changed, 432 insertions(+) create mode 100644 detections/endpoint/powershell_remote_thread_to_known_windows_process.yml create mode 100644 detections/endpoint/schedule_task_with_rundll32_command_trigger.yml create mode 100644 detections/endpoint/trickbot_named_pipe.yml create mode 100644 detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml create mode 100644 detections/endpoint/wermgr_process_create_executable_file.yml create mode 100644 detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml create mode 100644 detections/endpoint/write_executable_in_smb_share.yml create mode 100644 stories/trickbot.yml create mode 100644 tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml create mode 100644 tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml create mode 100644 tests/endpoint/trickbot_named_pipe.test.yml create mode 100644 tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml create mode 100644 tests/endpoint/wermgr_process_create_executable_file.test.yml create mode 100644 tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml create mode 100644 tests/endpoint/write_executable_in_smb_share.test.yml diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml new file mode 100644 index 0000000000..807276fd8d --- /dev/null +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -0,0 +1,46 @@ +name: Powershell Remote Thread To Known Windows Process +id: ec102cb2-a0f5-11eb-9b38-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. + This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload +search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") + TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") + | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_remote_thread_to_known_windows_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, Create Remote thread from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of create remote thread may be used. +known_false_positives: unknown +references: +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - process_name + - SourceProcessId + - SourceProcessGuid + - TargetImage + - TargetProcessId + - NewThreadId + - StartAddress + - Computer + - EventCode + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml new file mode 100644 index 0000000000..bd5fe2d1bd --- /dev/null +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -0,0 +1,52 @@ +name: Schedule Task with Rundll32 Command Trigger +id: 75b00fd8-a0ff-11eb-8b31-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, + to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. + The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. + Identify any parallel processes within the same timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 + | xmlkv Message + | search Command IN ("*rundll32*") + | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `schedule_task_with_rundll32_command_trigger_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the task schedule (Exa. Security Log EventCode 4698) + endpoints. Tune and filter known instances of Task schedule used in your environment. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Windows Persistence Techniques + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Command + - Author + - Enabled + - Hidden + - Arguments + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml new file mode 100644 index 0000000000..14cb7dc608 --- /dev/null +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -0,0 +1,44 @@ +name: Trickbot Named Pipe +id: 1804b0a4-a682-11eb-8f68-acde48001122 +version: 1 +date: '2021-04-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential trickbot infection through the create/connected named pipe to the system. + This technique is used by trickbot to communicate to its c2 to post or get command during infection. +search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" + | stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `trickbot_named_pipe_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and pipename from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. . +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - user_id + - EventCode + - PipeName + - signature + - Image + - process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml new file mode 100644 index 0000000000..bc3595b84b --- /dev/null +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -0,0 +1,47 @@ +name: Wermgr Process Connecting To IP Check Web Services +id: ed313326-a0f9-11eb-a89c-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. + This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. + Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. +search: '`sysmon` EventCode =22 process_name = wermgr.exe + QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", + "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") + | stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wermgr_process_connecting_to_ip_check_web_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, dns query name process path , and query ststus from your + endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1590.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_path + - process_name + - process_id + - QueryName + - QueryStatus + - QueryResults + - Computer + - EventCode + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml new file mode 100644 index 0000000000..96b314caea --- /dev/null +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -0,0 +1,43 @@ +name: Wermgr Process Create Executable File +id: ab3bcce0-a105-11eb-973c-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. + Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. + This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload +search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" + | stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename process_name dest EventCode ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wermgr_process_create_executable_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1027 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - process_name + - dest + - EventCode + - ProcessId + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml new file mode 100644 index 0000000000..e0ed900827 --- /dev/null +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -0,0 +1,47 @@ +name: Wermgr Process Spawned CMD Or Powershell Process +id: e8fc95bc-a107-11eb-a978-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. + This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" + by Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wermgr_process_spawned_cmd_or_powershell_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process_id + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/write_executable_in_smb_share.yml new file mode 100644 index 0000000000..b3be66dd74 --- /dev/null +++ b/detections/endpoint/write_executable_in_smb_share.yml @@ -0,0 +1,45 @@ +name: Write Executable in SMB Share +id: f63c34fe-a435-11eb-935a-acde48001122 +version: 1 +date: '2021-04-23' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. + This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. + This detection catch the access event (FILE WRITE) access to a share. +search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" + | stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `write_executable_in_smb_share_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also + required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: unknown +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Share_Name + - Relative_Target_Name + - Object_Type + - Access_Mask + - user + - src_port + - Source_Address + security_domain: endpoint \ No newline at end of file diff --git a/stories/trickbot.yml b/stories/trickbot.yml new file mode 100644 index 0000000000..13f988bd86 --- /dev/null +++ b/stories/trickbot.yml @@ -0,0 +1,24 @@ +name: Trickbot +id: 16f93769-8342-44c0-9b1d-f131937cce8e +version: 1 +date: '2021-04-20' +author: Rod Soto, Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the trickbot banking trojan, including looking for file writes associated + with its payload, process injection, shellcode execution and data collection even in LDAP environment. +narrative: trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known + in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal + Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data. +references: +- https://en.wikipedia.org/wiki/Trickbot +- https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/ +tags: + analytic_story: Trickbot + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml new file mode 100644 index 0000000000..7434e8c567 --- /dev/null +++ b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml @@ -0,0 +1,12 @@ +name: Powershell Remote Thread To Known Windows Process Unit Test +tests: +- name: Powershell Remote Thread To Known Windows Process + file: endpoint/powershell_remote_thread_to_known_windows_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml b/tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml new file mode 100644 index 0000000000..77411b2298 --- /dev/null +++ b/tests/endpoint/schedule_task_with_rundll32_command_trigger.test.yml @@ -0,0 +1,12 @@ +name: Schedule Task with Rundll32 Command Trigger Unit Test +tests: +- name: Schedule Task with Rundll32 Command Trigger + file: endpoint/schedule_task_with_rundll32_command_trigger.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/trickbot_named_pipe.test.yml b/tests/endpoint/trickbot_named_pipe.test.yml new file mode 100644 index 0000000000..a83bc0136f --- /dev/null +++ b/tests/endpoint/trickbot_named_pipe.test.yml @@ -0,0 +1,12 @@ +name: Trickbot Named Pipe Unit Test +tests: +- name: Trickbot Named Pipe + file: endpoint/trickbot_named_pipe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml new file mode 100644 index 0000000000..fe866594fe --- /dev/null +++ b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml @@ -0,0 +1,12 @@ +name: Wermgr Process Connecting To IP Check Web Services Unit Test +tests: +- name: Wermgr Process Connecting To IP Check Web Services + file: endpoint/wermgr_process_connecting_to_ip_check_web_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_create_executable_file.test.yml b/tests/endpoint/wermgr_process_create_executable_file.test.yml new file mode 100644 index 0000000000..0cf6b31dfb --- /dev/null +++ b/tests/endpoint/wermgr_process_create_executable_file.test.yml @@ -0,0 +1,12 @@ +name: Wermgr Process Create Executable File Unit Test +tests: +- name: Wermgr Process Create Executable File + file: endpoint/wermgr_process_create_executable_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml new file mode 100644 index 0000000000..02fd800a52 --- /dev/null +++ b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml @@ -0,0 +1,12 @@ +name: Wermgr Process Spawned CMD Or Powershell Process Unit Test +tests: +- name: Wermgr Process Spawned CMD Or Powershell Process + file: endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/write_executable_in_smb_share.test.yml b/tests/endpoint/write_executable_in_smb_share.test.yml new file mode 100644 index 0000000000..83a55cd08a --- /dev/null +++ b/tests/endpoint/write_executable_in_smb_share.test.yml @@ -0,0 +1,12 @@ +name: Write Executable in SMB Share Unit Test +tests: +- name: Write Executable in SMB Share + file: endpoint/write_executable_in_smb_share.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file From 051c6f9cfa3609af816066b820f47a825f1a5c5c Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 26 Apr 2021 17:19:41 +0200 Subject: [PATCH 02/17] trickbot_1 --- detections/endpoint/attempt_to_stop_security_service.yml | 1 + detections/endpoint/cobalt_strike_named_pipes.yml | 1 + .../endpoint/office_application_spawn_rundll32_process.yml | 1 + detections/endpoint/office_document_executing_macro_code.yml | 1 + .../powershell_remote_thread_to_known_windows_process.yml | 1 + detections/endpoint/suspicious_rundll32_startw.yml | 1 + 6 files changed, 6 insertions(+) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index d20d1cc89a..6c0655b9d5 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -31,6 +31,7 @@ references: [] tags: analytic_story: - Disabling Security Tools + - Trickbot asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 79999603b7..e8b8cd15e7 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -39,6 +39,7 @@ references: tags: analytic_story: - Cobalt Strike + - Trickbot asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index ed86253761..88e70a1cb7 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Trickbot automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 5f3ea89876..8b39e4875b 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Trickbot automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 807276fd8d..7588fc5c4b 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. Tune and filter known instances of create remote thread may be used. known_false_positives: unknown references: +- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ tags: analytic_story: - Trickbot diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index b5846eae39..1c24057ef8 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -36,6 +36,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Cobalt Strike + - Trickbot asset_type: Endpoint automated_detection_testing: passed cis20: From 4f0dbbe5f68802ffcc9919f9e795ab0f7c7a7a3c Mon Sep 17 00:00:00 2001 From: root Date: Tue, 27 Apr 2021 13:34:47 +0000 Subject: [PATCH 03/17] Added detection testing service results inSchedule Task with Rundll32 Command Trigger --- ...ule_task_with_rundll32_command_trigger.yml | 42 +++++++++++-------- 1 file changed, 24 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index bd5fe2d1bd..4a054d44b5 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -6,24 +6,27 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, - to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. - The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ - schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. - If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ - Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. - Identify any parallel processes within the same timeframe to identify source.' -search: '`wineventlog_security` EventCode=4698 - | xmlkv Message - | search Command IN ("*rundll32*") - | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `schedule_task_with_rundll32_command_trigger_filter`' +description: The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with a command to be executed with a Rundll32. This + technique is common in new trickbot that uses rundll32 to load is trickbot downloader. + The search will return the first time and last time the task was registered, as + well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or + TaskService is launched -`taskschd.dll`. If found loaded by another process, it + is possible a scheduled task is being registered within that process context in + memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or + via TaskService? Review the job created and the Command to be executed. Capture + any artifacts on disk and review. Identify any parallel processes within the same + timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN + ("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, + Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `schedule_task_with_rundll32_command_trigger_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the task schedule (Exa. Security Log EventCode 4698) - endpoints. Tune and filter known instances of Task schedule used in your environment. + logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and + filter known instances of Task schedule used in your environment. known_false_positives: unknown references: - https://labs.vipre.com/trickbot-and-its-modules/ @@ -49,4 +52,7 @@ tags: - Enabled - Hidden - Arguments - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log From 4ace6d2556bbba6640294b3bf840172dddcdcec0 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 27 Apr 2021 13:51:45 +0000 Subject: [PATCH 04/17] Added detection testing service results inTrickbot Named Pipe --- detections/endpoint/trickbot_named_pipe.yml | 22 +++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 14cb7dc608..6296d6fc9b 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -6,17 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential trickbot infection through the create/connected named pipe to the system. - This technique is used by trickbot to communicate to its c2 to post or get command during infection. -search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" - | stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: this search is to detect potential trickbot infection through the create/connected + named pipe to the system. This technique is used by trickbot to communicate to its + c2 to post or get command during infection. +search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats min(_time) + as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName + signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and pipename from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. . + logs with the process name and pipename from your endpoints. If you are using Sysmon, + you must have at least version 6.0.4 of the Sysmon TA. . known_false_positives: unknown references: - https://labs.vipre.com/trickbot-and-its-modules/ @@ -41,4 +40,7 @@ tags: - signature - Image - process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log From b54eec9d68e7034caa16ebcc8c4bf13263ec9d75 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 27 Apr 2021 14:01:03 +0000 Subject: [PATCH 05/17] Added detection testing service results inWrite Executable in SMB Share --- .../write_executable_in_smb_share.yml | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/write_executable_in_smb_share.yml index b3be66dd74..d48051c4d8 100644 --- a/detections/endpoint/write_executable_in_smb_share.yml +++ b/detections/endpoint/write_executable_in_smb_share.yml @@ -6,14 +6,15 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. - This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. - This detection catch the access event (FILE WRITE) access to a share. -search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" - | stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `write_executable_in_smb_share_filter`' +description: This search is to detect suspicious dropping or creating an executable + file in known sensitive SMB share. This technique is commonly used for lateral movement + like how trickbot try to infect other machine in the infected network. This detection + catch the access event (FILE WRITE) access to a share. +search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") + Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= + "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode + Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. @@ -41,5 +42,8 @@ tags: - Access_Mask - user - src_port - - Source_Address - security_domain: endpoint \ No newline at end of file + - Source_Address + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log From a845ca2f0d16889e6478b0b619bebb16d55be0cd Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 30 Apr 2021 12:15:04 +0200 Subject: [PATCH 06/17] minor_mod --- .../endpoint/office_application_spawn_rundll32_process.yml | 4 ++-- .../endpoint/office_document_creating_schedule_task.yml | 4 ++-- detections/endpoint/office_document_executing_macro_code.yml | 4 ++-- .../office_document_spawned_child_process_to_download.yml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 88e70a1cb7..c1664fec36 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -13,8 +13,8 @@ description: this detection was designed to identifies suspicious spawned proces search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name - = "wordpad.exe") Processes.process_name=rundll32.exe by Processes.parent_process + = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") + Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`' diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index 5bb6b7f560..bd66ddc533 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -19,8 +19,8 @@ description: this search detects a potential malicious office document that crea source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", - "wordpad.exe") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") + ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 8b39e4875b..b72b4aefb4 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -13,8 +13,8 @@ description: this detection was designed to identifies suspicious office documen or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", - "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") + ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index f3608c78e7..41a8700f93 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -11,7 +11,7 @@ description: this search is to detect potential malicious office document execut abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", - "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName + "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode From 7ed813a01ca7cca477137c6040c1d3dac098ddbe Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 30 Apr 2021 13:05:20 +0200 Subject: [PATCH 07/17] pw --- .../powershell_remote_thread_to_known_windows_process.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml index 7434e8c567..11252bce22 100644 --- a/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml +++ b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/trickbot_inf/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 74c4a949c6920de36a73997d35324d74b0b0c699 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 3 May 2021 15:08:35 +0200 Subject: [PATCH 08/17] mod_test --- .../wermgr_process_connecting_to_ip_check_web_services.test.yml | 2 +- tests/endpoint/wermgr_process_create_executable_file.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml index fe866594fe..1376e9b240 100644 --- a/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml +++ b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.005/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_create_executable_file.test.yml b/tests/endpoint/wermgr_process_create_executable_file.test.yml index 0cf6b31dfb..d5cad9a427 100644 --- a/tests/endpoint/wermgr_process_create_executable_file.test.yml +++ b/tests/endpoint/wermgr_process_create_executable_file.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/trickbot_drop/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 6fff5cd15527ae7bbe24f55f43830a58b539e03c Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 3 May 2021 15:20:24 +0200 Subject: [PATCH 09/17] new_tst --- .../wermgr_process_spawned_cmd_or_powershell_process.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml index 02fd800a52..bd11c7277c 100644 --- a/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml +++ b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/trickbot_cmd_powershell/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 66556b135d79c57b02c45f2d524729c724976240 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 3 May 2021 17:12:24 +0200 Subject: [PATCH 10/17] test_tr --- .../powershell_remote_thread_to_known_windows_process.test.yml | 2 +- .../wermgr_process_connecting_to_ip_check_web_services.test.yml | 2 +- tests/endpoint/wermgr_process_create_executable_file.test.yml | 2 +- .../wermgr_process_spawned_cmd_or_powershell_process.test.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml index 11252bce22..7434e8c567 100644 --- a/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml +++ b/tests/endpoint/powershell_remote_thread_to_known_windows_process.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/trickbot_inf/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog diff --git a/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml index 1376e9b240..fe866594fe 100644 --- a/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml +++ b/tests/endpoint/wermgr_process_connecting_to_ip_check_web_services.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.005/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_create_executable_file.test.yml b/tests/endpoint/wermgr_process_create_executable_file.test.yml index d5cad9a427..0cf6b31dfb 100644 --- a/tests/endpoint/wermgr_process_create_executable_file.test.yml +++ b/tests/endpoint/wermgr_process_create_executable_file.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/trickbot_drop/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml index bd11c7277c..02fd800a52 100644 --- a/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml +++ b/tests/endpoint/wermgr_process_spawned_cmd_or_powershell_process.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/trickbot_cmd_powershell/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 8386cfd475cdcef8e3b4936bc182d01f2ddb2d4f Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 May 2021 15:42:03 +0000 Subject: [PATCH 11/17] Added detection testing service results inWermgr Process Spawned CMD Or Powershell Process --- ...cess_spawned_cmd_or_powershell_process.yml | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index e0ed900827..d3fa042588 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. - This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. -search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" - by Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is designed to detect suspicious cmd and powershell process + spawned by wermgr.exe process. This suspicious behavior are commonly seen in code + injection technique technique like trickbot to execute a shellcode, dll modules + to run malicious behavior. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" + OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_spawned_cmd_or_powershell_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://labs.vipre.com/trickbot-and-its-modules/ @@ -43,5 +45,8 @@ tags: - Processes.process_id - Processes.process_guid - Processes.dest - - Processes.user - security_domain: endpoint \ No newline at end of file + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log From fe36e285e501896affd0e8a6e4f6a3ed10757b00 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 May 2021 16:04:17 +0000 Subject: [PATCH 12/17] Added detection testing service results inPowershell Remote Thread To Known Windows Process --- ...remote_thread_to_known_windows_process.yml | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 7588fc5c4b..2ce7201b9d 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -6,18 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. - This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload -search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") - TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") - | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: this search is designed to detect suspicious powershell process that + tries to inject code and to known/critical windows process and execute it using + CreateRemoteThread. This technique is seen in several malware like trickbot and + offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to + execute reverse shell to c2 and download another payload +search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") + TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") + | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name + SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress + Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, Create Remote thread from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of create remote thread may be used. + logs with the process name, Create Remote thread from your endpoints. If you are + using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter + known instances of create remote thread may be used. known_false_positives: unknown references: - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ @@ -44,4 +47,7 @@ tags: - StartAddress - Computer - EventCode - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log From ecfecd44f7e47acd3bf159ca8c4413651ba8ee59 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 May 2021 16:29:11 +0000 Subject: [PATCH 13/17] Added detection testing service results inWermgr Process Create Executable File --- .../wermgr_process_create_executable_file.yml | 32 +++++++++++-------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 96b314caea..9f1862211d 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -6,13 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. - Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. - This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload -search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" - | stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename process_name dest EventCode ProcessId - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `wermgr_process_create_executable_file_filter`' +description: this search is designed to detect potential malicious wermgr.exe process + that drops or create executable file. Since wermgr.exe is an application trigger + when error encountered in a process, it is really un ussual to this process to drop + executable file. This technique is commonly seen in trickbot malware where it injects + it code to this process to execute it malicious behavior like downloading other + payload +search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" + | stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename + process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `wermgr_process_create_executable_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -34,10 +37,13 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - TargetFilename - - process_name - - dest - - EventCode + - Image + - TargetFilename + - process_name + - dest + - EventCode - ProcessId - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log From 0ef9cb112222ddd2aaf05854c44d61cd43896fc0 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 May 2021 16:48:23 +0000 Subject: [PATCH 14/17] Added detection testing service results inWermgr Process Connecting To IP Check Web Services --- ...ss_connecting_to_ip_check_web_services.yml | 34 ++++++++++++------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index bc3595b84b..693331f4be 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -6,19 +6,24 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. - This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. - Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. -search: '`sysmon` EventCode =22 process_name = wermgr.exe - QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", - "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") - | stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `wermgr_process_connecting_to_ip_check_web_services_filter`' +description: this search is designed to detect suspicious wermgr.exe process that + tries to connect to known IP web services. This technique is know for trickbot and + other trojan spy malware to recon the infected machine and look for its ip address + without so much finger print on the commandline process. Since wermgr.exe is designed + for error handling process of windows it is really suspicious that this process + is trying to connect to this IP web services cause that maybe cause of some malicious + code injection. +search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", + "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", + "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", + "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") + | stats min(_time) as firstTime max(_time) as lastTime count by process_path + process_name process_id QueryName QueryStatus QueryResults Computer EventCode | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, dns query name process path , and query ststus from your - endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. + logs with the process name, dns query name process path , and query ststus from + your endpoints like EventCode 22. If you are using Sysmon, you must have at least + version 12 of the Sysmon TA. known_false_positives: unknown references: - https://labs.vipre.com/trickbot-and-its-modules/ @@ -44,4 +49,7 @@ tags: - QueryResults - Computer - EventCode - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log From 9250aca10fecabe26d09ccbd41a03700c9f46e32 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 3 May 2021 19:36:17 +0200 Subject: [PATCH 15/17] net --- .../account_discovery_with_net_app.yml | 50 +++++++++++++++++++ .../account_discovery_with_net_app.test.yml | 12 +++++ 2 files changed, 62 insertions(+) create mode 100644 detections/endpoint/account_discovery_with_net_app.yml create mode 100644 tests/endpoint/account_discovery_with_net_app.test.yml diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml new file mode 100644 index 0000000000..96766208fc --- /dev/null +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -0,0 +1,50 @@ +name: Account Discovery With Net App +id: 339805ce-ac30-11eb-b87d-acde48001122 +version: 1 +date: '2021-05-03' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. + This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. + This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") + by Processes.process_name Processes.dest Processes.user Processes.parent_process_name + | where count >=5 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `account_discovery_with_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: admin or power user may used this series of command. +references: +- https://labs.vipre.com/trickbot-and-its-modules/ +- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +tags: + analytic_story: + - Trickbot + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process_id + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/account_discovery_with_net_app.test.yml b/tests/endpoint/account_discovery_with_net_app.test.yml new file mode 100644 index 0000000000..3295365172 --- /dev/null +++ b/tests/endpoint/account_discovery_with_net_app.test.yml @@ -0,0 +1,12 @@ +name: Account Discovery With Net App Unit Test +tests: +- name: Account Discovery With Net App + file: endpoint/account_discovery_with_net_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From f4e25f9d5cb237efe61ef531e894e684c5ead6c3 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 3 May 2021 19:40:55 +0200 Subject: [PATCH 16/17] minor --- detections/endpoint/account_discovery_with_net_app.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 96766208fc..8849156bbf 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -32,7 +32,7 @@ tags: kill_chain_phases: - Exploitation mitre_attack_id: - - T1059 + - T1087.002 product: - Splunk Enterprise - Splunk Enterprise Security From 652c3861886660f8732a2af156884fad7eee1ea8 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 3 May 2021 18:08:30 +0000 Subject: [PATCH 17/17] Added detection testing service results inAccount Discovery With Net App --- .../account_discovery_with_net_app.yml | 34 +++++++++++-------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 8849156bbf..748ec8b65a 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -6,18 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. - This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. - This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") - by Processes.process_name Processes.dest Processes.user Processes.parent_process_name - | where count >=5 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `account_discovery_with_net_app_filter`' +description: this search is to detect a potential account discovery series of command + used by several malware or attack to recon the target machine. This technique is + also seen in some note worthy malware like trickbot where it runs a cmd process, + or even drop its module that will execute the said series of net command. This series + of command are good correlation search and indicator of attacker recon if seen in + the machines within a none technical user or department (HR, finance, ceo and etc) + network. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND + (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view + /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name + | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -46,5 +49,8 @@ tags: - Processes.process_id - Processes.process_guid - Processes.dest - - Processes.user - security_domain: endpoint \ No newline at end of file + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log