From b24b66f05444b13a293ab4616ec3839a4ba55a75 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 26 Aug 2022 12:03:46 +0200 Subject: [PATCH 1/8] brute-ratel-1 --- ..._or_script_creation_in_suspicious_path.yml | 1 + .../endpoint/modification_of_wallpaper.yml | 1 + .../endpoint/suspicious_process_file_path.yml | 1 + .../windows_iso_lnk_file_creation.yml | 1 + ...e_created_with_suspicious_service_path.yml | 68 ------------------- ..._service_creation_using_registry_entry.yml | 1 + ...ated_with_suspicious_service_path.test.yml | 12 ---- 7 files changed, 5 insertions(+), 80 deletions(-) delete mode 100644 detections/endpoint/windows_service_created_with_suspicious_service_path.yml delete mode 100644 tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 14cce5e19f..248106dffb 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -44,6 +44,7 @@ tags: - Industroyer2 - Azorult - DarkCrystal RAT + - Brute Ratel C4 automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 279433dd8c..38ccf17f52 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -29,6 +29,7 @@ tags: - Revil Ransomware - BlackMatter Ransomware - Windows Registry Abuse + - Brute Ratel C4 confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index d5cc4c4d33..1bb5a1c902 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -40,6 +40,7 @@ tags: - Hermetic Wiper - Industroyer2 - DarkCrystal RAT + - Brute Ratel C4 automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index 73c352f48f..74a3df3852 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -22,6 +22,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Brute Ratel C4 asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml deleted file mode 100644 index 5be65564e7..0000000000 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Windows Service Created With Suspicious Service Path -id: 429141be-8311-11eb-adb6-acde48001122 -version: 2 -date: '2021-11-22' -author: Teoderick Contreras, Mauricio Velazco, Splunk -type: TTP -datamodel: [] -description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`, - to identify the creation of a Windows Service where the service binary path path - is located in a non-common Service folder in Windows. Red Teams and adversaries - alike may create malicious Services for lateral movement or remote code execution - as well as persistence and execution. The Clop ransomware has also been seen in - the wild abusing Windows services. -search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name - IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name - Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the Service name, Service File Name Service Start type, and Service Type - from your endpoints. -known_false_positives: Legitimate applications may install services with uncommon - services paths. -references: -- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -tags: - analytic_story: - - Clop Ransomware - - Active Directory Lateral Movement - confidence: 80 - context: - - Source:Endpoint - - Stage:Privilege Escalation - - Stage:Lateral Movement - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log - impact: 70 - kill_chain_phases: - - Exploitation - message: A service $Service_File_Name$ was created from a non-standard path using - $Service_Name$ - mitre_attack_id: - - T1569 - - T1569.002 - observable: - - name: Service_File_Name - type: Other - role: - - Other - - name: Service_Name - type: Other - role: - - Other - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - EventCode - - Service_File_Name - - Service_Type - - _time - - Service_Name - - Service_Start_Type - risk_score: 56 - security_domain: endpoint - asset_type: Endpoint diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index c41790becd..725386a061 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -39,6 +39,7 @@ tags: - Suspicious Windows Registry Activities - Windows Persistence Techniques - Windows Registry Abuse + - Brute Ratel C4 cis20: - CIS 3 - CIS 5 diff --git a/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml deleted file mode 100644 index aa5b995982..0000000000 --- a/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Service Created With Suspicious Service Path Unit Test -tests: -- name: Windows Service Created With Suspicious Service Path - file: endpoint/windows_service_created_with_suspicious_service_path.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-system.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog From 044d38f3ac6f1114b6d09c4448e549052649b945 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 26 Aug 2022 12:06:24 +0200 Subject: [PATCH 2/8] brute-ratel-1 --- stories/brute_ratel.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 stories/brute_ratel.yml diff --git a/stories/brute_ratel.yml b/stories/brute_ratel.yml new file mode 100644 index 0000000000..0d9b326092 --- /dev/null +++ b/stories/brute_ratel.yml @@ -0,0 +1,27 @@ +name: Brute Ratel C4 (BRc4) +id: 0ec9dbfe-f64e-46bb-8eb8-04e92326f513 +version: 1 +date: '2022-08-23' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Brute Ratel Red teaming tool. This includes creation, modification and deletion of services, + collection or data, ping ip, dns cache, process injection, debug privileges adjustment, winlogon process duplicate token, + lock workstation, get clipboard or screenshot and so on. +narrative: Brute RATEL (BRC4) is one of the newest red-teaming tool that simulate several TTPS. It uses several Techniques + like syscall, patching etw/amsi and code everything in native C to minimize noise in process command line. This tool was seen + in the wild being abused by some ransomware (blackcat) and adversaries in their campaigs to install the BRC4 agent + that can server as remote admin tool to compromise the target host or network. +references: +- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ +tags: + analytic_story: Brute Ratel C4 + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 17c6d7ff3bfac3eb86edb88a99e6d99c7ffb068c Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 26 Aug 2022 12:07:53 +0200 Subject: [PATCH 3/8] brute-ratel-1 --- ...rvice_created_in_uncommon_service_path.yml | 69 +++++++++++++++++++ ..._created_in_uncommon_service_path.test.yml | 12 ++++ 2 files changed, 81 insertions(+) create mode 100644 detections/endpoint/windows_service_created_in_uncommon_service_path.yml create mode 100644 tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml diff --git a/detections/endpoint/windows_service_created_in_uncommon_service_path.yml b/detections/endpoint/windows_service_created_in_uncommon_service_path.yml new file mode 100644 index 0000000000..3eec07c3f7 --- /dev/null +++ b/detections/endpoint/windows_service_created_in_uncommon_service_path.yml @@ -0,0 +1,69 @@ +name: Windows Service Created In Uncommon Service Path +id: 429141be-8311-11eb-adb6-acde48001122 +version: 2 +date: '2021-11-22' +author: Teoderick Contreras, Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytics uses Windows Event Id 7045, `New Service Was Installed`, + to identify the creation of a Windows Service where the service binary path path + is located in a non-common Service folder in Windows. Red Teams and adversaries + alike may create malicious Services for lateral movement or remote code execution + as well as persistence and execution. The Clop ransomware has also been seen in + the wild abusing Windows services. +search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name + IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name + Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_created_in_uncommon_service_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: Legitimate applications may install services with uncommon + services paths. +references: +- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +tags: + analytic_story: + - Clop Ransomware + - Active Directory Lateral Movement + - Brute Ratel C4 + confidence: 80 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log + impact: 70 + kill_chain_phases: + - Exploitation + message: A service $Service_File_Name$ was created from a non-standard path using + $Service_Name$ + mitre_attack_id: + - T1569 + - T1569.002 + observable: + - name: Service_File_Name + type: Other + role: + - Other + - name: Service_Name + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - Service_File_Name + - Service_Type + - _time + - Service_Name + - Service_Start_Type + risk_score: 56 + security_domain: endpoint + asset_type: Endpoint diff --git a/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml b/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml new file mode 100644 index 0000000000..e6d8415ab1 --- /dev/null +++ b/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml @@ -0,0 +1,12 @@ +name: Windows Service Created In Uncommon Service Path Unit Test +tests: +- name: Windows Service Created In Uncommon Service Path + file: endpoint/windows_service_created_in_uncommon_service_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog From c1ae64ed368c9baf58bd47b76583a909baa4759b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 26 Aug 2022 12:10:46 +0200 Subject: [PATCH 4/8] Update brute_ratel.yml --- stories/brute_ratel.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/brute_ratel.yml b/stories/brute_ratel.yml index 0d9b326092..09231d6aea 100644 --- a/stories/brute_ratel.yml +++ b/stories/brute_ratel.yml @@ -1,4 +1,4 @@ -name: Brute Ratel C4 (BRc4) +name: Brute Ratel C4 BRc4 id: 0ec9dbfe-f64e-46bb-8eb8-04e92326f513 version: 1 date: '2022-08-23' @@ -7,7 +7,7 @@ description: Leverage searches that allow you to detect and investigate unusual that might relate to the Brute Ratel Red teaming tool. This includes creation, modification and deletion of services, collection or data, ping ip, dns cache, process injection, debug privileges adjustment, winlogon process duplicate token, lock workstation, get clipboard or screenshot and so on. -narrative: Brute RATEL (BRC4) is one of the newest red-teaming tool that simulate several TTPS. It uses several Techniques +narrative: Brute RATEL BRC4 is one of the newest red-teaming tool that simulate several TTPS. It uses several Techniques like syscall, patching etw/amsi and code everything in native C to minimize noise in process command line. This tool was seen in the wild being abused by some ransomware (blackcat) and adversaries in their campaigs to install the BRC4 agent that can server as remote admin tool to compromise the target host or network. @@ -24,4 +24,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection From 510ece0c701f66c90edadf7b0fe1d4a5ab936296 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 26 Aug 2022 08:02:32 -0600 Subject: [PATCH 5/8] Updates --- ...ws_service_created_in_uncommon_service_path.yml | 4 ++-- stories/brute_ratel.yml | 14 +++++++------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/windows_service_created_in_uncommon_service_path.yml b/detections/endpoint/windows_service_created_in_uncommon_service_path.yml index 3eec07c3f7..6fcd2c3111 100644 --- a/detections/endpoint/windows_service_created_in_uncommon_service_path.yml +++ b/detections/endpoint/windows_service_created_in_uncommon_service_path.yml @@ -1,7 +1,7 @@ name: Windows Service Created In Uncommon Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: 2 -date: '2021-11-22' +version: 3 +date: '2022-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] diff --git a/stories/brute_ratel.yml b/stories/brute_ratel.yml index 09231d6aea..b9adf892d6 100644 --- a/stories/brute_ratel.yml +++ b/stories/brute_ratel.yml @@ -4,13 +4,13 @@ version: 1 date: '2022-08-23' author: Teoderick Contreras, Splunk description: Leverage searches that allow you to detect and investigate unusual activities - that might relate to the Brute Ratel Red teaming tool. This includes creation, modification and deletion of services, - collection or data, ping ip, dns cache, process injection, debug privileges adjustment, winlogon process duplicate token, - lock workstation, get clipboard or screenshot and so on. -narrative: Brute RATEL BRC4 is one of the newest red-teaming tool that simulate several TTPS. It uses several Techniques - like syscall, patching etw/amsi and code everything in native C to minimize noise in process command line. This tool was seen - in the wild being abused by some ransomware (blackcat) and adversaries in their campaigs to install the BRC4 agent - that can server as remote admin tool to compromise the target host or network. + that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, + collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, + lock workstation, get clipboard or screenshot and much more. +narrative: Brute RATEL BRC4 is the latest red-teaming tool that simulate several TTP's. It uses several techniques + like syscall, patching ETW/AMSI and written in native C to minimize noise in process command-line. This tool was seen + in the wild being abused by some ransomware (blackcat) and adversaries in their campaigns to install the BRC4 agent + that can serve as remote admin tool to compromise the target host or network. references: - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ - https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ From b59f8ecd3428afaba6bdba5c9f86a0a0a5593285 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 29 Aug 2022 19:04:50 +0200 Subject: [PATCH 6/8] Update and rename windows_service_created_in_uncommon_service_path.yml to windows_service_created_with_suspicious_service_path.yml windows_service_created_with_suspicious_service_path_filter --- ... windows_service_created_with_suspicious_service_path.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{windows_service_created_in_uncommon_service_path.yml => windows_service_created_with_suspicious_service_path.yml} (96%) diff --git a/detections/endpoint/windows_service_created_in_uncommon_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml similarity index 96% rename from detections/endpoint/windows_service_created_in_uncommon_service_path.yml rename to detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 6fcd2c3111..c7e80d176a 100644 --- a/detections/endpoint/windows_service_created_in_uncommon_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,4 +1,4 @@ -name: Windows Service Created In Uncommon Service Path +name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 version: 3 date: '2022-08-26' @@ -15,7 +15,7 @@ search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_created_in_uncommon_service_path_filter`' + | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. From c79cb8f97bfd20a38ab992e00f55350cfe21daa1 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 29 Aug 2022 19:05:32 +0200 Subject: [PATCH 7/8] Update windows_service_created_in_uncommon_service_path.test.yml --- ...indows_service_created_in_uncommon_service_path.test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml b/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml index e6d8415ab1..aa5b995982 100644 --- a/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml +++ b/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml @@ -1,7 +1,7 @@ -name: Windows Service Created In Uncommon Service Path Unit Test +name: Windows Service Created With Suspicious Service Path Unit Test tests: -- name: Windows Service Created In Uncommon Service Path - file: endpoint/windows_service_created_in_uncommon_service_path.yml +- name: Windows Service Created With Suspicious Service Path + file: endpoint/windows_service_created_with_suspicious_service_path.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 34c6bb18873b52cda940204e9de406b80b779c6d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 29 Aug 2022 19:09:19 +0200 Subject: [PATCH 8/8] Rename windows_service_created_in_uncommon_service_path.test.yml to windows_service_created_with_suspicious_service_path.test.yml --- ...windows_service_created_with_suspicious_service_path.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{windows_service_created_in_uncommon_service_path.test.yml => windows_service_created_with_suspicious_service_path.test.yml} (100%) diff --git a/tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml b/tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml similarity index 100% rename from tests/endpoint/windows_service_created_in_uncommon_service_path.test.yml rename to tests/endpoint/windows_service_created_with_suspicious_service_path.test.yml