Branch was auto-updated.

detections/endpoint/recon_using_wmi_class.yml

@@ -27,10 +27,12 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
 tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - Industroyer2
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_hidden_schedule_task_settings.yml

@@ -0,0 +1,70 @@
+name: Windows Hidden Schedule Task Settings
+id: 0b730470-5fe8-4b13-93a7-fe0ad014d0cc
+version: 1
+date: '2022-04-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following query utilizes Windows Security EventCode 4698, 
+  A scheduled task was created, to identify suspicious tasks registered on 
+  Windows either via schtasks.exe OR TaskService with a hidden settings
+  that are unique entry of malware like industroyer2 or attack that uses 
+  lolbin to download other file or payload to the infected machine. 
+search: '`wineventlog_security` EventCode=4698
+  | xmlkv Message
+  | search Hidden = true
+  | stats count min(_time) as firstTime max(_time) as lastTime by  Task_Name, Command, Author, Hidden, dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_hidden_schedule_task_settings_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
+  filter known instances of Task schedule used in your environment.
+known_false_positives: unknown
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://cert.gov.ua/article/39518
+tags:
+  analytic_story:
+  - Industroyer2
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: A schedule task with hidden setting enable in host $dest$
+  mitre_attack_id:
+  - T1053
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Command
+  - Author
+  - Enabled
+  - Hidden
+  - Arguments
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_linked_policies_in_adsi_discovery.yml

@@ -0,0 +1,65 @@
+name: Windows Linked Policies In ADSI Discovery
+id: 510ea428-4731-4d2f-8829-a28293e427aa
+version: 1
+date: '2022-04-25'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
+  for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
+  domain organizational unit for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_linked_policies_in_adsi_discovery_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81
+tags:
+  analytic_story:
+  - Industroyer2
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
+  impact: 50
+  kill_chain_phases:
+  - Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  mitre_attack_id:
+  - T1087.002
+  - T1087
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ScriptBlockText
+  - Computer
+  - user_id
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml

@@ -0,0 +1,71 @@
+name: Windows Processes Killed By Industroyer2 Malware
+id: d8bea5ca-9d4a-4249-8b56-64a619109835
+version: 1
+date: '2022-04-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is to look for known processes killed by industroyer2 malware. 
+  This technique was seen in the industroyer2 malware attack that tries to kill several processes 
+  of windows host machines related to the energy facility network. This anomaly might be a good 
+  indicator to check which process kill these processes or why the process was killed.
+search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") 
+  | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
+  | `windows_processes_killed_by_industroyer2_malware_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: False positives are possible if legitimate applications are
+  allowed to terminate this process during testing or updates. Filter as needed based on paths that
+  are used legitimately.
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+tags:
+  analytic_story:
+  - Industroyer2
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: process was terminated $process_name$ in $dest$
+  mitre_attack_id:
+  - T1489
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid
+  risk_score: 36
+  security_domain: endpoint

detections/endpoint/windows_root_domain_linked_policies_discovery.yml

@@ -0,0 +1,65 @@
+name: Windows Root Domain linked policies Discovery
+id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c
+version: 1
+date: '2022-04-25'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
+  for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
+  root domain linked policies for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_root_domain_linked_policies_discovery_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
+- https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81
+tags:
+  analytic_story:
+  - Industroyer2
+  - Active Directory Discovery
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
+  impact: 50
+  kill_chain_phases:
+  - Reconnaissance
+  message: powershell process having commandline $Message$ for user enumeration
+  mitre_attack_id:
+  - T1087.002
+  - T1087
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ScriptBlockText
+  - Computer
+  - user_id
+  risk_score: 25
+  security_domain: endpoint

tests/endpoint/windows_hidden_schedule_task_settings.test.yml

@@ -0,0 +1,12 @@
+name: Windows Hidden Schedule Task Settings Unit Test
+tests:
+- name: Windows Hidden Schedule Task Settings
+  file: endpoint/windows_hidden_schedule_task_settings.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml

@@ -0,0 +1,12 @@
+name: Windows Linked Policies In ADSI Discovery Unit Test
+tests:
+- name: Windows Linked Policies In ADSI Discovery
+  file: endpoint/windows_linked_policies_in_adsi_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml2.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml

@@ -0,0 +1,12 @@
+name: Windows Processes Killed By Industroyer2 Malware Unit Test
+tests:
+- name: Windows Processes Killed By Industroyer2 Malware
+  file: endpoint/windows_processes_killed_by_industroyer2_malware.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml

@@ -0,0 +1,12 @@
+name: Windows Root Domain linked policies Discovery Unit Test
+tests:
+- name: Windows Root Domain linked policies Discovery
+  file: endpoint/windows_root_domain_linked_policies_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml1.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog