diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 2cccbb268a..7997fc0342 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -27,10 +27,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ tags: analytic_story: - Hermetic Wiper - Malicious PowerShell + - Industroyer2 confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml new file mode 100644 index 0000000000..2e55b57627 --- /dev/null +++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml @@ -0,0 +1,70 @@ +name: Windows Hidden Schedule Task Settings +id: 0b730470-5fe8-4b13-93a7-fe0ad014d0cc +version: 1 +date: '2022-04-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following query utilizes Windows Security EventCode 4698, + A scheduled task was created, to identify suspicious tasks registered on + Windows either via schtasks.exe OR TaskService with a hidden settings + that are unique entry of malware like industroyer2 or attack that uses + lolbin to download other file or payload to the infected machine. +search: '`wineventlog_security` EventCode=4698 + | xmlkv Message + | search Hidden = true + | stats count min(_time) as firstTime max(_time) as lastTime by Task_Name, Command, Author, Hidden, dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_hidden_schedule_task_settings_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and + filter known instances of Task schedule used in your environment. +known_false_positives: unknown +references: +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +- https://cert.gov.ua/article/39518 +tags: + analytic_story: + - Industroyer2 + - Active Directory Discovery + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log + impact: 80 + kill_chain_phases: + - Exploitation + message: A schedule task with hidden setting enable in host $dest$ + mitre_attack_id: + - T1053 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Command + - Author + - Enabled + - Hidden + - Arguments + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml new file mode 100644 index 0000000000..e9ae4599fc --- /dev/null +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -0,0 +1,65 @@ +name: Windows Linked Policies In ADSI Discovery +id: 510ea428-4731-4d2f-8829-a28293e427aa +version: 1 +date: '2022-04-25' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the `[Adsisearcher]` type accelerator being used to query Active Directory + for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate + domain organizational unit for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_linked_policies_in_adsi_discovery_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +- https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 +tags: + analytic_story: + - Industroyer2 + - Active Directory Discovery + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log + impact: 50 + kill_chain_phases: + - Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + mitre_attack_id: + - T1087.002 + - T1087 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ScriptBlockText + - Computer + - user_id + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml new file mode 100644 index 0000000000..fc55d84a0a --- /dev/null +++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml @@ -0,0 +1,71 @@ +name: Windows Processes Killed By Industroyer2 Malware +id: d8bea5ca-9d4a-4249-8b56-64a619109835 +version: 1 +date: '2022-04-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to look for known processes killed by industroyer2 malware. + This technique was seen in the industroyer2 malware attack that tries to kill several processes + of windows host machines related to the energy facility network. This anomaly might be a good + indicator to check which process kill these processes or why the process was killed. +search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") + | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `windows_processes_killed_by_industroyer2_malware_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: False positives are possible if legitimate applications are + allowed to terminate this process during testing or updates. Filter as needed based on paths that + are used legitimately. +references: +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +tags: + analytic_story: + - Industroyer2 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log + impact: 60 + kill_chain_phases: + - Exploitation + message: process was terminated $process_name$ in $dest$ + mitre_attack_id: + - T1489 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + - Processes.process_guid + risk_score: 36 + security_domain: endpoint diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml new file mode 100644 index 0000000000..be57e9229a --- /dev/null +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -0,0 +1,65 @@ +name: Windows Root Domain linked policies Discovery +id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c +version: 1 +date: '2022-04-25' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the `[Adsisearcher]` type accelerator being used to query Active Directory + for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate + root domain linked policies for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_root_domain_linked_policies_discovery_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ +- https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 +tags: + analytic_story: + - Industroyer2 + - Active Directory Discovery + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log + impact: 50 + kill_chain_phases: + - Reconnaissance + message: powershell process having commandline $Message$ for user enumeration + mitre_attack_id: + - T1087.002 + - T1087 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ScriptBlockText + - Computer + - user_id + risk_score: 25 + security_domain: endpoint diff --git a/tests/endpoint/windows_hidden_schedule_task_settings.test.yml b/tests/endpoint/windows_hidden_schedule_task_settings.test.yml new file mode 100644 index 0000000000..aae5a924b5 --- /dev/null +++ b/tests/endpoint/windows_hidden_schedule_task_settings.test.yml @@ -0,0 +1,12 @@ +name: Windows Hidden Schedule Task Settings Unit Test +tests: +- name: Windows Hidden Schedule Task Settings + file: endpoint/windows_hidden_schedule_task_settings.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml new file mode 100644 index 0000000000..654efa9de2 --- /dev/null +++ b/tests/endpoint/windows_linked_policies_in_adsi_discovery.test.yml @@ -0,0 +1,12 @@ +name: Windows Linked Policies In ADSI Discovery Unit Test +tests: +- name: Windows Linked Policies In ADSI Discovery + file: endpoint/windows_linked_policies_in_adsi_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml2.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml b/tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml new file mode 100644 index 0000000000..cc07733705 --- /dev/null +++ b/tests/endpoint/windows_processes_killed_by_industroyer2_malware.test.yml @@ -0,0 +1,12 @@ +name: Windows Processes Killed By Industroyer2 Malware Unit Test +tests: +- name: Windows Processes Killed By Industroyer2 Malware + file: endpoint/windows_processes_killed_by_industroyer2_malware.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml new file mode 100644 index 0000000000..8c27e137ad --- /dev/null +++ b/tests/endpoint/windows_root_domain_linked_policies_discovery.test.yml @@ -0,0 +1,12 @@ +name: Windows Root Domain linked policies Discovery Unit Test +tests: +- name: Windows Root Domain linked policies Discovery + file: endpoint/windows_root_domain_linked_policies_discovery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml1.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog