Branch was auto-updated.

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -0,0 +1,51 @@
+name: Office Application Spawn rundll32 process
+id: 958751e4-9c5f-11eb-b103-acde48001122
+version: 1
+date: '2021-04-13'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this detection was designed to identifies suspicious spawned process
+  of known MS office application due to macro or malicious code. this technique can
+  be seen in so many malware like trickbot that used MS office as its weapon or attack
+  vector to initially infect the machines.
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
+  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name
+  = "wordpad.exe") Processes.process_name=rundll32.exe  by Processes.parent_process
+  Processes.process_name Processes.process_id Processes.process_guid Processes.user
+  Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  | `office_application_spawn_rundll32_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://any.run/malware-trends/trickbot
+- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
+tags:
+  analytic_story:
+  - Phishing Payloads
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.process
+  - Processes.parent_process_name
+  - _time
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log

detections/endpoint/office_document_creating_schedule_task.yml

@@ -0,0 +1,59 @@
+name: Office Document Creating Schedule Task
+id: cc8b7b74-9d0f-11eb-8342-acde48001122
+version: 1
+date: '2021-04-14'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search detects a potential malicious office document that create
+  schedule task entry through macro VBA api or through loading taskschd.dll. This
+  technique was seen in so many malicious macro malware that create persistence ,
+  beaconing using task schedule malware entry The search will return the first time
+  and last time the task was registered, as well as the `Command` to be executed,
+  `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe
+  is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following
+  DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
+  If found loaded by another process, it's possible a scheduled task is being registered
+  within that process context in memory. Upon triage, identify the task scheduled
+  source. Was it schtasks.exe or via TaskService? Review the job created and the Command
+  to be executed. Capture any artifacts on disk and review. Identify any parallel
+  processes within the same timeframe to identify source.'
+search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE",
+  "wordpad.exe")  ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime
+  max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode
+  Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Also be sure to include those monitored dll to your own sysmon config.
+known_false_positives: unknown
+references:
+- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
+- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
+tags:
+  analytic_story:
+  - Phishing Payloads
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - ImageLoaded
+  - AllImageLoaded
+  - Computer
+  - EventCode
+  - Image
+  - process_name
+  - ProcessId
+  - ProcessGuid
+  - _time
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log

detections/endpoint/office_document_executing_macro_code.yml

@@ -0,0 +1,52 @@
+name: Office Document Executing Macro Code
+id: b12c89bc-9d06-11eb-a592-acde48001122
+version: 1
+date: '2021-04-14'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this detection was designed to identifies suspicious office documents
+  that using macro code. Macro code is known to be one of the prevalent weaponization
+  or attack vector of threat actor. This malicious macro code is embed to a office
+  document as an attachment that may execute malicious payload, download malware payload
+  or other malware component. It is really good practice to disable macro by default
+  to avoid automatically execute macro code while opening or closing a office document
+  files.
+search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE",
+  "wordpad.exe")  ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
+  | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded
+  count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Also be sure to include those monitored dll to your own sysmon config.
+known_false_positives: Normal Office Document macro use for automation
+references:
+- https://www.joesandbox.com/analysis/386500/0/html
+tags:
+  analytic_story:
+  - Phishing Payloads
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - ImageLoaded
+  - AllImageLoaded
+  - Computer
+  - EventCode
+  - Image
+  - process_name
+  - ProcessId
+  - ProcessGuid
+  - _time
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log

detections/endpoint/office_document_spawned_child_process_to_download.yml

@@ -0,0 +1,52 @@
+name: Office Document Spawned Child Process To Download
+id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
+version: 1
+date: '2021-04-16'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect potential malicious office document executing
+  lolbin child process to download payload or other malware. Since most of the attacker
+  abused the capability of office document to execute living on land application to
+  blend it to the normal noise in the infected machine to cover its track.
+search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
+  "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*")  NOT(OriginalFileName
+  IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
+  min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
+  parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances office application and browser may be
+  used.
+known_false_positives: default browser not in the filter list
+references:
+- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
+tags:
+  analytic_story:
+  - Phishing Payloads
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - parent_process_name
+  - process_name
+  - parent_process
+  - cmdline
+  - process_id
+  - OriginalFileName
+  - ProcessGuid
+  - Computer
+  - EventCode
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log

detections/endpoint/shedule_task_with_http_command_arguments.yml

@@ -0,0 +1,56 @@
+name: Shedule Task with HTTP Command Arguments
+id: 523c2684-a101-11eb-916b-acde48001122
+version: 1
+date: '2021-04-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following query utilizes Windows Security EventCode 4698, `A scheduled
+  task was created`, to identify suspicious tasks registered on Windows either via
+  schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry
+  of malware or attack that uses lolbin to download other file or payload to the infected
+  machine.\ The search will return the first time and last time the task was registered,
+  as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
+  it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32`
+  and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or
+  TaskService is launched -`taskschd.dll`. If found loaded by another process, it
+  is possible a scheduled task is being registered within that process context in
+  memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or
+  via TaskService? Review the job created and the Command to be executed. Capture
+  any artifacts on disk and review. Identify any parallel processes within the same
+  timeframe to identify source.'
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN
+  ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
+  Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `shedule_task_with_http_command_arguments_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
+  filter known instances of Task schedule used in your environment.
+known_false_positives: unknown
+references:
+- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1053
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Command
+  - Author
+  - Enabled
+  - Hidden
+  - Arguments
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log

tests/endpoint/office_application_spawn_rundll32_process.test.yml

@@ -0,0 +1,13 @@
+name: Office Application Spawn rundll32 process Unit Test
+tests:
+- name: Office Application Spawn rundll32 process
+  file: endpoint/office_application_spawn_rundll32_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+

tests/endpoint/office_document_creating_schedule_task.test.yml

@@ -0,0 +1,12 @@
+name: Office Document Creating Schedule Task Unit Test
+tests:
+- name: Office Document Creating Schedule Task
+  file: endpoint/office_document_creating_schedule_task.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_document_executing_macro_code.test.yml

@@ -0,0 +1,12 @@
+name: Office Document Executing Macro Code Unit Test
+tests:
+- name: Office Document Executing Macro Code
+  file: endpoint/office_document_executing_macro_code.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_document_spawned_child_process_to_download.test.yml

@@ -0,0 +1,12 @@
+name: Office Document Spawned Child Process To Download Unit Test
+tests:
+- name: Office Document Spawned Child Process To Download
+  file: endpoint/office_document_spawned_child_process_to_download.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/shedule_task_with_http_command_arguments.test.yml

@@ -0,0 +1,15 @@
+name: Shedule Task with HTTP Command Arguments Unit Test
+tests:
+- name: Shedule Task with HTTP Command Arguments
+  file: endpoint/shedule_task_with_http_command_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+
+
+