diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml new file mode 100644 index 0000000000..18f6283ebc --- /dev/null +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -0,0 +1,51 @@ +name: Office Application Spawn rundll32 process +id: 958751e4-9c5f-11eb-b103-acde48001122 +version: 1 +date: '2021-04-13' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious spawned process + of known MS office application due to macro or malicious code. this technique can + be seen in so many malware like trickbot that used MS office as its weapon or attack + vector to initially infect the machines. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name + = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name + = "wordpad.exe") Processes.process_name=rundll32.exe by Processes.parent_process + Processes.process_name Processes.process_id Processes.process_guid Processes.user + Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `office_application_spawn_rundll32_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://any.run/malware-trends/trickbot +- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe +tags: + analytic_story: + - Phishing Payloads + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Processes.process + - Processes.parent_process_name + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml new file mode 100644 index 0000000000..e19c0b7cb7 --- /dev/null +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -0,0 +1,59 @@ +name: Office Document Creating Schedule Task +id: cc8b7b74-9d0f-11eb-8342-acde48001122 +version: 1 +date: '2021-04-14' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search detects a potential malicious office document that create + schedule task entry through macro VBA api or through loading taskschd.dll. This + technique was seen in so many malicious macro malware that create persistence , + beaconing using task schedule malware entry The search will return the first time + and last time the task was registered, as well as the `Command` to be executed, + `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe + is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following + DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it's possible a scheduled task is being registered + within that process context in memory. Upon triage, identify the task scheduled + source. Was it schtasks.exe or via TaskService? Review the job created and the Command + to be executed. Capture any artifacts on disk and review. Identify any parallel + processes within the same timeframe to identify source.' +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", + "wordpad.exe") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime + max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode + Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: unknown +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +tags: + analytic_story: + - Phishing Payloads + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - ImageLoaded + - AllImageLoaded + - Computer + - EventCode + - Image + - process_name + - ProcessId + - ProcessGuid + - _time + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml new file mode 100644 index 0000000000..da2b5c9f3d --- /dev/null +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -0,0 +1,52 @@ +name: Office Document Executing Macro Code +id: b12c89bc-9d06-11eb-a592-acde48001122 +version: 1 +date: '2021-04-14' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious office documents + that using macro code. Macro code is known to be one of the prevalent weaponization + or attack vector of threat actor. This malicious macro code is embed to a office + document as an attachment that may execute malicious payload, download malware payload + or other malware component. It is really good practice to disable macro by default + to avoid automatically execute macro code while opening or closing a office document + files. +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", + "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") + | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded + count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: Normal Office Document macro use for automation +references: +- https://www.joesandbox.com/analysis/386500/0/html +tags: + analytic_story: + - Phishing Payloads + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - ImageLoaded + - AllImageLoaded + - Computer + - EventCode + - Image + - process_name + - ProcessId + - ProcessGuid + - _time + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml new file mode 100644 index 0000000000..b76f07bf38 --- /dev/null +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -0,0 +1,52 @@ +name: Office Document Spawned Child Process To Download +id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 +version: 1 +date: '2021-04-16' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential malicious office document executing + lolbin child process to download payload or other malware. Since most of the attacker + abused the capability of office document to execute living on land application to + blend it to the normal noise in the infected machine to cover its track. +search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", + "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName + IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats + min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name + parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances office application and browser may be + used. +known_false_positives: default browser not in the filter list +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/# +tags: + analytic_story: + - Phishing Payloads + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - parent_process_name + - process_name + - parent_process + - cmdline + - process_id + - OriginalFileName + - ProcessGuid + - Computer + - EventCode + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log diff --git a/detections/endpoint/shedule_task_with_http_command_arguments.yml b/detections/endpoint/shedule_task_with_http_command_arguments.yml new file mode 100644 index 0000000000..8624b3c950 --- /dev/null +++ b/detections/endpoint/shedule_task_with_http_command_arguments.yml @@ -0,0 +1,56 @@ +name: Shedule Task with HTTP Command Arguments +id: 523c2684-a101-11eb-916b-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry + of malware or attack that uses lolbin to download other file or payload to the infected + machine.\ The search will return the first time and last time the task was registered, + as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or + TaskService is launched -`taskschd.dll`. If found loaded by another process, it + is possible a scheduled task is being registered within that process context in + memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or + via TaskService? Review the job created and the Command to be executed. Capture + any artifacts on disk and review. Identify any parallel processes within the same + timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN + ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, + Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `shedule_task_with_http_command_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and + filter known instances of Task schedule used in your environment. +known_false_positives: unknown +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ +tags: + analytic_story: + - Windows Persistence Techniques + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Command + - Author + - Enabled + - Hidden + - Arguments + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log diff --git a/tests/endpoint/office_application_spawn_rundll32_process.test.yml b/tests/endpoint/office_application_spawn_rundll32_process.test.yml new file mode 100644 index 0000000000..528f74d283 --- /dev/null +++ b/tests/endpoint/office_application_spawn_rundll32_process.test.yml @@ -0,0 +1,13 @@ +name: Office Application Spawn rundll32 process Unit Test +tests: +- name: Office Application Spawn rundll32 process + file: endpoint/office_application_spawn_rundll32_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + diff --git a/tests/endpoint/office_document_creating_schedule_task.test.yml b/tests/endpoint/office_document_creating_schedule_task.test.yml new file mode 100644 index 0000000000..d26087261a --- /dev/null +++ b/tests/endpoint/office_document_creating_schedule_task.test.yml @@ -0,0 +1,12 @@ +name: Office Document Creating Schedule Task Unit Test +tests: +- name: Office Document Creating Schedule Task + file: endpoint/office_document_creating_schedule_task.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_document_executing_macro_code.test.yml b/tests/endpoint/office_document_executing_macro_code.test.yml new file mode 100644 index 0000000000..6330750cd6 --- /dev/null +++ b/tests/endpoint/office_document_executing_macro_code.test.yml @@ -0,0 +1,12 @@ +name: Office Document Executing Macro Code Unit Test +tests: +- name: Office Document Executing Macro Code + file: endpoint/office_document_executing_macro_code.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_document_spawned_child_process_to_download.test.yml b/tests/endpoint/office_document_spawned_child_process_to_download.test.yml new file mode 100644 index 0000000000..1bd110ade9 --- /dev/null +++ b/tests/endpoint/office_document_spawned_child_process_to_download.test.yml @@ -0,0 +1,12 @@ +name: Office Document Spawned Child Process To Download Unit Test +tests: +- name: Office Document Spawned Child Process To Download + file: endpoint/office_document_spawned_child_process_to_download.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml new file mode 100644 index 0000000000..cedd314f01 --- /dev/null +++ b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml @@ -0,0 +1,15 @@ +name: Shedule Task with HTTP Command Arguments Unit Test +tests: +- name: Shedule Task with HTTP Command Arguments + file: endpoint/shedule_task_with_http_command_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + + + \ No newline at end of file