From 71b663937ec7b37a3d49e254fad9f4c373c853dc Mon Sep 17 00:00:00 2001 From: tcontreras Date: Wed, 14 Apr 2021 16:00:16 +0200 Subject: [PATCH 01/13] spear_detections --- ...ice_application_spawn_rundll32_process.yml | 44 ++++++++++++++++ .../office_application_spawned_cmd_shell.yml | 45 ++++++++++++++++ ...office_document_creating_schedule_task.yml | 52 +++++++++++++++++++ .../office_document_executing_macro_code.yml | 45 ++++++++++++++++ ...pplication_spawn_rundll32_process.test.yml | 13 +++++ ...ice_application_spawned_cmd_shell.test.yml | 12 +++++ ...e_document_creating_schedule_task.test.yml | 12 +++++ ...ice_document_executing_macro_code.test.yml | 12 +++++ 8 files changed, 235 insertions(+) create mode 100644 detections/endpoint/office_application_spawn_rundll32_process.yml create mode 100644 detections/endpoint/office_application_spawned_cmd_shell.yml create mode 100644 detections/endpoint/office_document_creating_schedule_task.yml create mode 100644 detections/endpoint/office_document_executing_macro_code.yml create mode 100644 tests/endpoint/office_application_spawn_rundll32_process.test.yml create mode 100644 tests/endpoint/office_application_spawned_cmd_shell.test.yml create mode 100644 tests/endpoint/office_document_creating_schedule_task.test.yml create mode 100644 tests/endpoint/office_document_executing_macro_code.test.yml diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml new file mode 100644 index 0000000000..dcde436cb6 --- /dev/null +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -0,0 +1,44 @@ +name: Office Application Spawn rundll32 process +id: 958751e4-9c5f-11eb-b103-acde48001122 +version: 1 +date: '2021-04-13' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. + this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") + Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid + Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `office_application_spawn_rundll32_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://any.run/malware-trends/trickbot +- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe +tags: + analytic_story: + - Spearphishing Attachments + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Processes.process + - Processes.parent_process_name + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/office_application_spawned_cmd_shell.yml b/detections/endpoint/office_application_spawned_cmd_shell.yml new file mode 100644 index 0000000000..8ae8752a0f --- /dev/null +++ b/detections/endpoint/office_application_spawned_cmd_shell.yml @@ -0,0 +1,45 @@ +name: Office Application Spawned CMD Shell +id: c1ad8f62-9c65-11eb-9d59-acde48001122 +version: 1 +date: '2021-04-13' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect a potential malicious office macro document that spawn command shell to execute malicious batch, powershell, vb/js script. + this technique is common on malicious ms office macro document used by threat actor to load payloads, download payloads or other malware. +search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") + Processes.process_name= "cmd.exe" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid + Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `office_application_spawned_cmd_shell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cmd.exe may be used. +known_false_positives: office document that load automation batch script +references: +- https://www.joesandbox.com/analysis/369141/0/html +tags: + analytic_story: + - Spearphishing Attachments + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Processes.process + - Processes.parent_process_name + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml new file mode 100644 index 0000000000..bf7cb41d81 --- /dev/null +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -0,0 +1,52 @@ +name: Office Document Creating Schedule Task +id: cc8b7b74-9d0f-11eb-8342-acde48001122 +version: 1 +date: '2021-04-14' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. + This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry + The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. + Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' + +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded = "*\\taskschd.dll" + | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `office_document_creating_schedule_task_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: unknown +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +tags: + analytic_story: + - Spearphishing Attachments + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - ImageLoaded + - AllImageLoaded + - Computer + - EventCode + - Image + - process_name + - ProcessId + - ProcessGuid + - _time + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml new file mode 100644 index 0000000000..5f3514bc83 --- /dev/null +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -0,0 +1,45 @@ +name: Office Document Executing Macro Code +id: b12c89bc-9d06-11eb-a592-acde48001122 +version: 1 +date: '2021-04-14' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. + This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. + It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") + | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `office_document_executing_macro_code_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: Normal Office Document macro use for automation +references: + - https://www.joesandbox.com/analysis/386500/0/html +tags: + analytic_story: + - Spearphishing Attachments + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - ImageLoaded + - AllImageLoaded + - Computer + - EventCode + - Image + - process_name + - ProcessId + - ProcessGuid + - _time + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/office_application_spawn_rundll32_process.test.yml b/tests/endpoint/office_application_spawn_rundll32_process.test.yml new file mode 100644 index 0000000000..528f74d283 --- /dev/null +++ b/tests/endpoint/office_application_spawn_rundll32_process.test.yml @@ -0,0 +1,13 @@ +name: Office Application Spawn rundll32 process Unit Test +tests: +- name: Office Application Spawn rundll32 process + file: endpoint/office_application_spawn_rundll32_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + diff --git a/tests/endpoint/office_application_spawned_cmd_shell.test.yml b/tests/endpoint/office_application_spawned_cmd_shell.test.yml new file mode 100644 index 0000000000..2ecc7a762d --- /dev/null +++ b/tests/endpoint/office_application_spawned_cmd_shell.test.yml @@ -0,0 +1,12 @@ +name: Office Application Spawned CMD Shell Unit Test +tests: +- name: Office Application Spawned CMD Shell + file: endpoint/office_application_spawned_cmd_shell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_document_creating_schedule_task.test.yml b/tests/endpoint/office_document_creating_schedule_task.test.yml new file mode 100644 index 0000000000..d26087261a --- /dev/null +++ b/tests/endpoint/office_document_creating_schedule_task.test.yml @@ -0,0 +1,12 @@ +name: Office Document Creating Schedule Task Unit Test +tests: +- name: Office Document Creating Schedule Task + file: endpoint/office_document_creating_schedule_task.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_document_executing_macro_code.test.yml b/tests/endpoint/office_document_executing_macro_code.test.yml new file mode 100644 index 0000000000..6330750cd6 --- /dev/null +++ b/tests/endpoint/office_document_executing_macro_code.test.yml @@ -0,0 +1,12 @@ +name: Office Document Executing Macro Code Unit Test +tests: +- name: Office Document Executing Macro Code + file: endpoint/office_document_executing_macro_code.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From b8092f79817b8f074f2c0cc7d03f5ce061d2197d Mon Sep 17 00:00:00 2001 From: root Date: Wed, 14 Apr 2021 16:12:49 +0000 Subject: [PATCH 02/13] Added detection testing service results inOffice Application Spawn rundll32 process --- ...ice_application_spawn_rundll32_process.yml | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index dcde436cb6..a7942cf80e 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -6,18 +6,22 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. - this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. +description: this detection was designed to identifies suspicious spawned process + of known MS office application due to macro or malicious code. this technique can + be seen in so many malware like trickbot that used MS office as its weapon or attack + vector to initially infect the machines. search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") - Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name + = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name + = "wordpad.exe") Processes.process_name=rundll32.exe by Processes.parent_process + Processes.process_name Processes.process_id Processes.process_guid Processes.user + Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://any.run/malware-trends/trickbot @@ -41,4 +45,7 @@ tags: - Processes.dest - Processes.user - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log From ac1b96681edaf9a373d01e1d1947dabf406d8095 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 14 Apr 2021 16:35:28 +0000 Subject: [PATCH 03/13] Added detection testing service results inOffice Application Spawned CMD Shell --- .../office_application_spawned_cmd_shell.yml | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/office_application_spawned_cmd_shell.yml b/detections/endpoint/office_application_spawned_cmd_shell.yml index 8ae8752a0f..b22ced4c72 100644 --- a/detections/endpoint/office_application_spawned_cmd_shell.yml +++ b/detections/endpoint/office_application_spawned_cmd_shell.yml @@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a potential malicious office macro document that spawn command shell to execute malicious batch, powershell, vb/js script. - this technique is common on malicious ms office macro document used by threat actor to load payloads, download payloads or other malware. -search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") - Processes.process_name= "cmd.exe" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid - Processes.user Processes.dest - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `office_application_spawned_cmd_shell_filter`' +description: this search is to detect a potential malicious office macro document + that spawn command shell to execute malicious batch, powershell, vb/js script. this + technique is common on malicious ms office macro document used by threat actor to + load payloads, download payloads or other malware. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name + = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name + = "wordpad.exe") Processes.process_name= "cmd.exe" by Processes.parent_process + Processes.process_name Processes.process_id Processes.process_guid Processes.user + Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `office_application_spawned_cmd_shell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -42,4 +44,7 @@ tags: - Processes.dest - Processes.user - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log From 55885cf24b4bd6141c55ed2d2b5f9920be4efe16 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 14 Apr 2021 17:05:09 +0000 Subject: [PATCH 04/13] Added detection testing service results inOffice Document Creating Schedule Task --- ...office_document_creating_schedule_task.yml | 43 +++++++++++-------- 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index bf7cb41d81..35e8c79559 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -6,24 +6,28 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. - This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry - The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. - schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. - If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. - Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. - Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' - -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded = "*\\taskschd.dll" - | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `office_document_creating_schedule_task_filter`' +description: this search detects a potential malicious office document that create + schedule task entry through macro VBA api or through loading taskschd.dll. This + technique was seen in so many malicious macro malware that create persistence , + beaconing using task schedule malware entry The search will return the first time + and last time the task was registered, as well as the `Command` to be executed, + `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe + is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following + DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it's possible a scheduled task is being registered + within that process context in memory. Upon triage, identify the task scheduled + source. Was it schtasks.exe or via TaskService? Review the job created and the Command + to be executed. Capture any artifacts on disk and review. Identify any parallel + processes within the same timeframe to identify source.' +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", + "wordpad.exe") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime + max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode + Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. known_false_positives: unknown references: - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ @@ -49,4 +53,7 @@ tags: - ProcessId - ProcessGuid - _time - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log From e85860be6c84bd1a77c1cc050d698e71a04b8370 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 15 Apr 2021 09:46:00 +0200 Subject: [PATCH 05/13] Delete office_application_spawned_cmd_shell.yml --- .../office_application_spawned_cmd_shell.yml | 50 ------------------- 1 file changed, 50 deletions(-) delete mode 100644 detections/endpoint/office_application_spawned_cmd_shell.yml diff --git a/detections/endpoint/office_application_spawned_cmd_shell.yml b/detections/endpoint/office_application_spawned_cmd_shell.yml deleted file mode 100644 index b22ced4c72..0000000000 --- a/detections/endpoint/office_application_spawned_cmd_shell.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Office Application Spawned CMD Shell -id: c1ad8f62-9c65-11eb-9d59-acde48001122 -version: 1 -date: '2021-04-13' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: this search is to detect a potential malicious office macro document - that spawn command shell to execute malicious batch, powershell, vb/js script. this - technique is common on malicious ms office macro document used by threat actor to - load payloads, download payloads or other malware. -search: '| tstats `security_content_summariesonly` count values(Processes.process) - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name - = "wordpad.exe") Processes.process_name= "cmd.exe" by Processes.parent_process - Processes.process_name Processes.process_id Processes.process_guid Processes.user - Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `office_application_spawned_cmd_shell_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed cmd.exe may be used. -known_false_positives: office document that load automation batch script -references: -- https://www.joesandbox.com/analysis/369141/0/html -tags: - analytic_story: - - Spearphishing Attachments - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - Processes.process - - Processes.parent_process_name - - _time - - Processes.process_name - - Processes.dest - - Processes.user - - Processes.process_id - security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log From 0fa575ad4ac5ee16e3ee20f263a10e5798a792d9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 15 Apr 2021 09:46:20 +0200 Subject: [PATCH 06/13] Delete office_application_spawned_cmd_shell.test.yml --- .../office_application_spawned_cmd_shell.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/office_application_spawned_cmd_shell.test.yml diff --git a/tests/endpoint/office_application_spawned_cmd_shell.test.yml b/tests/endpoint/office_application_spawned_cmd_shell.test.yml deleted file mode 100644 index 2ecc7a762d..0000000000 --- a/tests/endpoint/office_application_spawned_cmd_shell.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Office Application Spawned CMD Shell Unit Test -tests: -- name: Office Application Spawned CMD Shell - file: endpoint/office_application_spawned_cmd_shell.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From 8cd49a3f7a4f737079e2f8d360269358ae74b228 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 15 Apr 2021 08:25:53 +0000 Subject: [PATCH 07/13] Added detection testing service results inOffice Document Executing Macro Code --- .../office_document_executing_macro_code.yml | 33 +++++++++++-------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 5f3514bc83..cd5b8965c2 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -6,21 +6,25 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. - This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. - It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") - | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `office_document_executing_macro_code_filter`' +description: this detection was designed to identifies suspicious office documents + that using macro code. Macro code is known to be one of the prevalent weaponization + or attack vector of threat actor. This malicious macro code is embed to a office + document as an attachment that may execute malicious payload, download malware payload + or other malware component. It is really good practice to disable macro by default + to avoid automatically execute macro code while opening or closing a office document + files. +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", + "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") + | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded + count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. known_false_positives: Normal Office Document macro use for automation references: - - https://www.joesandbox.com/analysis/386500/0/html +- https://www.joesandbox.com/analysis/386500/0/html tags: analytic_story: - Spearphishing Attachments @@ -42,4 +46,7 @@ tags: - ProcessId - ProcessGuid - _time - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log From 7a0d9be5a580729292227ba4cf7d88869a92359a Mon Sep 17 00:00:00 2001 From: tcontreras Date: Thu, 15 Apr 2021 19:39:21 +0200 Subject: [PATCH 08/13] spear_update --- ...ice_application_spawn_rundll32_process.yml | 2 +- .../office_application_spawned_cmd_shell.yml | 45 ------------------- ...office_document_creating_schedule_task.yml | 2 +- .../office_document_executing_macro_code.yml | 2 +- ...ice_application_spawned_cmd_shell.test.yml | 12 ----- 5 files changed, 3 insertions(+), 60 deletions(-) delete mode 100644 detections/endpoint/office_application_spawned_cmd_shell.yml delete mode 100644 tests/endpoint/office_application_spawned_cmd_shell.test.yml diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index dcde436cb6..5b3eadc6d3 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -24,7 +24,7 @@ references: - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe tags: analytic_story: - - Spearphishing Attachments + - Phishing Payloads kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_application_spawned_cmd_shell.yml b/detections/endpoint/office_application_spawned_cmd_shell.yml deleted file mode 100644 index 8ae8752a0f..0000000000 --- a/detections/endpoint/office_application_spawned_cmd_shell.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Office Application Spawned CMD Shell -id: c1ad8f62-9c65-11eb-9d59-acde48001122 -version: 1 -date: '2021-04-13' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: this search is to detect a potential malicious office macro document that spawn command shell to execute malicious batch, powershell, vb/js script. - this technique is common on malicious ms office macro document used by threat actor to load payloads, download payloads or other malware. -search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") - Processes.process_name= "cmd.exe" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid - Processes.user Processes.dest - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `office_application_spawned_cmd_shell_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed cmd.exe may be used. -known_false_positives: office document that load automation batch script -references: -- https://www.joesandbox.com/analysis/369141/0/html -tags: - analytic_story: - - Spearphishing Attachments - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - Processes.process - - Processes.parent_process_name - - _time - - Processes.process_name - - Processes.dest - - Processes.user - - Processes.process_id - security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index bf7cb41d81..be8d9b4a73 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -30,7 +30,7 @@ references: - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ tags: analytic_story: - - Spearphishing Attachments + - Phishing Payloads kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 5f3514bc83..99ac369e63 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -23,7 +23,7 @@ references: - https://www.joesandbox.com/analysis/386500/0/html tags: analytic_story: - - Spearphishing Attachments + - Phishing Payloads kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/office_application_spawned_cmd_shell.test.yml b/tests/endpoint/office_application_spawned_cmd_shell.test.yml deleted file mode 100644 index 2ecc7a762d..0000000000 --- a/tests/endpoint/office_application_spawned_cmd_shell.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Office Application Spawned CMD Shell Unit Test -tests: -- name: Office Application Spawned CMD Shell - file: endpoint/office_application_spawned_cmd_shell.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From 8f80520df765a45579542b6cd6613c4646fe5941 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 19 Apr 2021 16:40:53 +0200 Subject: [PATCH 09/13] spear --- ...ment_spawned_child_process_to_download.yml | 46 ++++++++++++++++++ ...edule_task_with_http_command_arguments.yml | 47 +++++++++++++++++++ ...spawned_child_process_to_download.test.yml | 12 +++++ ..._task_with_http_command_arguments.test.yml | 15 ++++++ 4 files changed, 120 insertions(+) create mode 100644 detections/endpoint/office_document_spawned_child_process_to_download.yml create mode 100644 detections/endpoint/shedule_task_with_http_command_arguments.yml create mode 100644 tests/endpoint/office_document_spawned_child_process_to_download.test.yml create mode 100644 tests/endpoint/shedule_task_with_http_command_arguments.test.yml diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml new file mode 100644 index 0000000000..cf817b2e59 --- /dev/null +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -0,0 +1,46 @@ +name: Office Document Spawned Child Process To Download +id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 +version: 1 +date: '2021-04-16' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect potential malicious office document executing lolbin child process to download payload or other malware. + Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. +search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe") + process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) + | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `office_document_spawned_child_process_to_download_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances office application and browser may be used. +known_false_positives: default browser not in the filter list +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/# +tags: + analytic_story: + - Phishing Payloads + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - parent_process_name + - process_name + - parent_process + - cmdline + - process_id + - OriginalFileName + - ProcessGuid + - Computer + - EventCode + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/shedule_task_with_http_command_arguments.yml b/detections/endpoint/shedule_task_with_http_command_arguments.yml new file mode 100644 index 0000000000..2dfe0838a6 --- /dev/null +++ b/detections/endpoint/shedule_task_with_http_command_arguments.yml @@ -0,0 +1,47 @@ +name: Shedule Task with HTTP Command Arguments +id: 523c2684-a101-11eb-916b-acde48001122 +version: 1 +date: '2021-04-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, + to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ + The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. + Identify any parallel processes within the same timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN ("*http*") + | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `shedule_task_with_http_command_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the task schedule (Exa. Security Log EventCode 4698) + endpoints. Tune and filter known instances of Task schedule used in your environment. +known_false_positives: unknown +references: +tags: + analytic_story: + - Windows Persistence Techniques + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Command + - Author + - Enabled + - Hidden + - Arguments + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/office_document_spawned_child_process_to_download.test.yml b/tests/endpoint/office_document_spawned_child_process_to_download.test.yml new file mode 100644 index 0000000000..acfe100eab --- /dev/null +++ b/tests/endpoint/office_document_spawned_child_process_to_download.test.yml @@ -0,0 +1,12 @@ +name: Office Document Spawned Child Process To Download Unit Test +tests: +- name: Office Document Spawned Child Process To Download + file: detections/endpoint/office_document_spawned_child_process_to_download.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml new file mode 100644 index 0000000000..db8a09d65b --- /dev/null +++ b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml @@ -0,0 +1,15 @@ +name: Shedule Task with HTTP Command Arguments Unit Test +tests: +- name: Shedule Task with HTTP Command Arguments + file: detections/endpoint/shedule_task_with_http_command_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-secuirty.log + source: WinEventLog:Security + sourcetype: WinEventLog:Security + + + \ No newline at end of file From 0e3bf4835f24cde7f1a6ee1fd6993b933ea29f4b Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 19 Apr 2021 16:45:03 +0200 Subject: [PATCH 10/13] spear2 --- .../endpoint/shedule_task_with_http_command_arguments.yml | 1 + .../office_document_spawned_child_process_to_download.test.yml | 2 +- .../endpoint/shedule_task_with_http_command_arguments.test.yml | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/shedule_task_with_http_command_arguments.yml b/detections/endpoint/shedule_task_with_http_command_arguments.yml index 2dfe0838a6..90e5516920 100644 --- a/detections/endpoint/shedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/shedule_task_with_http_command_arguments.yml @@ -24,6 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin endpoints. Tune and filter known instances of Task schedule used in your environment. known_false_positives: unknown references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ tags: analytic_story: - Windows Persistence Techniques diff --git a/tests/endpoint/office_document_spawned_child_process_to_download.test.yml b/tests/endpoint/office_document_spawned_child_process_to_download.test.yml index acfe100eab..1bd110ade9 100644 --- a/tests/endpoint/office_document_spawned_child_process_to_download.test.yml +++ b/tests/endpoint/office_document_spawned_child_process_to_download.test.yml @@ -1,7 +1,7 @@ name: Office Document Spawned Child Process To Download Unit Test tests: - name: Office Document Spawned Child Process To Download - file: detections/endpoint/office_document_spawned_child_process_to_download.yml + file: endpoint/office_document_spawned_child_process_to_download.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml index db8a09d65b..fe8f238452 100644 --- a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml +++ b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml @@ -1,7 +1,7 @@ name: Shedule Task with HTTP Command Arguments Unit Test tests: - name: Shedule Task with HTTP Command Arguments - file: detections/endpoint/shedule_task_with_http_command_arguments.yml + file: endpoint/shedule_task_with_http_command_arguments.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From a5cf51e9d5ea1e9df26be9fe935409add319c31b Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 19 Apr 2021 18:58:16 +0200 Subject: [PATCH 11/13] task_sched --- .../shedule_task_with_http_command_arguments.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml index fe8f238452..cedd314f01 100644 --- a/tests/endpoint/shedule_task_with_http_command_arguments.test.yml +++ b/tests/endpoint/shedule_task_with_http_command_arguments.test.yml @@ -7,9 +7,9 @@ tests: latest_time: 'now' attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-secuirty.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log source: WinEventLog:Security - sourcetype: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file From 868df41593f3dda3e75a94f99f69d5dfed42f06d Mon Sep 17 00:00:00 2001 From: root Date: Mon, 19 Apr 2021 17:26:14 +0000 Subject: [PATCH 12/13] Added detection testing service results inShedule Task with HTTP Command Arguments --- ...edule_task_with_http_command_arguments.yml | 40 +++++++++++-------- 1 file changed, 24 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/shedule_task_with_http_command_arguments.yml b/detections/endpoint/shedule_task_with_http_command_arguments.yml index 90e5516920..8624b3c950 100644 --- a/detections/endpoint/shedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/shedule_task_with_http_command_arguments.yml @@ -6,22 +6,27 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, - to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ - The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ - schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ - The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. - If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ - Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. - Identify any parallel processes within the same timeframe to identify source.' -search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN ("*http*") - | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `shedule_task_with_http_command_arguments_filter`' +description: The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry + of malware or attack that uses lolbin to download other file or payload to the infected + machine.\ The search will return the first time and last time the task was registered, + as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or + TaskService is launched -`taskschd.dll`. If found loaded by another process, it + is possible a scheduled task is being registered within that process context in + memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or + via TaskService? Review the job created and the Command to be executed. Capture + any artifacts on disk and review. Identify any parallel processes within the same + timeframe to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN + ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, + Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `shedule_task_with_http_command_arguments_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the task schedule (Exa. Security Log EventCode 4698) - endpoints. Tune and filter known instances of Task schedule used in your environment. + logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and + filter known instances of Task schedule used in your environment. known_false_positives: unknown references: - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ @@ -45,4 +50,7 @@ tags: - Enabled - Hidden - Arguments - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log From dee37ff33506b13ddd78af36366e48eb2b56e25a Mon Sep 17 00:00:00 2001 From: root Date: Tue, 20 Apr 2021 16:04:58 +0000 Subject: [PATCH 13/13] Added detection testing service results inOffice Document Spawned Child Process To Download --- ...ment_spawned_child_process_to_download.yml | 26 ++++++++++++------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index cf817b2e59..b76f07bf38 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -6,18 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential malicious office document executing lolbin child process to download payload or other malware. - Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. -search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe") - process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) - | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `office_document_spawned_child_process_to_download_filter`' +description: this search is to detect potential malicious office document executing + lolbin child process to download payload or other malware. Since most of the attacker + abused the capability of office document to execute living on land application to + blend it to the normal noise in the infected machine to cover its track. +search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", + "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName + IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats + min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name + parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances office application and browser may be used. + Sysmon TA. Tune and filter known instances office application and browser may be + used. known_false_positives: default browser not in the filter list references: - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/# @@ -43,4 +46,7 @@ tags: - ProcessGuid - Computer - EventCode - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log