|
|
|
@@ -1,6 +1,6 @@
|
|
|
|
|
#############
|
|
|
|
|
# Automatically generated by generator.py in splunk/security_content
|
|
|
|
|
# On Date: 2022-08-29T17:38:30 UTC
|
|
|
|
|
# On Date: 2022-09-20T15:09:11 UTC
|
|
|
|
|
# Author: Splunk Security Research
|
|
|
|
|
# Contact: research@splunk.com
|
|
|
|
|
#############
|
|
|
|
@@ -22,7 +22,7 @@ type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries.
|
|
|
|
|
how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts.
|
|
|
|
|
how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"]}
|
|
|
|
|
known_false_positives = This search may find additional path traversal exploitation attempts.
|
|
|
|
|
providing_technologies = null
|
|
|
|
@@ -521,12 +521,32 @@ providing_technologies = null
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category.
|
|
|
|
|
explanation = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. Error Code 500121 represents a failed attempt to authenticate using a second factor. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004", "T1621"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD External Guest User Invited - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrator may legitimately invite external guest users. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Global Administrator Role Assigned - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1098.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Multi-Factor Authentication Disabled - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
@@ -537,23 +557,93 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Ins
|
|
|
|
|
known_false_positives = Legitimate use case may require for users to disable MFA. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Multiple Failed MFA Requests For User - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621", "T1078", "T1078.004"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies one source Ip failing to authenticate with 30 unique valid users within 5 minutes. This behavior could represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code 50126 represents an invalid password. This logic can be used for real time security monitoring as well as threat hunting exercises.\
|
|
|
|
|
Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs. log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110", "T1110.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD New Custom Domain Added - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = In most organizations, new customm domains will be updated infrequently. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD New Federated Domain Added - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = In most organizations, domain federation settings will be updated infrequently. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Privileged Role Assigned - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Service Principal Created - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the creation of a Service Principal in an Azure AD environment. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrator may legitimately create Service Principal. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Service Principal New Client Credentials - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1098", "T1098.001"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Service Principal Owner Added - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrator may legitimately add new owners for Service Principals. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD Successful PowerShell Authentication - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. This behavior is not common for regular, non administrative users. After compromising an account in Azure AD, attackers and red teams alike will perform enumeration and discovery techniques. One method of executing these techniques is leveraging the native PowerShell modules.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
@@ -563,7 +653,7 @@ type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
|
|
|
|
|
providing_technologies = null
|
|
|
|
@@ -575,11 +665,61 @@ confidence = medium
|
|
|
|
|
explanation = The following analytic identifies one source Ip failing to authenticate with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code 50126 represents an invalid password.\
|
|
|
|
|
The detection calculates the standard deviation for source Ip and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
|
|
|
|
|
While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110", "T1110.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD User Enabled And Password Reset - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = While not common, Administrators may enable accounts and reset their passwords for legitimate reasons. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure AD User ImmutableId Attribute Updated - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure Active Directory
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure Automation Account Created - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrators may legitimately create Azure Automation accounts. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure Automation Runbook Created - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrators may legitimately create Azure Automation Runbooks. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Azure Runbook Webhook Created - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Azure
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet. An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM. This provides a persistent foothold on the environment.
|
|
|
|
|
how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Administrators may legitimately create Azure Runbook Webhooks. Filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Circle CI Disable Security Job - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = CircleCI
|
|
|
|
@@ -4181,7 +4321,7 @@ providing_technologies = ["Microsoft Windows"]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
|
|
|
|
|
explanation = This analytic is designed to identify a high frequency of process termination events on a computer in a short period of time, which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
|
|
|
|
|
how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
|
|
|
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
|
|
|
|
|
known_false_positives = admin or user tool that can terminate multiple process.
|
|
|
|
@@ -7619,6 +7759,36 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
|
|
|
|
|
known_false_positives = False positives should be limited, however filtering may be required.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir. This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code.
|
|
|
|
|
how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also required.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.002", "T1134"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
|
|
|
|
|
providing_technologies = ["Microsoft Windows"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle. This technique was seen in several adversaries to gain privileges for their process. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
|
|
|
|
|
how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = It is possible legitimate applications will request access to winlogon, filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path. This technique was seen where adversaries attempt to gain privileges to their process. This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
|
|
|
|
|
how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = It is possible legitimate applications will request access to winlogon, filter as needed.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows AdFind Exe - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -7745,6 +7915,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
|
|
|
|
|
known_false_positives = False positives may be limited to source control applications and may be required to be filtered out.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper if a user changes it via desktop personalized setting is explorer.exe.
|
|
|
|
|
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = 3rd part software application can change the wallpaper. Filter is needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Defender Exclusion Registry Entry - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -7968,6 +8148,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Acti
|
|
|
|
|
known_false_positives = It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
|
|
|
|
|
providing_technologies = ["Microsoft Windows"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Event Triggered Image File Execution Options Injection - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior. Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
|
|
|
|
|
how_to_implement = This analytic requires capturing the Windows Event Log Application channel in XML.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1546.012"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = False positives may be present and tuning will be required before turning into a TTP or notable.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Excessive Disabled Services Event - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8008,6 +8198,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
|
|
|
|
|
known_false_positives = Administrators may execute this powershell command to get hardware information related to camera.
|
|
|
|
|
providing_technologies = ["Microsoft Windows"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Gather Victim Identity SAM Info - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a process that loads the samlib.dll module. This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. This hunting query can be a good indicator that a process is capable of accessing the SAM object.
|
|
|
|
|
how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1589.001", "T1589"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = this module can be loaded by a third party application. Filter is needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8058,6 +8258,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"]}
|
|
|
|
|
known_false_positives = user may delete bunch of pictures or files in a folder.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host.
|
|
|
|
|
how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.001", "T1574"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = unknown
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Hunting System Account Targeting Lsass - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8072,7 +8282,7 @@ providing_technologies = null
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
|
|
|
|
|
explanation = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.
|
|
|
|
|
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
|
|
|
|
@@ -8152,10 +8362,20 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic detects an explorer.exe with a possible url link process command line on it. Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
|
|
|
|
|
explanation = The following analytic identifies the Windows Explorer process with a URL within the command-line. Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
|
|
|
|
|
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = unknown
|
|
|
|
|
known_false_positives = False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Input Capture Using Credential UI Dll - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a process that loads the credui.dll module. This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. This hunting query may hit false positive for a third party application that uses a credential login UI for user login.
|
|
|
|
|
how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1056.002", "T1056"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = this module can be loaded by a third party application. Filter is needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows InstallUtil Credential Theft - Rule]
|
|
|
|
@@ -8498,6 +8718,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
|
|
|
|
|
known_false_positives = False positives should be limited, however filter as needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Phishing Recent ISO Exec Registry - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system. As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
|
|
|
|
|
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = False positives may be high depending on the environment and consistent use of ISOs. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Possible Credential Dumping - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8562,6 +8792,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
|
|
|
|
|
known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
|
|
|
|
|
providing_technologies = ["Microsoft Windows"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Process Injection With Public Source Path - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = 80
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries for process injection to evade detections or gain privilege escalation.
|
|
|
|
|
how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.002"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = Some security products or third party applications may utilize CreateRemoteThread, filter as needed before enabling as a notable.
|
|
|
|
|
providing_technologies = null
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Process With NamedPipe CommandLine - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8582,6 +8822,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
|
|
|
|
|
known_false_positives = False positives are possible if legitimate applications are allowed to terminate this process during testing or updates. Filter as needed based on paths that are used legitimately.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Protocol Tunneling with Plink - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization.
|
|
|
|
|
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1572", "T1021.004"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Raccine Scheduled Task Deletion - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8652,6 +8902,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.00
|
|
|
|
|
known_false_positives = updated windows application needed in safe boot may used this registry
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. For example, credential managers are notified when a user logs on or an account password changes. Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
|
|
|
|
|
how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219", "T1003"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = This module can be loaded by a third party application. Filter is needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Remote Access Software Hunt - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8762,11 +9022,11 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Ins
|
|
|
|
|
known_false_positives = False positives may be present based on common applications adding new drivers, however, filter as needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Service Created With Suspicious Service Path - Rule]
|
|
|
|
|
[savedsearch://ESCU - Windows Service Created with Suspicious Service Path - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
|
|
|
|
|
explanation = The following analytics uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
|
|
|
|
|
how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
|
|
|
|
|
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]}
|
|
|
|
|
known_false_positives = Legitimate applications may install services with uncommon services paths.
|
|
|
|
@@ -8802,6 +9062,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
|
|
|
|
|
known_false_positives = Third party tools may used this technique to create services but not so common.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Service Deletion In Registry - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services. Adversaries may delete a service as part of defense evasion.
|
|
|
|
|
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry, but it is still recommended to check this alert with high priority.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows Service Initiation on Remote Endpoint - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -8822,6 +9092,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
|
|
|
|
|
known_false_positives = It is possible administrative scripts may start/stop/delete services. Filter as needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
|
confidence = medium
|
|
|
|
|
explanation = The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
|
|
|
|
|
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
|
|
|
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1218.001", "T1218"], "nist": ["DE.CM"]}
|
|
|
|
|
known_false_positives = False positives should be limited, filter as needed.
|
|
|
|
|
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
|
|
|
|
|
|
|
|
|
[savedsearch://ESCU - Windows System File on Disk - Rule]
|
|
|
|
|
type = detection
|
|
|
|
|
asset_type = Endpoint
|
|
|
|
@@ -10378,7 +10658,7 @@ version = 3
|
|
|
|
|
references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html", "http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco"]
|
|
|
|
|
maintainers = [{"company": "Mauricio Velazco Splunk", "email": "-", "name": "David Dorsey"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
|
|
|
|
|
searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
|
|
|
|
|
description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage.
|
|
|
|
|
narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
|
|
|
|
|
Indications of lateral movement in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\
|
|
|
|
@@ -10546,10 +10826,21 @@ version = 2
|
|
|
|
|
references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://attack.mitre.org/techniques/T1586/", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://www.imperva.com/learn/application-security/account-takeover-ato/", "https://www.varonis.com/blog/azure-active-directory", "https://www.barracuda.com/glossary/account-takeover"]
|
|
|
|
|
maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"]
|
|
|
|
|
searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Failed MFA Requests For User - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"]
|
|
|
|
|
description = Monitor for activities and techniques associated with Account Takover attacks against Azure Active Directory tenants.
|
|
|
|
|
narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization.\ This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
|
|
|
|
|
|
|
|
|
|
[analytic_story://Azure Active Directory Persistence]
|
|
|
|
|
category = Cloud Security
|
|
|
|
|
last_updated = 2022-08-17
|
|
|
|
|
version = 1
|
|
|
|
|
references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://attack.mitre.org/tactics/TA0003/", "https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/"]
|
|
|
|
|
maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"]
|
|
|
|
|
description = Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.
|
|
|
|
|
narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants.
|
|
|
|
|
|
|
|
|
|
[analytic_story://Baron Samedit CVE-2021-3156]
|
|
|
|
|
category = Adversary Tactics
|
|
|
|
|
last_updated = 2021-01-27
|
|
|
|
@@ -10585,6 +10876,17 @@ narrative = While you can educate your users and customers about the risks and t
|
|
|
|
|
You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\
|
|
|
|
|
Notable events will include IP addresses, URLs, and user data. Drilling down can provide you with even more actionable intelligence, including likely geographic information, contextual searches to help you scope the problem, and investigative searches.
|
|
|
|
|
|
|
|
|
|
[analytic_story://Brute Ratel C4]
|
|
|
|
|
category = Data Destruction
|
|
|
|
|
last_updated = 2022-08-23
|
|
|
|
|
version = 1
|
|
|
|
|
references = ["https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/", "https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"]
|
|
|
|
|
maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule", "ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule", "ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule", "ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule", "ESCU - Windows Gather Victim Identity SAM Info - Rule", "ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule", "ESCU - Windows Input Capture Using Credential UI Dll - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - Windows Process Injection With Public Source Path - Rule", "ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Deletion In Registry - Rule"]
|
|
|
|
|
description = Leverage searches that allow you to detect and investigate unusual activities that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, lock workstation, get clipboard or screenshot and much more.
|
|
|
|
|
narrative = Brute RATEL BRC4 is the latest red-teaming tool that simulate several TTP's. It uses several techniques like syscall, patching ETW/AMSI and written in native C to minimize noise in process command-line. This tool was seen in the wild being abused by some ransomware (blackcat) and adversaries in their campaigns to install the BRC4 agent that can serve as remote admin tool to compromise the target host or network.
|
|
|
|
|
|
|
|
|
|
[analytic_story://Caddy Wiper]
|
|
|
|
|
category = Data Destruction
|
|
|
|
|
last_updated = 2022-03-25
|
|
|
|
@@ -10596,6 +10898,17 @@ searches = ["ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU -
|
|
|
|
|
description = Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions.
|
|
|
|
|
narrative = Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions.
|
|
|
|
|
|
|
|
|
|
[analytic_story://CISA AA22-257A]
|
|
|
|
|
category = Adversary Tactics
|
|
|
|
|
last_updated = 2022-09-15
|
|
|
|
|
version = 1
|
|
|
|
|
references = ["https://www.cisa.gov/uscert/ncas/alerts/aa21-321a", "https://www.cisa.gov/uscert/ncas/alerts/aa22-257a", "https://www.ic3.gov/Media/News/2021/210527.pdf", "https://www.us-cert.gov/sites/default/files/AA22-257A.stix.xml", "https://www.us-cert.cisa.gov/iran"]
|
|
|
|
|
maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows Hidden Schedule Task Settings - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Windows Protocol Tunneling with Plink - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule"]
|
|
|
|
|
description = The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.
|
|
|
|
|
narrative = This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC. Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations. The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organizations. These actors often operate under the auspices of Najee Technology Hooshmand Fater LLC, based in Karaj, Iran, and Afkar System Yazd Company, based in Yazd, Iran. The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks rather than targeting specific targeted entities or sectors. This advisory provides observed tactics, techniques, and indicators of compromise (IOCs) that the authoring agencies assess are likely associated with this IRGC-affiliated APT. The authoring agencies urge organizations, especially critical infrastructure organizations, to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from these IRGC-affiliated cyber actors.
|
|
|
|
|
|
|
|
|
|
[analytic_story://Cloud Cryptomining]
|
|
|
|
|
category = Cloud Security
|
|
|
|
|
last_updated = 2019-10-02
|
|
|
|
@@ -11274,7 +11587,7 @@ version = 2
|
|
|
|
|
references = ["https://lolbas-project.github.io/"]
|
|
|
|
|
maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Living Off The Land - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - MacOS plutil - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule", "ESCU - Windows DLL Search Order Hijacking with iscsicpl - Rule", "ESCU - Windows Identify Protocol Handlers - Rule", "ESCU - Windows Indirect Command Execution Via forfiles - Rule", "ESCU - Windows Indirect Command Execution Via pcalua - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - Windows MOF Event Triggered Execution via WMI - Rule", "ESCU - Windows Odbcconf Hunting - Rule", "ESCU - Windows Odbcconf Load DLL - Rule", "ESCU - Windows Odbcconf Load Response File - Rule", "ESCU - WSReset UAC Bypass - Rule"]
|
|
|
|
|
searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Living Off The Land - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - MacOS plutil - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule", "ESCU - Windows DLL Search Order Hijacking with iscsicpl - Rule", "ESCU - Windows Identify Protocol Handlers - Rule", "ESCU - Windows Indirect Command Execution Via forfiles - Rule", "ESCU - Windows Indirect Command Execution Via pcalua - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - Windows MOF Event Triggered Execution via WMI - Rule", "ESCU - Windows Odbcconf Hunting - Rule", "ESCU - Windows Odbcconf Load DLL - Rule", "ESCU - Windows Odbcconf Load Response File - Rule", "ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule", "ESCU - WSReset UAC Bypass - Rule"]
|
|
|
|
|
description = Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.
|
|
|
|
|
narrative = Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
|
|
|
|
|
|
|
|
|
@@ -11559,7 +11872,7 @@ version = 1
|
|
|
|
|
references = ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"]
|
|
|
|
|
maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule"]
|
|
|
|
|
searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule"]
|
|
|
|
|
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more.
|
|
|
|
|
narrative = Clop ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data.
|
|
|
|
|
|
|
|
|
@@ -11833,7 +12146,7 @@ version = 1
|
|
|
|
|
references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"]
|
|
|
|
|
maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule"]
|
|
|
|
|
searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule"]
|
|
|
|
|
description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
|
|
|
|
|
narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \
|
|
|
|
|
HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \
|
|
|
|
@@ -12153,7 +12466,7 @@ version = 2
|
|
|
|
|
references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
|
|
|
|
|
maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
|
|
|
|
|
spec_version = 3
|
|
|
|
|
searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
|
|
|
|
|
searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Event Triggered Image File Execution Options Injection - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
|
|
|
|
|
description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
|
|
|
|
|
narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
|
|
|
|
|
|
|
|
|
|
pyth0n1c