diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml new file mode 100644 index 0000000000..3f31a7ffa2 --- /dev/null +++ b/detections/endpoint/disable_registry_tool.yml @@ -0,0 +1,49 @@ +name: Disable Registry Tool +id: cd2cf33c-9201-11eb-a10a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies modification of registry to disable the + regedit or registry tools of windows operating system. Since registry tool is a + swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this + application to prevent the removal of their registry entry such as persistence, + file less components and defense evasion. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml new file mode 100644 index 0000000000..036ea045f8 --- /dev/null +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -0,0 +1,52 @@ +name: Disable Show Hidden Files +id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search is to idetifies a modification in registry to prevent + the user seeing all the files with hidden attributes. This event or techniques are + known on some worm and trojan spy malware that will drop hidden files on the infected + machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" + OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" + Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= + "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" + Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1564.001 + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_nam + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml new file mode 100644 index 0000000000..7c5ab7d25e --- /dev/null +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -0,0 +1,51 @@ +name: Disable Windows Behavior Monitoring +id: 79439cae-9200-11eb-a4d3-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies a modification in registry to disable the + windows denfender real time behavior monitoring. This event or technique is commonly + seen in RAT, bot, or Trojan to disable AV to evade detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows + Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= + "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" + OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time + Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml new file mode 100644 index 0000000000..b127627da0 --- /dev/null +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -0,0 +1,49 @@ +name: Disable Windows SmartScreen Protection +id: 664f0fd0-91ff-11eb-a56f-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search identifies a modification of registry to disable + the smartscreen protection of windows machine. This is windows feature provide an + early warning system against website that might engage in phishing attack or malware + distribution. This modification are seen in RAT malware to cover their tracks upon + downloading other of its component or other payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name + = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to disable this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_nam + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml new file mode 100644 index 0000000000..60d544c9bb --- /dev/null +++ b/detections/endpoint/disabling_cmd_application.yml @@ -0,0 +1,48 @@ +name: Disabling CMD Application +id: ff86077c-9212-11eb-a1e6-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify modification in registry to disable cmd prompt + application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging + or deleting there samples through cmd application which is one of the tool of analyst + to traverse on directory and files. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml new file mode 100644 index 0000000000..f4c03a35b8 --- /dev/null +++ b/detections/endpoint/disabling_controlpanel.yml @@ -0,0 +1,47 @@ +name: Disabling ControlPanel +id: 6ae0148e-9215-11eb-a94a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to identify registry modification to disable control panel + window. This technique is commonly seen in malware to prevent their artifacts , + persistence removed on the infected machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml new file mode 100644 index 0000000000..03fff72233 --- /dev/null +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -0,0 +1,52 @@ +name: Disabling Firewall with Netsh +id: 6860a62c-9203-11eb-9e05-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies suspicious firewall disabling using netsh + application. this technique is commonly seen in malware that tries to communicate + or download its component or other payload to its C2 server. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe + Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= + "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`' +how_to_implement: You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint file-system data model node. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: admin may disable firewall during testing or fixing network + problem. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml new file mode 100644 index 0000000000..59adce28fc --- /dev/null +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -0,0 +1,49 @@ +name: Disabling FolderOptions Windows Feature +id: 83776de4-921a-11eb-868a-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identify registry modification to disable folder options + feature of windows to show hidden files, file extension and etc. This technique + used by malware in combination if disabling show hidden files feature to hide their + files and also to hide the file extension to lure the user base on file icons or + fake file extensions. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml new file mode 100644 index 0000000000..e77ffbd10c --- /dev/null +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -0,0 +1,50 @@ +name: Disabling NoRun Windows App +id: de81bc46-9213-11eb-adc9-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identify modification of registry to disable run application + in window start menu. this application is known to be a helpful shortcut to windows + OS user to run known application and also to execute some reg or batch script. This + technique is used malware to make cleaning of its infection more harder by preventing + known application run easily through run shortcut. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.malwarebytes.com/detections/pum-optional-norun/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml new file mode 100644 index 0000000000..f0ed94188f --- /dev/null +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -0,0 +1,50 @@ +name: Disabling SystemRestore In Registry +id: f4f837e2-91fb-11eb-8bf6-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following search identifies the modification of registry related + in disabling the system restore of a machine. This event or behavior are seen in + some RAT malware to make the restore of the infected machine difficult and keep + their infection on the box. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = + "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: in some cases admin can disable systemrestore on a machine. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml new file mode 100644 index 0000000000..f1ce08549d --- /dev/null +++ b/detections/endpoint/disabling_task_manager.yml @@ -0,0 +1,49 @@ +name: Disabling Task Manager +id: dac279bc-9202-11eb-b7fb-acde48001122 +version: 1 +date: '2021-03-31' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to identifies modification of registry to disable the + task manager of windows operating system. this event or technique are commonly seen + in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate + their process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" + Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin may disable this application for non technical user. +references: +- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry +- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/tests/endpoint/disable_registry_tool.test.yml b/tests/endpoint/disable_registry_tool.test.yml new file mode 100644 index 0000000000..f2f6fd210c --- /dev/null +++ b/tests/endpoint/disable_registry_tool.test.yml @@ -0,0 +1,22 @@ +name: Disable Registry Tool Unit Test +tests: +- name: Disable Registry Tool + file: endpoint/disable_registry_tool.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_show_hidden_files.test.yml b/tests/endpoint/disable_show_hidden_files.test.yml new file mode 100644 index 0000000000..98db777275 --- /dev/null +++ b/tests/endpoint/disable_show_hidden_files.test.yml @@ -0,0 +1,22 @@ +name: Disable Show Hidden Files Unit Test +tests: +- name: Disable Show Hidden Files + file: endpoint/disable_show_hidden_files.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_windows_behavior_monitoring.test.yml b/tests/endpoint/disable_windows_behavior_monitoring.test.yml new file mode 100644 index 0000000000..01c556ef9c --- /dev/null +++ b/tests/endpoint/disable_windows_behavior_monitoring.test.yml @@ -0,0 +1,22 @@ +name: Disable Windows Behavior Monitoring Unit Test +tests: +- name: Disable Windows Behavior Monitoring + file: endpoint/disable_windows_behavior_monitoring.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_windows_smartscreen_protection.test.yml b/tests/endpoint/disable_windows_smartscreen_protection.test.yml new file mode 100644 index 0000000000..b1174e469c --- /dev/null +++ b/tests/endpoint/disable_windows_smartscreen_protection.test.yml @@ -0,0 +1,22 @@ +name: Disable Windows SmartScreen Protection Unit Test +tests: +- name: Disable Windows SmartScreen Protection + file: endpoint/disable_windows_smartscreen_protection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_cmd_application.test.yml b/tests/endpoint/disabling_cmd_application.test.yml new file mode 100644 index 0000000000..42cb6a6770 --- /dev/null +++ b/tests/endpoint/disabling_cmd_application.test.yml @@ -0,0 +1,22 @@ +name: Disabling CMD Application Unit Test +tests: +- name: Disabling CMD Application + file: endpoint/disabling_cmd_application.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_controlpanel.test.yml b/tests/endpoint/disabling_controlpanel.test.yml new file mode 100644 index 0000000000..b0f8a184d4 --- /dev/null +++ b/tests/endpoint/disabling_controlpanel.test.yml @@ -0,0 +1,22 @@ +name: Disabling ControlPanel Unit Test +tests: +- name: Disabling ControlPanel + file: endpoint/disabling_controlpanel.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_firewall_with_netsh.test.yml b/tests/endpoint/disabling_firewall_with_netsh.test.yml new file mode 100644 index 0000000000..cfad109c1e --- /dev/null +++ b/tests/endpoint/disabling_firewall_with_netsh.test.yml @@ -0,0 +1,22 @@ +name: Disabling Firewall with Netsh Unit Test +tests: +- name: Disabling Firewall with Netsh + file: endpoint/disabling_firewall_with_netsh.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml new file mode 100644 index 0000000000..213be9e4cf --- /dev/null +++ b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml @@ -0,0 +1,22 @@ +name: Disabling FolderOptions Windows Feature Unit Test +tests: +- name: Disabling FolderOptions Windows Feature + file: endpoint/disabling_folderoptions_windows_feature.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlogE \ No newline at end of file diff --git a/tests/endpoint/disabling_norun_windows_app.test.yml b/tests/endpoint/disabling_norun_windows_app.test.yml new file mode 100644 index 0000000000..93cb1186b8 --- /dev/null +++ b/tests/endpoint/disabling_norun_windows_app.test.yml @@ -0,0 +1,22 @@ +name: Disabling NoRun Windows App Unit Test +tests: +- name: Disabling NoRun Windows App + file: endpoint/disabling_norun_windows_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_systemrestore_in_registry.test.yml b/tests/endpoint/disabling_systemrestore_in_registry.test.yml new file mode 100644 index 0000000000..61d8cfbf10 --- /dev/null +++ b/tests/endpoint/disabling_systemrestore_in_registry.test.yml @@ -0,0 +1,22 @@ +name: Disabling SystemRestore In Registry Unit Test +tests: +- name: Disabling SystemRestore In Registry + file: endpoint/disabling_systemrestore_in_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_task_manager.test.yml b/tests/endpoint/disabling_task_manager.test.yml new file mode 100644 index 0000000000..b169662e6b --- /dev/null +++ b/tests/endpoint/disabling_task_manager.test.yml @@ -0,0 +1,22 @@ +name: Disabling Task Manager Unit Test +tests: +- name: Disabling Task Manager + file: endpoint/disabling_task_manager.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: True + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file