diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml new file mode 100644 index 0000000000..ff4c9749ac --- /dev/null +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -0,0 +1,79 @@ +name: Windows Command and Scripting Interpreter Hunting Path Traversal +id: d0026380-b3c4-4da0-ac8e-02790063ff6b +version: 1 +date: '2022-06-01' +author: Teoderick Contreras, Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line + that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes by + Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) + | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1) + | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) + | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) + | search count_of_pattern1 > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 + | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product +known_false_positives: false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better. +references: +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + impact: 60 + kill_chain_phases: + - Exploitation + message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ + mitre_attack_id: + - T1059 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 36 + security_domain: endpoint diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 0644a91e53..f084d38485 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -1,21 +1,21 @@ name: Windows Command and Scripting Interpreter Path Traversal Exec id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 -version: 1 -date: '2022-05-30' +version: 2 +date: '2022-06-01' author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline +description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/..\/..\/..\/..\/..\/..\/*" by + as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml b/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml new file mode 100644 index 0000000000..30208eb4bc --- /dev/null +++ b/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml @@ -0,0 +1,13 @@ +name: Windows Command and Scripting Interpreter Hunting Path Traversal Unit Test +tests: +- name: Windows Command and Scripting Interpreter Hunting Path Traversal + file: endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true