From e6a9d082b095210a73398390f42d0d97ff6c3ce5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 1 Jun 2022 09:48:17 +0200 Subject: [PATCH 1/6] follina_path_traversal_update --- ...mand_and_scripting_interpreter_path_traversal_exec.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 0644a91e53..a14cdaa66a 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -1,7 +1,7 @@ name: Windows Command and Scripting Interpreter Path Traversal Exec id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 -version: 1 -date: '2022-05-30' +version: 2 +date: '2022-06-01' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,12 +10,12 @@ description: The following analytic identifies path traversal commandline execut using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/..\/..\/..\/..\/..\/..\/*" by + as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From 223f4b73ba609fb1396e300beab0b4f6ea83a9a2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 1 Jun 2022 16:14:46 +0200 Subject: [PATCH 2/6] follina_path_traversal_update --- ...ing_interpreter_hunting_path_traversal.yml | 79 +++++++++++++++++++ ...nterpreter_hunting_path_traversal.test.yml | 13 +++ 2 files changed, 92 insertions(+) create mode 100644 detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml create mode 100644 tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml new file mode 100644 index 0000000000..cfa8473e62 --- /dev/null +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -0,0 +1,79 @@ +name: Windows Command and Scripting Interpreter Hunting Path Traversal +id: d0026380-b3c4-4da0-ac8e-02790063ff6b +version: 1 +date: '2022-06-01' +author: Teoderick Contreras, Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and commandline + that runs execute path ttraversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes by + Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | eval num_pat1 = (mvcount(split(process,"/.."))-1) + | eval num_pat2 = (mvcount(split(process,"\.."))-1) + | eval num_pat3 = (mvcount(split(process,"\\.."))-1) + | eval num_pat4 = (mvcount(split(process,"//.."))-1) + | search num_pat1 > 1 OR num_pat2 > 1 OR num_pat3 > 1 OR num_pat4 > 1 + | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product +known_false_positives: false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better. +references: +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + impact: 60 + kill_chain_phases: + - Exploitation + message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ + mitre_attack_id: + - T1059 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 36 + security_domain: endpoint diff --git a/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml b/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml new file mode 100644 index 0000000000..30208eb4bc --- /dev/null +++ b/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml @@ -0,0 +1,13 @@ +name: Windows Command and Scripting Interpreter Hunting Path Traversal Unit Test +tests: +- name: Windows Command and Scripting Interpreter Hunting Path Traversal + file: endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From da7c18f2343462cd4bf0fdeb527440014d61661b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 1 Jun 2022 16:28:03 +0200 Subject: [PATCH 3/6] Update windows_command_and_scripting_interpreter_hunting_path_traversal.yml --- ...nd_scripting_interpreter_hunting_path_traversal.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index cfa8473e62..9a0fb6f789 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -16,11 +16,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | eval num_pat1 = (mvcount(split(process,"/.."))-1) - | eval num_pat2 = (mvcount(split(process,"\.."))-1) - | eval num_pat3 = (mvcount(split(process,"\\.."))-1) - | eval num_pat4 = (mvcount(split(process,"//.."))-1) - | search num_pat1 > 1 OR num_pat2 > 1 OR num_pat3 > 1 OR num_pat4 > 1 + | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) + | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1) + | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) + | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) + | search count_of_pattern1 > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From 11ab1d104bbfd332ff810f13ecbf6904a228fe22 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 15:20:15 -0600 Subject: [PATCH 4/6] text --- ..._command_and_scripting_interpreter_path_traversal_exec.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index a14cdaa66a..f084d38485 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline +description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by From 58cb36ab2c748ecd32524b3b0256919631879a2f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 15:21:08 -0600 Subject: [PATCH 5/6] Update windows_command_and_scripting_interpreter_hunting_path_traversal.yml --- ...and_and_scripting_interpreter_hunting_path_traversal.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index 9a0fb6f789..441b05763f 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and commandline - that runs execute path ttraversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line + that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash From f6dda32dd2c2be5d535aab17c8f217813b0d53fc Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 15:38:29 -0600 Subject: [PATCH 6/6] Update windows_command_and_scripting_interpreter_hunting_path_traversal.yml --- ...command_and_scripting_interpreter_hunting_path_traversal.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index 441b05763f..ff4c9749ac 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code +description: The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)