From 868bf4984a14cfebf41dacb4ef939047e7d24806 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 13:13:39 -0500 Subject: [PATCH 01/16] Updated regex, removed duplicate pwsh --- ...ndows_powershell_connect_to_internet_with_hidden_window.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index f580d559a3..9aa0fd6c46 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -24,9 +24,8 @@ search: - sqltoolsps.exe - sqlps.exe - pwsh.exe - - pwsh.exe selection2: - process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-] + process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+ condition: selection1 and selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From ffed36c532f978a33e2012e78472b95069776243 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 13:38:03 -0500 Subject: [PATCH 02/16] generated detection --- ...dows_powershell_connect_to_internet_with_hidden_window.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index fcdadc10e5..30f8ebc1a8 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -34,8 +34,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") + AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From 649304fe9565ed37965c864ec71a04cf0b0308a3 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 13:49:46 -0500 Subject: [PATCH 03/16] tweak regex because tool supplies case insensitivity --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 9aa0fd6c46..686a7e6f0a 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -25,7 +25,7 @@ search: - sqlps.exe - pwsh.exe selection2: - process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+ + process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+' condition: selection1 and selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From 7efd991ae815b04ad210b8a7369f3f2cf9d2fa31 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 14:44:18 -0500 Subject: [PATCH 04/16] pushing to share for troubleshooting --- ...dows_powershell_connect_to_internet_with_hidden_window.yml | 4 ++-- ...dows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index afa33b2910..481c9f2caf 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -28,8 +28,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") + AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true | eval body=create_map( "devices", [ diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 30f8ebc1a8..7a178c6450 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true + AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From 024be40b555d75fe8ad010d14a7d3861df741fb8 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 15:34:17 -0500 Subject: [PATCH 05/16] Updated regex again --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 686a7e6f0a..43ece3dee1 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -25,7 +25,7 @@ search: - sqlps.exe - pwsh.exe selection2: - process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+' + process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h' condition: selection1 and selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 7a178c6450..0a0e4f234a 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true + AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From 3045c568d0ddcb306758546fe32ee1a70eb6ada5 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 15:34:48 -0500 Subject: [PATCH 06/16] Manual edit to remove extra escaping that seems to break the detection --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 481c9f2caf..a1abc33364 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true + AND match_regex(process_cmd_line, /(?i)[\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\s+h/)=true | eval body=create_map( "devices", [ From d4eb3011117f87cfd87c9bbce3e553c1c52d3c1d Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 15:42:17 -0500 Subject: [PATCH 07/16] push for troulbeshooting --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index a1abc33364..aadb188ebb 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\s+h/)=true + AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h/)=true | eval body=create_map( "devices", [ diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 0a0e4f234a..1a36209f4a 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h/)=true + AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From 937beacdedf1abd0396761f1deca6b687dd41be1 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 15:55:02 -0500 Subject: [PATCH 08/16] Adding updated full regex --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 43ece3dee1..686a7e6f0a 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -25,7 +25,7 @@ search: - sqlps.exe - pwsh.exe selection2: - process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h' + process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+' condition: selection1 and selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From 0052fd4a61e107d2ff80780207d2ee8b2c9bb6b3 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 15:55:34 -0500 Subject: [PATCH 09/16] adding converted version --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 1a36209f4a..7a178c6450 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h/)=true + AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be From e74457dfabfcab410aeb82bca58cbad7c77561cd Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 15:58:22 -0500 Subject: [PATCH 10/16] adding generated non-functioning regex --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index aadb188ebb..481c9f2caf 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h/)=true + AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true | eval body=create_map( "devices", [ From 2b77ace7e073c3fe8474a49ae9694938949039e5 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 17 Aug 2023 10:10:32 -0500 Subject: [PATCH 11/16] code change --- .../contentctl_infrastructure/builder/backend_splunk_ba.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index cc632c4668..0cb7cf43f5 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -34,7 +34,7 @@ class SplunkBABackend(TextQueryBackend): add_escaped : ClassVar[str] = "\\" re_expression : ClassVar[str] = "match_regex({field}, /(?i){regex}/)=true" - re_escape_char : ClassVar[str] = "\\" + re_escape_char : ClassVar[str] = "" re_escape : ClassVar[Tuple[str]] = ('"',) cidr_expression : ClassVar[str] = "{value}" From 779b5aea630a5e4a1a8784dfcec079271a0cac80 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 17 Aug 2023 10:10:59 -0500 Subject: [PATCH 12/16] Switch to using like --- ...dential_dump_from_registry_via_reg_exe.yml | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index d5f7875df1..2bad3b3b2d 100644 --- a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -16,15 +16,21 @@ search: - reg.exe - cmd.exe selection2: - process.cmd_line|re: - - HKEY_LOCAL_MACHINE\System - - HKEY_LOCAL_MACHINE\SAM - - HKEY_LOCAL_MACHINE\Security - - HKLM\System - - HKLM\SAM - - HKLM\Security + process.cmd_line|contains: + - HKEY_LOCAL_MACHINE\\\\\\\\System + - HKEY_LOCAL_MACHINE\\\\\\\\system + - HKEY_LOCAL_MACHINE\\\\\\\\SAM + - HKEY_LOCAL_MACHINE\\\\\\\\sam + - HKEY_LOCAL_MACHINE\\\\\\\\Security + - HKEY_LOCAL_MACHINE\\\\\\\\security + - HKLM\\\\\\\\System + - HKLM\\\\\\\\system + - HKLM\\\\\\\\SAM + - HKLM\\\\\\\\sam + - HKLM\\\\\\\\Security + - HKLM\\\\\\\\security selection3: - process.cmd_line|re: save + process.cmd_line|contains: save condition: selection1 and (selection2) and selection3 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your From 74a3891f789497c08e9ef5be81d67bfa80161af2 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 17 Aug 2023 10:12:04 -0500 Subject: [PATCH 13/16] Running mass conversion --- ..._credential_dump_from_registry_via_reg_exe.yml | 15 +++++++++------ ...edential_dumping_with_ntdsutil_export_ntds.yml | 2 ++ ...ell_connect_to_internet_with_hidden_window.yml | 2 +- .../ssa___windows_remote_create_service.yml | 2 +- .../ssa___windows_service_create_with_tscon.yml | 3 ++- 5 files changed, 15 insertions(+), 9 deletions(-) diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 8c03c1170b..ffb742bbbe 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -27,12 +27,15 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, - /(?i)save/)=true --finding_report--' + null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (like(process_cmd_line, + "%HKEY_LOCAL_MACHINE\\\\System%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\system%") + OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\SAM%") OR like(process_cmd_line, + "%HKEY_LOCAL_MACHINE\\\\sam%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\Security%") + OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\security%") OR like(process_cmd_line, + "%HKLM\\\\System%") OR like(process_cmd_line, "%HKLM\\\\system%") OR like(process_cmd_line, + "%HKLM\\\\SAM%") OR like(process_cmd_line, "%HKLM\\\\sam%") OR like(process_cmd_line, + "%HKLM\\\\Security%") OR like(process_cmd_line, "%HKLM\\\\security%")) AND like(process_cmd_line, + "%save%") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 0f995ae31b..775bffd7d0 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -48,11 +48,13 @@ references: - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: analytic_story: - Credential Dumping - HAFNIUM Group - Living Off The Land + - Volt Typhoon asset_type: Endpoint confidence: 50 impact: 100 diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 7a178c6450..3d0e662d00 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true + AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index e60d1050f1..2264865145 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (match_regex(process_cmd_line, /(?i)create/)=true OR match_regex(process_cmd_line, - /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' + /(?i)\\/)=true) AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml index 6f347bc2a4..13e1db4005 100644 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -33,7 +33,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/dest:rdp-tcp%") --finding_report--' + null) | where match_regex(process_cmd_line, /(?i)/dest:rdp-tcp/)=true AND process_file_name="sc.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From 2410b52d7a6ec5b7efb728c8ca41a061fc88bb4c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 17 Aug 2023 10:12:34 -0500 Subject: [PATCH 14/16] Regenerated for testing --- ..._credential_dump_from_registry_via_reg_exe.yml | 15 +++++++++------ ...edential_dumping_with_ntdsutil_export_ntds.yml | 2 ++ ...ell_connect_to_internet_with_hidden_window.yml | 2 +- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index ddc458e504..8c8d722ba7 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -21,12 +21,15 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, - /(?i)save/)=true + null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (like(process_cmd_line, + "%HKEY_LOCAL_MACHINE\\\\System%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\system%") + OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\SAM%") OR like(process_cmd_line, + "%HKEY_LOCAL_MACHINE\\\\sam%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\Security%") + OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\security%") OR like(process_cmd_line, + "%HKLM\\\\System%") OR like(process_cmd_line, "%HKLM\\\\system%") OR like(process_cmd_line, + "%HKLM\\\\SAM%") OR like(process_cmd_line, "%HKLM\\\\sam%") OR like(process_cmd_line, + "%HKLM\\\\Security%") OR like(process_cmd_line, "%HKLM\\\\security%")) AND like(process_cmd_line, + "%save%") | eval body=create_map( "devices", [ create_map( diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index c46df3acbb..187454b817 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -69,6 +69,7 @@ references: - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: required_fields: - process.pid @@ -109,6 +110,7 @@ tags: - Credential Dumping - HAFNIUM Group - Living Off The Land + - Volt Typhoon cis20: - CIS 10 kill_chain_phases: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 481c9f2caf..7687819460 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true + AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true | eval body=create_map( "devices", [ From 1832570a398895751a81e65ce3fd6661d36629f4 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 17 Aug 2023 10:36:36 -0500 Subject: [PATCH 15/16] Swap back to regex with new escapes --- ...dential_dump_from_registry_via_reg_exe.yml | 22 +++++++------------ ...dential_dump_from_registry_via_reg_exe.yml | 15 +++++-------- ...dential_dump_from_registry_via_reg_exe.yml | 15 +++++-------- 3 files changed, 20 insertions(+), 32 deletions(-) diff --git a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 2bad3b3b2d..63be50fb9f 100644 --- a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -16,21 +16,15 @@ search: - reg.exe - cmd.exe selection2: - process.cmd_line|contains: - - HKEY_LOCAL_MACHINE\\\\\\\\System - - HKEY_LOCAL_MACHINE\\\\\\\\system - - HKEY_LOCAL_MACHINE\\\\\\\\SAM - - HKEY_LOCAL_MACHINE\\\\\\\\sam - - HKEY_LOCAL_MACHINE\\\\\\\\Security - - HKEY_LOCAL_MACHINE\\\\\\\\security - - HKLM\\\\\\\\System - - HKLM\\\\\\\\system - - HKLM\\\\\\\\SAM - - HKLM\\\\\\\\sam - - HKLM\\\\\\\\Security - - HKLM\\\\\\\\security + process.cmd_line|re: + - HKEY_LOCAL_MACHINE\\System + - HKEY_LOCAL_MACHINE\\SAM + - HKEY_LOCAL_MACHINE\\Security + - HKLM\\System + - HKLM\\SAM + - HKLM\\Security selection3: - process.cmd_line|contains: save + process.cmd_line|re: save condition: selection1 and (selection2) and selection3 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 8c8d722ba7..ddc458e504 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -21,15 +21,12 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (like(process_cmd_line, - "%HKEY_LOCAL_MACHINE\\\\System%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\system%") - OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\SAM%") OR like(process_cmd_line, - "%HKEY_LOCAL_MACHINE\\\\sam%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\Security%") - OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\security%") OR like(process_cmd_line, - "%HKLM\\\\System%") OR like(process_cmd_line, "%HKLM\\\\system%") OR like(process_cmd_line, - "%HKLM\\\\SAM%") OR like(process_cmd_line, "%HKLM\\\\sam%") OR like(process_cmd_line, - "%HKLM\\\\Security%") OR like(process_cmd_line, "%HKLM\\\\security%")) AND like(process_cmd_line, - "%save%") + null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, + /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true + OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, + /(?i)save/)=true | eval body=create_map( "devices", [ create_map( diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index ffb742bbbe..8c03c1170b 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -27,15 +27,12 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (like(process_cmd_line, - "%HKEY_LOCAL_MACHINE\\\\System%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\system%") - OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\SAM%") OR like(process_cmd_line, - "%HKEY_LOCAL_MACHINE\\\\sam%") OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\Security%") - OR like(process_cmd_line, "%HKEY_LOCAL_MACHINE\\\\security%") OR like(process_cmd_line, - "%HKLM\\\\System%") OR like(process_cmd_line, "%HKLM\\\\system%") OR like(process_cmd_line, - "%HKLM\\\\SAM%") OR like(process_cmd_line, "%HKLM\\\\sam%") OR like(process_cmd_line, - "%HKLM\\\\Security%") OR like(process_cmd_line, "%HKLM\\\\security%")) AND like(process_cmd_line, - "%save%") --finding_report--' + null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, + /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true + OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, + /(?i)save/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From 45c6fda795297995097cd56e4dcbba86628e86e2 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 17 Aug 2023 10:47:29 -0500 Subject: [PATCH 16/16] Version bumps --- ...sa___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...sa___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...sa___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 63be50fb9f..c67ba071f3 100644 --- a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,6 +1,6 @@ name: Attempted Credential Dump From Registry via Reg exe id: 14038953-e5f2-4daf-acff-5452062baf03 -version: 2 +version: 3 date: '2021-11-29' author: Jose Hernandez, Splunk status: production diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 686a7e6f0a..3f54150610 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -1,6 +1,6 @@ name: Windows Powershell Connect to Internet With Hidden Window id: 477e068e-8b6d-11ec-b6c1-81af21670352 -version: 1 +version: 2 date: '2022-02-11' author: Jose Hernandez, David Dorsey, Michael Haag Splunk status: production diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index ddc458e504..96ce3a156c 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,6 +1,6 @@ name: Attempted Credential Dump From Registry via Reg exe id: 14038953-e5f2-4daf-acff-5452062baf03 -version: 2 +version: 3 description: The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking. diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 7687819460..43e52a4cf6 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -1,6 +1,6 @@ name: Windows Powershell Connect to Internet With Hidden Window id: 477e068e-8b6d-11ec-b6c1-81af21670352 -version: 1 +version: 2 description: The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 8c03c1170b..4fb45b76b4 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,6 +1,6 @@ name: Attempted Credential Dump From Registry via Reg exe id: 14038953-e5f2-4daf-acff-5452062baf03 -version: 2 +version: 3 date: '2021-11-29' author: Jose Hernandez, Splunk type: TTP diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 3d0e662d00..b2caa8668f 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -1,6 +1,6 @@ name: Windows Powershell Connect to Internet With Hidden Window id: 477e068e-8b6d-11ec-b6c1-81af21670352 -version: 1 +version: 2 date: '2022-02-11' author: Jose Hernandez, David Dorsey, Michael Haag Splunk type: Anomaly