From 135e12500f0b7e5a07edc45bc8e432b42ef1e18b Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 14 Oct 2022 10:28:30 +0200 Subject: [PATCH 1/8] mshta_reg --- .../windows_mshta_execution_in_registry.yml | 75 +++++++++++++++++++ ...ndows_mshta_execution_in_registry.test.yml | 13 ++++ 2 files changed, 88 insertions(+) create mode 100644 detections/endpoint/windows_mshta_execution_in_registry.yml create mode 100644 tests/endpoint/windows_mshta_execution_in_registry.test.yml diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml new file mode 100644 index 0000000000..84df8c5750 --- /dev/null +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -0,0 +1,75 @@ +name: Windows Mshta Execution In Registry +id: e13ceade-b673-4d34-adc4-4d9c01729753 +version: 1 +date: '2022-10-14' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the usage of mshta.exe Windows binary in registry to execute malicious script. + This technique was seen in kovter malware where it create several registry entry which is a encoded javascript and will be executed by + another registry containing mshta and javascript activexobject to execute the encoded script using wscript.shell. + This TTP is a good indication of kovter malware or other adversaries or threat actors leveraging fileless detection that survive system reboot. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_value_data = "*mshta*" OR Registry.registry_value_data IN ("*javascript:*", "*vbscript:*","*WScript.Shell*") + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_mshta_execution_in_registry_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://redcanary.com/threat-detection-report/techniques/mshta/ +- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/fileless-threats?view=o365-worldwide +tags: + analytic_story: + - Suspicious Windows Registry Activities + - Windows Persistence Techniques + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a registry $registry_path$ contains mshta $registry_value_data$ in $dest$ + mitre_attack_id: + - T1218.005 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.dest + - Registry.user + - Registry.registry_value_data + - Registry.action + risk_score: 72 + security_domain: endpoint diff --git a/tests/endpoint/windows_mshta_execution_in_registry.test.yml b/tests/endpoint/windows_mshta_execution_in_registry.test.yml new file mode 100644 index 0000000000..b2a28d05f5 --- /dev/null +++ b/tests/endpoint/windows_mshta_execution_in_registry.test.yml @@ -0,0 +1,13 @@ +name: Windows Mshta Execution In Registry Unit Test +tests: +- name: Windows Mshta Execution In Registry + file: endpoint/windows_mshta_execution_in_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 93cc5d602cb99e7903ba9a49c9e4e1c05d52153f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Oct 2022 10:45:39 +0200 Subject: [PATCH 2/8] Update windows_mshta_execution_in_registry.yml --- detections/endpoint/windows_mshta_execution_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index 84df8c5750..e680ae157a 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -41,7 +41,7 @@ tags: - Source:Endpoint - Stage:Persistence dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon2.log impact: 80 kill_chain_phases: - Exploitation From b67c3bf8ce00498ae24fa1dd54165866a33ac533 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Oct 2022 10:45:52 +0200 Subject: [PATCH 3/8] Update windows_mshta_execution_in_registry.test.yml --- tests/endpoint/windows_mshta_execution_in_registry.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/windows_mshta_execution_in_registry.test.yml b/tests/endpoint/windows_mshta_execution_in_registry.test.yml index b2a28d05f5..41f99e15e4 100644 --- a/tests/endpoint/windows_mshta_execution_in_registry.test.yml +++ b/tests/endpoint/windows_mshta_execution_in_registry.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon.log + - file_name: sysmon2.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog update_timestamp: true From b5cf28dff531f720ae46847229f17500784eb65b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Oct 2022 11:13:52 +0200 Subject: [PATCH 4/8] Update windows_mshta_execution_in_registry.yml --- detections/endpoint/windows_mshta_execution_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index e680ae157a..9a3307a7be 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -41,7 +41,7 @@ tags: - Source:Endpoint - Stage:Persistence dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon2.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon3.log impact: 80 kill_chain_phases: - Exploitation From 0295a489d4109514896e4c359d4135ec2fd4725f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Oct 2022 11:14:07 +0200 Subject: [PATCH 5/8] Update windows_mshta_execution_in_registry.test.yml --- tests/endpoint/windows_mshta_execution_in_registry.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/windows_mshta_execution_in_registry.test.yml b/tests/endpoint/windows_mshta_execution_in_registry.test.yml index 41f99e15e4..a33c4c329a 100644 --- a/tests/endpoint/windows_mshta_execution_in_registry.test.yml +++ b/tests/endpoint/windows_mshta_execution_in_registry.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: sysmon2.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon2.log + - file_name: sysmon3.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon3.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog update_timestamp: true From b886ffa10f6622e27cc437f369419f244efaecac Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Oct 2022 11:47:18 +0200 Subject: [PATCH 6/8] Update windows_mshta_execution_in_registry.yml --- detections/endpoint/windows_mshta_execution_in_registry.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index 9a3307a7be..422e666cc2 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -12,7 +12,7 @@ description: The following analytic identifies the usage of mshta.exe Windows bi This TTP is a good indication of kovter malware or other adversaries or threat actors leveraging fileless detection that survive system reboot. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_data = "*mshta*" OR Registry.registry_value_data IN ("*javascript:*", "*vbscript:*","*WScript.Shell*") - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + by Registry.registry_key_name Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -68,7 +68,6 @@ tags: - Registry.registry_key_name - Registry.registry_path - Registry.dest - - Registry.user - Registry.registry_value_data - Registry.action risk_score: 72 From 6da0d7913accc160d65538b9771d5a48faef970f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Oct 2022 17:50:56 +0200 Subject: [PATCH 7/8] Update windows_mshta_execution_in_registry.test.yml --- tests/endpoint/windows_mshta_execution_in_registry.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_mshta_execution_in_registry.test.yml b/tests/endpoint/windows_mshta_execution_in_registry.test.yml index a33c4c329a..a7c80ce576 100644 --- a/tests/endpoint/windows_mshta_execution_in_registry.test.yml +++ b/tests/endpoint/windows_mshta_execution_in_registry.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: sysmon3.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon3.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog update_timestamp: true From 0867949d4d3c3fe060bbe3e22d96e1cbf1e8f8c5 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 14 Oct 2022 17:51:37 +0200 Subject: [PATCH 8/8] Update windows_mshta_execution_in_registry.yml --- detections/endpoint/windows_mshta_execution_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index 422e666cc2..681daa1a43 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -41,7 +41,7 @@ tags: - Source:Endpoint - Stage:Persistence dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon3.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3.log impact: 80 kill_chain_phases: - Exploitation