From fae82533c448aa07d21b23dbf6a7d69b6c0e28c9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 2 May 2023 10:05:05 +0200 Subject: [PATCH 1/3] do_not_step_on_redline3 --- .../endpoint/disabling_defender_services.yml | 1 + ...assword_stores_chrome_extension_access.yml | 60 ++++++++++++++++++ ...ssword_stores_chrome_localstate_access.yml | 60 ++++++++++++++++++ ...ssword_stores_chrome_login_data_access.yml | 61 ++++++++++++++++++ ...uery_registry_browser_list_application.yml | 61 ++++++++++++++++++ ..._query_registry_uninstall_program_list.yml | 59 +++++++++++++++++ .../windows_service_stop_win_updates.yml | 63 +++++++++++++++++++ 7 files changed, 365 insertions(+) create mode 100644 detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml create mode 100644 detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml create mode 100644 detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml create mode 100644 detections/endpoint/windows_query_registry_browser_list_application.yml create mode 100644 detections/endpoint/windows_query_registry_uninstall_program_list.yml create mode 100644 detections/endpoint/windows_service_stop_win_updates.yml diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index ea81a3a6df..1564b9ae86 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -37,6 +37,7 @@ tags: analytic_story: - IcedID - Windows Registry Abuse + - RedLine Stealer asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml new file mode 100644 index 0000000000..ee0f5981d6 --- /dev/null +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -0,0 +1,60 @@ +name: Windows Credentials from Password Stores Chrome Extension Access +id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af +version: 1 +date: '2023-04-26' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a non-chrome process accessing Chrome extensions file. + This file stores various settings and information related to the browser's extensions on your computer. Threat actor, adversaries and malware author + also abused this file to attempt to extract sensitive information from the chrome browser of the target host. + This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" + AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\chrome.exe")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_extension_access_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a non-chrome process accessing chrome browser extension folder files in $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_ext_access/security-ext-raw.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml new file mode 100644 index 0000000000..dc4c6c67fe --- /dev/null +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -0,0 +1,60 @@ +name: Windows Credentials from Password Stores Chrome LocalState Access +id: 3b1d09a8-a26f-473e-a510-6c6613573657 +version: 1 +date: '2023-04-26' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a non-chrome process accessing Chrome user data "local state" file. + This file stores various settings and information related to the browser's operation on your computer. Threat actor, adversaries and malware author + also abused this file to attempt to extract the encrypted master key to decrypt password saved in chrome browser. + This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" + NOT (process_name IN ("*\\chrome.exe","*:\\Windows\\explorer.exe")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_localstate_access_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: uninstall chrome application may access this file and folder path to removed chrome installation in target host. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a non-chrome process accessing "Chrome\\User Data\\Local State" file in $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_local_state_simulate_access/redline-local-state-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml new file mode 100644 index 0000000000..ed7ed71361 --- /dev/null +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -0,0 +1,61 @@ +name: Windows Credentials from Password Stores Chrome Login Data Access +id: 0d32ba37-80fc-4429-809c-0ba15801aeaf +version: 1 +date: '2023-04-27' +author: Teoderick Contreras, Splunk +status: production +type: anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a non-chrome process accessing Chrome user data "login data" file. + This sqlite db file stores various information related to the browser's operation on your computer. Threat actor, adversaries and malware author + also abused this file to attempt to extract and decrypt password saved in chrome browser. + This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" + AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_login_data_access_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 70 + impact: 70 + message: a non-chrome process accessing Chrome "Login Data" file in $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_login_data_simulate_access/redline-login-data-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml new file mode 100644 index 0000000000..066e1c59c1 --- /dev/null +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -0,0 +1,61 @@ +name: Windows Query Registry Browser List Application +id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb +version: 1 +date: '2023-04-25' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a suspicious process accessing default internet browsers registry entry. + This registry is used by Windows to store information about default internet browsers installed on a system. + Malware, adversaries or red-teamers can abuse this registry key to collect data about the installed internet browsers and their associated settings. + This information can be used to steal sensitive data such as login credentials, browsing history, and saved passwords. + We observed noise that needs to be filter out so we add several known path of Windows Application to make this detection more stable. +search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\SOFTWARE\\Clients\\StartMenuInternet\\*", "*\\SOFTWARE\\Clients\\StartMenuInternet\\*") + AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_query_registry_browser_list_application_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a suspicious process accessing installed default browser registry in $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_ext_access/security-ext-raw.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml new file mode 100644 index 0000000000..eba6de979c --- /dev/null +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -0,0 +1,59 @@ +name: Windows Query Registry UnInstall Program List +id: 535fd4fc-7151-4062-9d7e-e896bea77bf6 +version: 1 +date: '2023-04-25' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a suspicious query on uninstall application list in Windows OS registry. + This registry is commonly used by legitimate software to store information about installed applications on a Windows system, such as their name, version, publisher, and installation path. + However, malware, adversaries or even red-teamers can abuse this registry key to retrieve information stored in the "Uninstall" key to gather data about installed applications in the target host. + This Anomaly detection can be a good pivot to detect a possible suspicious process accessing this registry which is not commonly accessed by a normal user. +search: '`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall" + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_query_registry_uninstall_program_list_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a suspicious process accessing uninstall registry in $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/recon_registry/recon-reg-redline-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml new file mode 100644 index 0000000000..4c901528e0 --- /dev/null +++ b/detections/endpoint/windows_service_stop_win_updates.yml @@ -0,0 +1,63 @@ +name: 'Windows Service Stop Win Updates' +id: 0dc25c24-6fcf-456f-b08b-dd55a183e4de +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- System Event ID 7040 +description: The following analytic identifies a windows update service being disabled in Windows OS. + This technique is being abused by adversaries or threat actors to add defense mechanisms to their malware implant in the targeted host. + Disabling windows update will put the compromised host vulnerable in some zero day exploit or even some update features against threats. + RedLine Stealer kills this service as part of its defense evasion mechanism. +search: '`wineventlog_system` EventCode=7040 + (service_name IN ("Update Orchestrator Service for Windows Update", "WaaSMedicSvc", "Windows Update") OR param1 IN ("UsoSvc", "WaaSMedicSvc", "wuauserv")) AND + (param3=disabled OR start_mode = disabled) + | stats count min(_time) as firstTime max(_time) as lastTime by Computer Error_Code service_name start_mode param1 param2 param3 param4 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_service_stop_win_updates_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints (like Windows system.log Event ID 7040) +known_false_positives: network administrator may disable this services as part of its audit process within the network. filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 70 + impact: 70 + message: windows update services $service_name$ was being disabled in $dest$ + mitre_attack_id: + - T1489 + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - EventCode + - Error_Code + - service_name + - start_mode + - param1 + - param2 + - param3 + - param4 + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/win_update_services_stop/system.log + source: XmlWinEventLog:System + sourcetype: WinEventLog From 9b7689e1996ef1ae23a56e57c167e33619476438 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 2 May 2023 15:20:08 +0200 Subject: [PATCH 2/3] do_not_step_on_redline3 --- .../windows_query_registry_browser_list_application.yml | 2 +- .../endpoint/windows_query_registry_uninstall_program_list.yml | 2 +- detections/endpoint/windows_service_stop_win_updates.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index 066e1c59c1..72284afb2a 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -56,6 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_ext_access/security-ext-raw.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_list/ar3_4663_redline_reg.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml index eba6de979c..57755eac29 100644 --- a/detections/endpoint/windows_query_registry_uninstall_program_list.yml +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -11,7 +11,7 @@ description: The following analytic identifies a suspicious query on uninstall a This registry is commonly used by legitimate software to store information about installed applications on a Windows system, such as their name, version, publisher, and installation path. However, malware, adversaries or even red-teamers can abuse this registry key to retrieve information stored in the "Uninstall" key to gather data about installed applications in the target host. This Anomaly detection can be a good pivot to detect a possible suspicious process accessing this registry which is not commonly accessed by a normal user. -search: '`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall" +search: '`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml index 4c901528e0..d429a6fcc1 100644 --- a/detections/endpoint/windows_service_stop_win_updates.yml +++ b/detections/endpoint/windows_service_stop_win_updates.yml @@ -60,4 +60,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/win_update_services_stop/system.log source: XmlWinEventLog:System - sourcetype: WinEventLog + sourcetype: XmlWinEventLog From 68748537d975fc91cb40d02d5aa3a22b95988bbe Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 2 May 2023 12:55:11 -0700 Subject: [PATCH 3/3] minor fixes --- ...entials_from_password_stores_chrome_extension_access.yml | 4 ++-- ...ntials_from_password_stores_chrome_localstate_access.yml | 4 ++-- ...ntials_from_password_stores_chrome_login_data_access.yml | 6 +++--- .../windows_query_registry_browser_list_application.yml | 2 +- .../windows_query_registry_uninstall_program_list.yml | 4 ++-- detections/endpoint/windows_service_stop_win_updates.yml | 6 +++--- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index ee0f5981d6..fc7f609281 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -20,7 +20,7 @@ search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Loc how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. Filter is needed. +known_false_positives: Uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. Filter is needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer tags: @@ -29,7 +29,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a non-chrome process accessing chrome browser extension folder files in $dest$ + message: A non-chrome process $process_name$ accessing chrome browser extension folder files on $dest$ mitre_attack_id: - T1012 observable: diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index dc4c6c67fe..535824e170 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -20,7 +20,7 @@ search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Loc how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: uninstall chrome application may access this file and folder path to removed chrome installation in target host. Filter is needed. +known_false_positives: Uninstall chrome application may access this file and folder path to removed chrome installation in target host. Filter is needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer tags: @@ -29,7 +29,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a non-chrome process accessing "Chrome\\User Data\\Local State" file in $dest$ + message: A non-chrome process $process_name$ accessing "Chrome\\User Data\\Local State" file on $dest$ mitre_attack_id: - T1012 observable: diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index ed7ed71361..a0d9fe42ee 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-04-27' author: Teoderick Contreras, Splunk status: production -type: anomaly +type: Anomaly data_source: - Security Event ID 4663 description: The following analytic identifies a non-chrome process accessing Chrome user data "login data" file. @@ -20,7 +20,7 @@ search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Loc how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed. +known_false_positives: Uninstall application may access this registry to remove the entry of the target application. filter is needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer tags: @@ -29,7 +29,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: a non-chrome process accessing Chrome "Login Data" file in $dest$ + message: A non-chrome process $process_name$ accessing Chrome "Login Data" file on $dest$ mitre_attack_id: - T1012 observable: diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index 72284afb2a..36b4f78c04 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a suspicious process accessing installed default browser registry in $dest$ + message: A suspicious process accessing installed default browser registry on $dest$ mitre_attack_id: - T1012 observable: diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml index 57755eac29..ed5649b780 100644 --- a/detections/endpoint/windows_query_registry_uninstall_program_list.yml +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -19,7 +19,7 @@ search: '`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MAC how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed. +known_false_positives: Uninstall application may access this registry to remove the entry of the target application. Filter is needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer tags: @@ -28,7 +28,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a suspicious process accessing uninstall registry in $dest$ + message: A suspicious process $process_name$ accessing uninstall registry on $dest$ mitre_attack_id: - T1012 observable: diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml index d429a6fcc1..b8d5271570 100644 --- a/detections/endpoint/windows_service_stop_win_updates.yml +++ b/detections/endpoint/windows_service_stop_win_updates.yml @@ -1,4 +1,4 @@ -name: 'Windows Service Stop Win Updates' +name: Windows Service Stop Win Updates id: 0dc25c24-6fcf-456f-b08b-dd55a183e4de version: 1 date: '2023-04-21' @@ -21,7 +21,7 @@ search: '`wineventlog_system` EventCode=7040 how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints (like Windows system.log Event ID 7040) -known_false_positives: network administrator may disable this services as part of its audit process within the network. filter is needed. +known_false_positives: Network administrator may disable this services as part of its audit process within the network. Filter is needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer tags: @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: windows update services $service_name$ was being disabled in $dest$ + message: Windows update services $service_name$ was being disabled on $dest$ mitre_attack_id: - T1489 observable: