Branch was auto-updated.

detections/endpoint/sc_exe_manipulating_windows_services.yml

@@ -20,7 +20,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However,
   there may be legitimate instances of this behavior. It is important to validate
   and investigate as appropriate.
-references: []
+references:
+  - https://www.secureworks.com/blog/drokbk-malware-uses-github-as-dead-drop-resolver
 tags:
   analytic_story:
   - Windows Service Abuse
@@ -30,6 +31,7 @@ tags:
   - Disabling Security Tools
   - NOBELIUM Group
   - Azorult
+  - Windows Drivers
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml

@@ -0,0 +1,85 @@
+name: Windows Disable Windows Event Logging Disable HTTP Logging
+id: 23fb6787-255f-4d5b-9a66-9fd7504032b5
+version: 1
+date: '2022-12-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies AppCmd.exe being utilized to disable HTTP logging on IIS.
+  Adversaries may perform this action to disable logging and delete the logs so remove any trace or events on disk.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name  IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe 
+  Processes.process IN ("*set config*", "*httplogging*","*dontlog:true*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_disable_windows_event_logging_disable_http_logging_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present only if scripts or Administrators are disabling logging. Filter as needed by parent process or other.
+references:
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable IIS HTTP Logging.
+  mitre_attack_id:
+  - T1562.002
+  - T1562
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_iis_components_add_new_module.yml

@@ -0,0 +1,87 @@
+name: Windows IIS Components Add New Module
+id: 38fe731c-1f13-43d4-b878-a5bbe44807e3
+version: 1
+date: '2022-12-19'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the process AppCmd.exe installing a new module into IIS.
+  AppCmd is a utility to manage IIS web sites and App Pools.
+  An adversary may run this command to install a webshell or backdoor. This has been found to be used for credit card scraping, persistence, and further post-exploitation.
+  An administrator may run this to install new modules for a web site or during IIS updates.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name  IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe 
+  Processes.process IN ("*install *", "*module *") AND Processes.process="*image*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_iis_components_add_new_module_filter`'
+how_to_implement: Tune the analytic for your environment by filtering by known good modules or processes. Enable as TTP once the volume is low enough. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present until properly tuned. Filter as needed.
+references:
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to install a new IIS module.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml

@@ -0,0 +1,54 @@
+name: Windows IIS Components Get-WebGlobalModule Module Query
+id: 20db5f70-34b4-4e83-8926-fa26119de173
+version: 1
+date: '2022-12-20'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: The following analytic requires the use of PowerShell inputs to run Get-WebGlobalModule to list out all the IIS Modules installed. The output is a list of Module names and the Image path of the DLL. 
+search: '`iis_get_webglobalmodule` | stats count min(_time) as firstTime max(_time) as lastTime by host name image | rename host as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_get_webglobalmodule_module_query_filter`'
+how_to_implement: You must ingest the PwSh cmdlet Get-WebGlobalModule in order to utilize this analytic. Follow https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
+known_false_positives: This analytic is meant to assist with hunting modules across a fleet of IIS servers. Filter and modify as needed.
+references:
+- https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/MonitorWindowsdatawithPowerShellscripts
+- https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
+- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/pwsh_installediismodules.log
+  impact: 10
+  kill_chain_phases:
+  - Installation
+  message: IIS Modules have been listed on $dest$.
+  mitre_attack_id:
+  - T1505.004
+  - T1505
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - host 
+  - name 
+  - image
+  risk_score: 1
+  security_domain: endpoint

detections/endpoint/windows_iis_components_module_failed_to_load.yml

@@ -0,0 +1,59 @@
+name: Windows IIS Components Module Failed to Load
+id: 40c2ba5b-dd6a-496b-9e6e-c9524d0be167
+version: 1
+date: '2022-12-20'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic utilizes EventCode 2282 which generates when a Module DLL could not be loaded due to a configuration problem. This typically occurs when a IIS module is installed but is failing to load. This typically results in thousands of events until the issue is resolved.
+  Review the module that is failing and determine if it is legitimate or not.
+search: '`wineventlog_application` EventCode=2282 | stats  count min(_time) as firstTime max(_time) as lastTime by  EventCode dest Name ModuleDll | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_module_failed_to_load_filter`'
+how_to_implement: IIS must be installed and Application event logs must be collected in order to utilize this analytic.
+known_false_positives: False positives will be present until all module failures are resolved or reviewed.
+references:
+  - https://social.technet.microsoft.com/wiki/contents/articles/21757.event-id-2282-iis-worker-process-availability.aspx
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/2282_windows-application.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  message: A new IIS Module has been loaded and should be reviewed on $dest$.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OpCode
+  - EventCode 
+  - ComputerName
+  - Message
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/windows_iis_components_new_module_added.yml

@@ -0,0 +1,61 @@
+name: Windows IIS Components New Module Added
+id: 55f22929-cfd3-4388-ba5c-4d01fac7ee7e
+version: 1
+date: '2022-12-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analytic uses the Windows Event log - Microsoft-IIS-Configuration/Operational - which must be enabled and logged on Windows IIS servers before it can be Splunked. The following analytic identifies newly installed IIS modules.
+  Per Microsoft, IIS modules are not commonly added to a production IIS server, so alerting on this event ID should be enabled.IIS modules can be installed at a global level or at a site level. In detecting malicious IIS modules, it is important to check both the global and site level for unauthorized modules. Regular monitoring of these locations for such modules and comparing against a known good list can help detect and identify malicious IIS modules.
+search: '`iis_operational_logs` EventCode=29
+  | stats  count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | rename ComputerName AS dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_new_module_added_filter`'
+how_to_implement: You must enabled the IIS Configuration Operational log before ingesting in Splunk. Setup and inputs may be found here https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040.
+known_false_positives: False positives may be present when updates or an administrator adds a new module to IIS. Monitor and filter as needed.
+references:
+  - https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/IIS-Configuration-Operational.log
+  impact: 60
+  kill_chain_phases:
+  - Installation
+  message: A new IIS Module has been loaded and should be reviewed on $dest$.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OpCode
+  - EventCode 
+  - ComputerName
+  - Message
+  risk_score: 48
+  security_domain: endpoint

detections/endpoint/windows_powershell_disable_http_logging.yml

@@ -0,0 +1,64 @@
+name: Windows PowerShell Disable HTTP Logging
+id: 27958de0-2857-43ca-9d4c-b255cf59dcab
+version: 1
+date: '2022-12-21'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analtyic identifies the use of get-WebConfigurationProperty and Set-ItemProperty attempting to disable HTTP logging on windows via PowerShell. 
+  Adversaries may perform this action to disable HTTP logging to cover tracks and delete logs on disk.
+search: '`powershell` EventCode=4104 ScriptBlockText IN("*get-WebConfigurationProperty*","*Set-ItemProperty*") AND ScriptBlockText IN ("*httpLogging*","*Logfile.enabled*") AND ScriptBlockText IN ("*dontLog*", "*false*")   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_powershell_disable_http_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+tags:
+  analytic_story:
+  - IIS Components
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A PowerShell Cmdlet related to disable or modifying a IIS HTTP logging has occurred on $Computer$.
+  mitre_attack_id:
+  - T1562
+  - T1562.002
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - EventCode
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml

@@ -0,0 +1,64 @@
+name: Windows PowerShell IIS Components WebGlobalModule Usage
+id: 33fc9f6f-0ce7-4696-924e-a69ec61a3d57
+version: 1
+date: '2022-12-21'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies the usage of PowerShell Cmdlets - New-WebGlobalModule, Enable-WebGlobalModule and Set-WebGlobalModule being utilized to create (new), enable (start) or modify a current IIS Module.
+  These commands are equivalent to AppCmd.exe parameters.
+  Adversaries may utilize these cmdlets as they are lesser known and perform the same activity as AppCmd. 
+search: '`powershell` EventCode=4104 ScriptBlockText IN("*New-WebGlobalModule*","*Enable-WebGlobalModule*","*Set-WebGlobalModule*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`  | `windows_powershell_iis_components_webglobalmodule_usage_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
+references:
+  - https://learn.microsoft.com/en-us/powershell/module/webadministration/new-webglobalmodule?view=windowsserver2022-ps
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
+tags:
+  analytic_story:
+  - IIS Components
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_windows-powershell.log
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  message: A PowerShell Cmdlet related to enabling, creating or modifying a IIS module has occurred on $Computer$.
+  mitre_attack_id:
+  - T1505
+  - T1505.004
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Computer
+  - EventCode
+  risk_score: 64
+  security_domain: endpoint

detections/endpoint/windows_remote_access_software_hunt.yml

@@ -20,6 +20,7 @@ known_false_positives: False positives will be found. Filter as needed and creat
 references:
   - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
   - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md
+  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
 tags:
   analytic_story:
   - Insider Threat

lookups/remote_access_software.csv

@@ -49,4 +49,6 @@ winvncsc.exe, VNC, TRUE
 winwvc.exe, VNC, TRUE
 Zaservice.exe, Zoho Assist, TRUE
 Zohours.exe, Zoho Assist, TRUE
-ZohoMeeting.exe, Zoho Assist, TRUE
+ZohoMeeting.exe, Zoho Assist, TRUE
+meshagent.exe, MeshAgent, TRUE
+tacticalrmm.exe, Tactical RMM, TRUE

macros/iis_get_webglobalmodule.yml

@@ -0,0 +1,4 @@
+definition: sourcetype="Pwsh:InstalledIISModules"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: iis_get_webglobalmodule

macros/iis_operational_logs.yml

@@ -0,0 +1,4 @@
+definition: sourcetype="IIS:Configuration:Operational"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: iis_operational_logs

stories/iis_components.yml

@@ -0,0 +1,27 @@
+name: IIS Components
+id: 0fbde550-8252-43ab-a26a-03976f55b58b
+version: 1
+date: '2022-12-19'
+author: Michael Haag, Splunk
+description: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.
+narrative: IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions - Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.
+
+  Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.
+
+  Adversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests. (reference MITRE)
+references:
+  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+  - https://attack.mitre.org/techniques/T1505/004/
+  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
+  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
+  - https://www.secureworks.com/research/bronze-union
+  - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
+tags:
+  analytic_story: IIS Components
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/proxynotshell.yml

@@ -11,6 +11,7 @@ references:
   - https://twitter.com/cglyer/status/1575793769814728705?s=20&t=67gq9xCWuyPm1VEm8ydfyA
   - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
   - https://research.splunk.com/stories/proxyshell/
+  - https://www.inversecos.com/2022/07/hunting-for-apt-abuse-of-exchange.html
 tags:
   analytic_story: ProxyNotShell
   category:

stories/proxyshell.yml

@@ -22,6 +22,7 @@ references:
 - https://www.youtube.com/watch?v=FC6iHw258RI
 - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 - https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf
+- https://www.inversecos.com/2022/07/hunting-for-apt-abuse-of-exchange.html
 tags:
   analytic_story: ProxyShell
   category:

tests/endpoint/windows_disable_windows_event_logging_disable_http_logging.test.yml

@@ -0,0 +1,13 @@
+name: Windows Disable Windows Event Logging Disable HTTP Logging Unit Test
+tests:
+- name: Windows Disable Windows Event Logging Disable HTTP Logging
+  file: endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: disable_http_logging_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog 
+    update_timestamp: true

tests/endpoint/windows_iis_components_add_new_module.test.yml

@@ -0,0 +1,13 @@
+name: Windows IIS Components Add New Module Unit Test
+tests:
+- name: Windows IIS Components Add New Module
+  file: endpoint/windows_iis_components_add_new_module.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: appcmd_install-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_iis_components_get_webglobalmodule_module_query.test.yml

@@ -0,0 +1,13 @@
+name: Windows IIS Components Get-WebGlobalModule Module Query Unit Test
+tests:
+- name: Windows IIS Components Get-WebGlobalModule Module Query
+  file: endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: pwsh_installediismodules.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/pwsh_installediismodules.log
+    source: powershell://AppCmdModules
+    sourcetype: Pwsh:InstalledIISModules
+    update_timestamp: true

tests/endpoint/windows_iis_components_module_failed_to_load.test.yml

@@ -0,0 +1,13 @@
+name: Windows IIS Components Module Failed to Load Unit Test
+tests:
+- name: Windows IIS Components Module Failed to Load
+  file: endpoint/windows_iis_components_module_failed_to_load.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 2282_windows-application.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/2282_windows-application.log
+    source: XmlWinEventLog:Application
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/windows_iis_components_new_module_added.test.yml

@@ -0,0 +1,13 @@
+name: Windows IIS Components New Module Added Unit Test
+tests:
+- name: Windows IIS Components New Module Added
+  file: endpoint/windows_iis_components_new_module_added.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: IIS-Configuration-Operational.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/IIS-Configuration-Operational.log
+    source: IIS:Configuration:Operational
+    sourcetype: IIS:Configuration:Operational
+    update_timestamp: true

tests/endpoint/windows_powershell_disable_http_logging.test.yml

@@ -0,0 +1,13 @@
+name: Windows PowerShell Disable HTTP Logging Unit Test
+tests:
+- name: Windows PowerShell Disable HTTP Logging
+  file: endpoint/windows_powershell_disable_http_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_disable_http_logging_windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_powershell_iis_components_webglobalmodule_usage.test.yml

@@ -0,0 +1,13 @@
+name: Windows PowerShell IIS Components WebGlobalModule Usage Unit Test
+tests:
+- name: Windows PowerShell IIS Components WebGlobalModule Usage
+  file: endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4104_windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true