Branch was auto-updated.

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -5,10 +5,10 @@ date: '2023-06-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: This analytic will identify suspicious executable or scripts (known file
-  extensions) in a list of suspicious file paths in Windows. This technique is used
-  by adversaries to evade detection. The suspicious file path are known paths used
-  in the wild and are not common to have executable or scripts.
+description: This analytic identifies potentially malicious executables or scripts by examining a list of suspicious file paths on Windows Operating System. 
+  The purpose of this technique is to uncover files with known file extensions that could be used by adversaries to evade detection and persistence. 
+  The suspicious file paths selected for investigation are typically uncommon and uncommonly associated with executable or script files. 
+  By scrutinizing these paths, we can proactively identify potential security threats and enhance overall system security.
 data_source:
 - Sysmon Event ID 11
 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
@@ -59,6 +59,7 @@ tags:
   - Volt Typhoon
   - Chaos Ransomware
   - Trickbot
+  - Amadey
   asset_type: Endpoint
   confidence: 50
   impact: 40

detections/endpoint/icacls_deny_command.yml

@@ -1,23 +1,24 @@
 name: Icacls Deny Command
 id: cf8d753e-a8fe-11eb-8f58-acde48001122
 version: 1
-date: '2021-04-29'
+date: '2023-06-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: This analytic identifies a potential adversary that changes the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent
-  access to their component files.
+description: This analytic identifies instances where an adversary modifies the security permissions of a particular file or directory. 
+  This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. 
+  The purpose of this behavior is to actively evade detection and impede access to their associated files. 
+  By identifying these security permission changes, we can enhance our ability to detect and respond to potential threats, 
+  mitigating the impact of malicious activities on the system.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process
-  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe"
-  OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe"
-  AND Processes.process = "*/deny*" by Processes.parent_process_name Processes.process_name
-  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`'
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
+  AND Processes.process IN ("*/deny*", "*/D*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `icacls_deny_command_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/icacls_grant_command.yml

@@ -1,23 +1,24 @@
 name: ICACLS Grant Command
 id: b1b1e316-accc-11eb-a9b4-acde48001122
 version: 1
-date: '2021-05-04'
+date: '2023-06-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: This analytic identifies potential adversaries that modify the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft and coinminer scripts to evade detections and restrict access to their
-  component files.
+description: This analytic identifies adversaries who manipulate the security permissions of specific files or directories by granting additional access. 
+  This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. 
+  The objective behind this behavior is to actively evade detection mechanisms and tightly control access to their associated files. 
+  By identifying these security permission modifications, we can improve our ability to identify and respond to potential threats, 
+  thereby minimizing the impact of malicious activities on the system.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process
-  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe"
-  OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe"
-  AND Processes.process = "*/grant*" by Processes.parent_process_name Processes.process_name
-  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`'
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
+  AND Processes.process IN ("*/grant*", "*/G*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `icacls_grant_command_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -1,17 +1,25 @@
 name: Registry Keys Used For Persistence
 id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
 version: 9
-date: '2022-09-19'
+date: '2023-06-06'
 author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk
 status: production
 type: TTP
-description: The search looks for modifications to registry keys that can be used
-  to launch an application or service at system startup.
+description: The search looks for modifications or alterations made to registry keys 
+  that have the potential to initiate the launch of an application or service during system startup. 
+  By monitoring and detecting modifications in these registry keys, we can identify suspicious or 
+  unauthorized changes that could be indicative of malicious activity. 
+  This proactive approach helps in safeguarding the system's 
+  integrity and security by promptly identifying and mitigating potential threats that aim to gain persistence or execute malicious actions during the startup process.
 data_source:
+- Sysmon Event ID 12
 - Sysmon Event ID 13
+- Sysmon Event ID 14
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
   OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run
+  OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*"
+  OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*"
   OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
@@ -57,6 +65,7 @@ tags:
   - Qakbot
   - Chaos Ransomware
   - AsyncRAT
+  - Amadey
   - Sneaky Active Directory Persistence Tricks
   asset_type: Endpoint
   confidence: 95

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -5,9 +5,12 @@ date: '2023-04-05'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
-description: The following analytic detects the creation or deletion of a scheduled task using the schtasks.exe command-line tool with the 'create' or 'delete' flags. This behavior has been associated with threat actors like Dragonfly and the SUNBURST attack against SolarWinds. It replaces the previous analytic related to "Scheduled Task used in BadRabbit Ransomware."\
-
-  Identifying the creation or deletion of scheduled tasks via the command line is significant for a SOC as it may indicate malicious activity, such as the establishment of persistence or unauthorized changes to critical systems. A true positive suggests potential compromise or an ongoing attack, highlighting the need for immediate investigation and response to mitigate the impact on the affected systems.
+description: This analytic focuses on identifying the creation or deletion of scheduled tasks using the schtasks.exe utility 
+  with the corresponding command-line flags (-create or -delete). This technique has been notably associated with threat actors 
+  like Dragonfly and the SUNBURST attack against SolarWinds. The purpose of this analytic is to detect suspicious activity 
+  related to scheduled tasks that could indicate malicious intent or unauthorized system manipulation. By monitoring for these 
+  specific command-line flags, we can enhance our ability to identify potential threats and prevent attacks similar to the use of 
+  scheduled tasks in the BadRabbit Ransomware incident.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
@@ -41,6 +44,7 @@ tags:
   - CISA AA22-257A
   - DHS Report TA18-074A
   - Azorult
+  - Amadey
   - Scheduled Tasks
   asset_type: Endpoint
   confidence: 80

detections/endpoint/suspicious_process_file_path.yml

@@ -5,10 +5,12 @@ date: '2023-06-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: The following analytic will detect a suspicious process running in a
-  file path where a process is not commonly seen and is most commonly used by malicious
-  software. This behavior has been used by adversaries where they drop and run an
-  exe in a path that is accessible without admin privileges.
+description: This analytic identifies a suspicious processes running in file paths 
+  that are not typically associated with legitimate software. Adversaries often employ this technique 
+  to drop and execute malicious executables in accessible locations that do not require administrative privileges. 
+  By monitoring for processes running in such unconventional file paths, we can identify potential indicators of 
+  compromise and proactively respond to malicious activity. This analytic plays a crucial role in enhancing system 
+  security by pinpointing suspicious behaviors commonly associated with malware and unauthorized software execution.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
@@ -58,6 +60,7 @@ tags:
   - Volt Typhoon
   - Chaos Ransomware
   - Trickbot
+  - Amadey
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml

@@ -7,10 +7,11 @@ status: production
 type: Anomaly
 data_source:
 - Security Event ID 4663
-description: The following analytic identifies a non-chrome process accessing Chrome extensions file. 
-  This file stores various settings and information related to the browser's extensions on your computer. Threat actor, adversaries and malware author 
-  also abused this file to attempt to extract sensitive information from the chrome browser of the target host.
-  This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable.
+description: This analytic focuses on identifying non-chrome processes that attempt to access the Chrome extensions file. 
+  This file contains crucial settings and information related to the browser's extensions installed on the computer. 
+  Adversaries and malware authors have been known to exploit this file to extract sensitive information from the Chrome browser on targeted hosts. 
+  Detecting such anomalous behavior provides valuable insights for analyzing suspicious processes beyond the commonly observed chrome.exe and explorer.exe executables. 
+  By monitoring for access to the Chrome extensions file by non-chrome processes, we can enhance our ability to detect potential threats and protect sensitive information stored within the browser.
 search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" 
   AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\chrome.exe"))       
   | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
@@ -26,6 +27,7 @@ references:
 tags:
   analytic_story:
   - RedLine Stealer
+  - Amadey
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml

@@ -7,10 +7,12 @@ status: production
 type: Anomaly
 data_source:
 - Security Event ID 4663
-description: The following analytic identifies a non-chrome process accessing Chrome user data "local state" file. 
-  This file stores various settings and information related to the browser's operation on your computer. Threat actor, adversaries and malware author 
-  also abused this file to attempt to extract the encrypted master key to decrypt password saved in chrome browser.
-  This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable.
+description: This analytic is designed to detect non-chrome processes accessing the Chrome user data file called "local state." 
+  This file contains important settings and information related to the browser's operations on the computer. Threat actors, 
+  adversaries, and malware authors have been known to exploit this file in attempts to extract the encrypted master key used for
+  decrypting passwords saved in the Chrome browser. Detecting access to the "local state" file by non-chrome processes serves as 
+  a valuable pivot for analyzing suspicious processes beyond the commonly observed chrome.exe and explorer.exe executables. 
+  By monitoring for this anomaly, we can improve our ability to identify potential threats and safeguard sensitive information stored within the browser.
 search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" 
   NOT (process_name IN ("*\\chrome.exe","*:\\Windows\\explorer.exe"))
   | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
@@ -26,6 +28,7 @@ references:
 tags:
   analytic_story:
   - RedLine Stealer
+  - Amadey
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml

@@ -7,10 +7,12 @@ status: production
 type: Anomaly
 data_source:
 - Security Event ID 4663
-description: The following analytic identifies a non-chrome process accessing Chrome user data "login data" file. 
-  This sqlite db file stores various information related to the browser's operation on your computer. Threat actor, adversaries and malware author 
-  also abused this file to attempt to extract and decrypt password saved in chrome browser.
-  This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable.
+description: This analytic is designed to identify non-chrome processes accessing the Chrome user data file called "login data." 
+  This SQLite database file contains important information related to the browser's operations on the computer. Threat actors, adversaries, 
+  and malware authors have been known to exploit this file in attempts to extract and decrypt passwords saved in the Chrome browser. 
+  Detecting access to the "login data" file by non-chrome processes serves as a valuable pivot for analyzing suspicious processes 
+  beyond the commonly observed chrome.exe and explorer.exe executables. By monitoring for this anomaly, we can enhance our ability 
+  to detect potential threats and protect sensitive information stored within the browser.
 search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
   AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe"))       
   | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest
@@ -26,6 +28,7 @@ references:
 tags:
   analytic_story:
   - RedLine Stealer
+  - Amadey
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml

@@ -0,0 +1,74 @@
+name: Windows Files and Dirs Access Rights Modification Via Icacls
+id: c76b796c-27e1-4520-91c4-4a58695c749e
+version: 1
+date: '2023-06-06'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 1
+description: This analytic aims to identify potential adversaries who manipulate the security permissions of specific files or directories. 
+  This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. 
+  By modifying the security permissions, adversaries seek to evade detection and impede access to their component files. 
+  Such actions indicate a deliberate effort to maintain control over compromised systems and hinder investigation or remediation efforts. 
+  Detecting these security permission changes can serve as a valuable indicator of an ongoing attack and enable timely response to mitigate the impact of the adversary's activities.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name IN( "icacls.exe", "cacls.exe","xcacls.exe")
+  AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",, "*:N*","*/P*", "*/E*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+known_false_positives: Unknown. It is possible some administrative scripts use ICacls.
+  Filter as needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
+tags:
+  analytic_story:
+  - Amadey
+  asset_type: Endpoint
+  atomic_guid:
+  - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9
+  confidence: 70
+  impact: 70
+  message: Process name $process_name$ with access right modification argument executed by $user$ to change
+    security permission of a specific file or directory on host $dest$
+  mitre_attack_id:
+  - T1222.01
+  - T1222
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_guid
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/amadey/access_permission/amadey_sysmon2.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -42,6 +42,7 @@ tags:
   - Industroyer2
   - Sandworm Tools
   - Data Destruction
+  - Amadey
   - Scheduled Tasks
   asset_type: Endpoint
   confidence: 100

stories/amadey.yml

@@ -0,0 +1,19 @@
+name: Amadey
+id: a919a01b-3ea5-4ed4-9cbe-11cd8b64c36c
+version: 1
+date: '2023-06-16'
+author: Teoderick Contreras, Splunk
+description: This analytic story contains searches that aims to detect activities related to Amadey, a type of malware that primarily operates as a banking Trojan. It is designed to steal sensitive information such as login credentials, credit card details, and other financial data from infected systems. The malware typically targets Windows-based computers. 
+narrative: Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. The primary function is to steal information and further distribute malware. It aims to extract a variety of information from infected devices and attempts to evade the detection of security measures by reducing the volume of data exfiltration compared to that seen in other malicious instances.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
+- https://darktrace.com/blog/amadey-info-stealer-exploiting-n-day-vulnerabilities
+tags:
+  analytic_story: Amadey
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection