From c12ad2964c5f5546b5290509cdea9e2affbe12b6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 13 Jun 2023 11:18:27 +0200 Subject: [PATCH 01/16] Amadey --- ..._or_script_creation_in_suspicious_path.yml | 1 + detections/endpoint/icacls_deny_command.yml | 16 ++-- detections/endpoint/icacls_grant_command.yml | 16 ++-- .../registry_keys_used_for_persistence.yml | 7 +- ...eduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/suspicious_process_file_path.yml | 1 + ...assword_stores_chrome_extension_access.yml | 1 + ...ssword_stores_chrome_localstate_access.yml | 1 + ...ssword_stores_chrome_login_data_access.yml | 1 + ..._access_rights_modification_via_icacls.yml | 73 +++++++++++++++++++ ...ws_task_scheduler_event_action_started.yml | 1 + stories/amadey.yml | 21 ++++++ 12 files changed, 123 insertions(+), 17 deletions(-) create mode 100644 detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml create mode 100644 stories/amadey.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index df154d2328..e89c962946 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -58,6 +58,7 @@ tags: - Qakbot - Chaos Ransomware - Volt Typhoon + - Amadey asset_type: Endpoint confidence: 50 impact: 40 diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 2439435092..62b5bd5400 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,7 +1,7 @@ name: Icacls Deny Command id: cf8d753e-a8fe-11eb-8f58-acde48001122 version: 1 -date: '2021-04-29' +date: '2023-06-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -11,13 +11,13 @@ description: This analytic identifies a potential adversary that changes the sec access to their component files. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" - OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" - AND Processes.process = "*/deny*" by Processes.parent_process_name Processes.process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") + AND Processes.process IN ("*/deny*", "*/D*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `icacls_deny_command_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 13c5a55fa4..88e364c918 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -1,7 +1,7 @@ name: ICACLS Grant Command id: b1b1e316-accc-11eb-a9b4-acde48001122 version: 1 -date: '2021-05-04' +date: '2023-06-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -11,13 +11,13 @@ description: This analytic identifies potential adversaries that modify the secu component files. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" - OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" - AND Processes.process = "*/grant*" by Processes.parent_process_name Processes.process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") + AND Processes.process IN ("*/grant*", "*/G*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `icacls_grant_command_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index c8ab4830b0..836e98b56e 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,17 +1,21 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 9 -date: '2022-09-19' +date: '2023-06-06' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. data_source: +- Sysmon Event ID 12 - Sysmon Event ID 13 +- Sysmon Event ID 14 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run + OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*" + OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*" OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* @@ -57,6 +61,7 @@ tags: - Qakbot - Chaos Ransomware - AsyncRAT + - Amadey - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 95 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 52deb76332..74ac0a1531 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -43,6 +43,7 @@ tags: - CISA AA22-257A - DHS Report TA18-074A - Azorult + - Amadey asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 23a65c16e3..33c4809ca6 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -57,6 +57,7 @@ tags: - Qakbot - Chaos Ransomware - Volt Typhoon + - Amadey asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index fc7f609281..f8ec5707f4 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - RedLine Stealer + - Amadey asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 535824e170..37e78896b3 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - RedLine Stealer + - Amadey asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index a0d9fe42ee..1c7a1f18c0 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - RedLine Stealer + - Amadey asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml new file mode 100644 index 0000000000..7b7bf0aea9 --- /dev/null +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -0,0 +1,73 @@ +name: Windows Files and Dirs Access Rights Modification Via Icacls +id: c76b796c-27e1-4520-91c4-4a58695c749e +version: 1 +date: '2023-06-06' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 1 +description: This analytic identifies a potential adversary that changes the security + permission of a specific file or directory. This technique is commonly seen in APT + tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent + access to their component files. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe","xcacls.exe") + AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",, "*:N*","*/P*", "*/E*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: Unknown. It is possible some administrative scripts use ICacls. + Filter as needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey +tags: + analytic_story: + - Amadey + asset_type: Endpoint + atomic_guid: + - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9 + confidence: 70 + impact: 70 + message: Process name $process_name$ with access right modification argument executed by $user$ to change + security permission of a specific file or directory on host $dest$ + mitre_attack_id: + - T1222.01 + - T1222 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_guid + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.process + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/amadey/access_permission/amadey_sysmon2.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index e7ec3f00bd..a8ac30dcea 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -41,6 +41,7 @@ tags: - Industroyer2 - Sandworm Tools - Data Destruction + - Amadey asset_type: Endpoint confidence: 100 impact: 80 diff --git a/stories/amadey.yml b/stories/amadey.yml new file mode 100644 index 0000000000..3d2b05f971 --- /dev/null +++ b/stories/amadey.yml @@ -0,0 +1,21 @@ +name: Amadey +id: a919a01b-3ea5-4ed4-9cbe-11cd8b64c36c +version: 1 +date: '2023-06-16' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Amadey malware including parent-child process anomaly, rundll32 execution, persistence, files/directory access right modification and many more. + Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. + It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. +narrative: Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey +tags: + analytic_story: Amadey + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 76fa90dd680ee2235699a4ac903ecb8bbf890a47 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:22:01 +0200 Subject: [PATCH 02/16] Update executables_or_script_creation_in_suspicious_path.yml --- .../executables_or_script_creation_in_suspicious_path.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index e89c962946..6e9714e6eb 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -5,10 +5,10 @@ date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: This analytic will identify suspicious executable or scripts (known file - extensions) in a list of suspicious file paths in Windows. This technique is used - by adversaries to evade detection. The suspicious file path are known paths used - in the wild and are not common to have executable or scripts. +description: This analytic identifies potentially malicious executables or scripts by examining a list of suspicious file paths on Windows Operating System. + The purpose of this technique is to uncover files with known file extensions that could be used by adversaries to evade detection and persistence. + The suspicious file paths selected for investigation are typically uncommon and uncommonly associated with executable or script files. + By scrutinizing these paths, we can proactively identify potential security threats and enhance overall system security. data_source: - Sysmon Event ID 11 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as From e40ab340d9c1579531b7cafc36ffbcac356b5ca5 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:24:28 +0200 Subject: [PATCH 03/16] Update icacls_deny_command.yml --- detections/endpoint/icacls_deny_command.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 62b5bd5400..f6724acbd8 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -5,10 +5,11 @@ date: '2023-06-06' author: Teoderick Contreras, Splunk status: production type: TTP -description: This analytic identifies a potential adversary that changes the security - permission of a specific file or directory. This technique is commonly seen in APT - tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent - access to their component files. +description: This analytic identifies instances where an adversary modifies the security permissions of a particular file or directory. + This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. + The purpose of this behavior is to actively evade detection and impede access to their associated files. + By identifying these security permission changes, we can enhance our ability to detect and respond to potential threats, + mitigating the impact of malicious activities on the system. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes From 50dbd4be15f1cd6661bf6cc8b799c55bfa8c50de Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:26:43 +0200 Subject: [PATCH 04/16] Update icacls_grant_command.yml --- detections/endpoint/icacls_grant_command.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 88e364c918..c69495075f 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -5,10 +5,11 @@ date: '2023-06-06' author: Teoderick Contreras, Splunk status: production type: TTP -description: This analytic identifies potential adversaries that modify the security - permission of a specific file or directory. This technique is commonly seen in APT - tradecraft and coinminer scripts to evade detections and restrict access to their - component files. +description: This analytic identifies adversaries who manipulate the security permissions of specific files or directories by granting additional access. + This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. + The objective behind this behavior is to actively evade detection mechanisms and tightly control access to their associated files. + By identifying these security permission modifications, we can improve our ability to identify and respond to potential threats, + thereby minimizing the impact of malicious activities on the system. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes From f3ae3584fad5ad395881fc7186dea5c9f57f18c4 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:28:35 +0200 Subject: [PATCH 05/16] Update registry_keys_used_for_persistence.yml --- .../endpoint/registry_keys_used_for_persistence.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 836e98b56e..911a9b51d0 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -5,8 +5,12 @@ date: '2023-06-06' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP -description: The search looks for modifications to registry keys that can be used - to launch an application or service at system startup. +description: The search looks for modifications or alterations made to registry keys + that have the potential to initiate the launch of an application or service during system startup. + By monitoring and detecting modifications in these registry keys, we can identify suspicious or + unauthorized changes that could be indicative of malicious activity. + This proactive approach helps in safeguarding the system's + integrity and security by promptly identifying and mitigating potential threats that aim to gain persistence or execute malicious actions during the startup process. data_source: - Sysmon Event ID 12 - Sysmon Event ID 13 From 5123f93811fa70f7d75135ac0f458597070ffda0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:30:01 +0200 Subject: [PATCH 06/16] Update scheduled_task_deleted_or_created_via_cmd.yml --- .../scheduled_task_deleted_or_created_via_cmd.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 74ac0a1531..d8185d05e8 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -5,10 +5,12 @@ date: '2023-04-05' author: Bhavin Patel, Splunk status: production type: TTP -description: The following analytic identifies the creation or deletion of a scheduled - task using schtasks.exe with flags - create or delete being passed on the command-line. - This has been associated with the Dragonfly threat actor, and the SUNBURST attack - against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware". +description: This analytic focuses on identifying the creation or deletion of scheduled tasks using the schtasks.exe utility + with the corresponding command-line flags (-create or -delete). This technique has been notably associated with threat actors + like Dragonfly and the SUNBURST attack against SolarWinds. The purpose of this analytic is to detect suspicious activity + related to scheduled tasks that could indicate malicious intent or unauthorized system manipulation. By monitoring for these + specific command-line flags, we can enhance our ability to identify potential threats and prevent attacks similar to the use of + scheduled tasks in the BadRabbit Ransomware incident. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.process) From a26b5e40c91b26db7befb99be8d7d6b3e3a1d713 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:40:42 +0200 Subject: [PATCH 07/16] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 33c4809ca6..6c574d4bc8 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -5,10 +5,12 @@ date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic will detect a suspicious process running in a - file path where a process is not commonly seen and is most commonly used by malicious - software. This behavior has been used by adversaries where they drop and run an - exe in a path that is accessible without admin privileges. +description: This analytic will indentifies a suspicious processes running in file paths + that are not typically associated with legitimate software. Adversaries often employ this technique + to drop and execute malicious executables in accessible locations that do not require administrative privileges. + By monitoring for processes running in such unconventional file paths, we can identify potential indicators of + compromise and proactively respond to malicious activity. This analytic plays a crucial role in enhancing system + security by pinpointing suspicious behaviors commonly associated with malware and unauthorized software execution. data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count values(Processes.process_name) From aba4d782851b07461e896511ec3e2fef62db2ffe Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:41:28 +0200 Subject: [PATCH 08/16] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 6c574d4bc8..14d5abcac4 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -5,7 +5,7 @@ date: '2023-04-25' author: Teoderick Contreras, Splunk status: production type: TTP -description: This analytic will indentifies a suspicious processes running in file paths +description: This analytic identifies a suspicious processes running in file paths that are not typically associated with legitimate software. Adversaries often employ this technique to drop and execute malicious executables in accessible locations that do not require administrative privileges. By monitoring for processes running in such unconventional file paths, we can identify potential indicators of From 2d3e14964164591a6133ac137ec03efd0f431ca5 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:52:11 +0200 Subject: [PATCH 09/16] Update windows_credentials_from_password_stores_chrome_extension_access.yml --- ...ials_from_password_stores_chrome_extension_access.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index f8ec5707f4..96fcec7c51 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -7,10 +7,11 @@ status: production type: Anomaly data_source: - Security Event ID 4663 -description: The following analytic identifies a non-chrome process accessing Chrome extensions file. - This file stores various settings and information related to the browser's extensions on your computer. Threat actor, adversaries and malware author - also abused this file to attempt to extract sensitive information from the chrome browser of the target host. - This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +description: This analytic focuses on identifying non-chrome processes that attempt to access the Chrome extensions file. + This file contains crucial settings and information related to the browser's extensions installed on the computer. + Adversaries and malware authors have been known to exploit this file to extract sensitive information from the Chrome browser on targeted hosts. + Detecting such anomalous behavior provides valuable insights for analyzing suspicious processes beyond the commonly observed chrome.exe and explorer.exe executables. + By monitoring for access to the Chrome extensions file by non-chrome processes, we can enhance our ability to detect potential threats and protect sensitive information stored within the browser. search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\chrome.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest From f292c7b09c0d1ba140db7bee0dcf31383bfd5ef1 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:53:17 +0200 Subject: [PATCH 10/16] Update windows_credentials_from_password_stores_chrome_localstate_access.yml --- ...s_from_password_stores_chrome_localstate_access.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 37e78896b3..1934c691fc 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -7,10 +7,12 @@ status: production type: Anomaly data_source: - Security Event ID 4663 -description: The following analytic identifies a non-chrome process accessing Chrome user data "local state" file. - This file stores various settings and information related to the browser's operation on your computer. Threat actor, adversaries and malware author - also abused this file to attempt to extract the encrypted master key to decrypt password saved in chrome browser. - This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +description: This analytic is designed to detect non-chrome processes accessing the Chrome user data file called "local state." + This file contains important settings and information related to the browser's operations on the computer. Threat actors, + adversaries, and malware authors have been known to exploit this file in attempts to extract the encrypted master key used for + decrypting passwords saved in the Chrome browser. Detecting access to the "local state" file by non-chrome processes serves as + a valuable pivot for analyzing suspicious processes beyond the commonly observed chrome.exe and explorer.exe executables. + By monitoring for this anomaly, we can improve our ability to identify potential threats and safeguard sensitive information stored within the browser. search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" NOT (process_name IN ("*\\chrome.exe","*:\\Windows\\explorer.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest From f75acdb416274c2b53d5e5f08b0004a3b171e050 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:54:35 +0200 Subject: [PATCH 11/16] Update windows_credentials_from_password_stores_chrome_login_data_access.yml --- ...s_from_password_stores_chrome_login_data_access.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 1c7a1f18c0..1e40b0019c 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -7,10 +7,12 @@ status: production type: Anomaly data_source: - Security Event ID 4663 -description: The following analytic identifies a non-chrome process accessing Chrome user data "login data" file. - This sqlite db file stores various information related to the browser's operation on your computer. Threat actor, adversaries and malware author - also abused this file to attempt to extract and decrypt password saved in chrome browser. - This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +description: This analytic is designed to identify non-chrome processes accessing the Chrome user data file called "login data." + This SQLite database file contains important information related to the browser's operations on the computer. Threat actors, adversaries, + and malware authors have been known to exploit this file in attempts to extract and decrypt passwords saved in the Chrome browser. + Detecting access to the "login data" file by non-chrome processes serves as a valuable pivot for analyzing suspicious processes + beyond the commonly observed chrome.exe and explorer.exe executables. By monitoring for this anomaly, we can enhance our ability + to detect potential threats and protect sensitive information stored within the browser. search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest From f38daa79195cf8c5fcdab918f20b827257798e39 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:55:45 +0200 Subject: [PATCH 12/16] Update windows_files_and_dirs_access_rights_modification_via_icacls.yml --- ...es_and_dirs_access_rights_modification_via_icacls.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index 7b7bf0aea9..29bdf91d5c 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -7,10 +7,11 @@ status: production type: TTP data_source: - Sysmon Event ID 1 -description: This analytic identifies a potential adversary that changes the security - permission of a specific file or directory. This technique is commonly seen in APT - tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent - access to their component files. +description: This analytic aims to identify potential adversaries who manipulate the security permissions of specific files or directories. +This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. +By modifying the security permissions, adversaries seek to evade detection and impede access to their component files. +Such actions indicate a deliberate effort to maintain control over compromised systems and hinder investigation or remediation efforts. +Detecting these security permission changes can serve as a valuable indicator of an ongoing attack and enable timely response to mitigate the impact of the adversary's activities. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", "cacls.exe","xcacls.exe") AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",, "*:N*","*/P*", "*/E*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user From 9e44ed00b30237e85dd29020a656bc6ddf0a0fac Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 22 Jun 2023 14:55:59 +0200 Subject: [PATCH 13/16] Update windows_files_and_dirs_access_rights_modification_via_icacls.yml --- ...les_and_dirs_access_rights_modification_via_icacls.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index 29bdf91d5c..bd891ca4e8 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -8,10 +8,10 @@ type: TTP data_source: - Sysmon Event ID 1 description: This analytic aims to identify potential adversaries who manipulate the security permissions of specific files or directories. -This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. -By modifying the security permissions, adversaries seek to evade detection and impede access to their component files. -Such actions indicate a deliberate effort to maintain control over compromised systems and hinder investigation or remediation efforts. -Detecting these security permission changes can serve as a valuable indicator of an ongoing attack and enable timely response to mitigate the impact of the adversary's activities. + This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. + By modifying the security permissions, adversaries seek to evade detection and impede access to their component files. + Such actions indicate a deliberate effort to maintain control over compromised systems and hinder investigation or remediation efforts. + Detecting these security permission changes can serve as a valuable indicator of an ongoing attack and enable timely response to mitigate the impact of the adversary's activities. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", "cacls.exe","xcacls.exe") AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",, "*:N*","*/P*", "*/E*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user From 23e36e939d38eeac089c281718c8b0fd7bd8c183 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Jun 2023 16:44:55 -0700 Subject: [PATCH 14/16] Update amadey.yml --- stories/amadey.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/stories/amadey.yml b/stories/amadey.yml index 3d2b05f971..a9462fb8ed 100644 --- a/stories/amadey.yml +++ b/stories/amadey.yml @@ -3,11 +3,9 @@ id: a919a01b-3ea5-4ed4-9cbe-11cd8b64c36c version: 1 date: '2023-06-16' author: Teoderick Contreras, Splunk -description: Leverage searches that allow you to detect and investigate unusual activities - that might relate to the Amadey malware including parent-child process anomaly, rundll32 execution, persistence, files/directory access right modification and many more. - Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. - It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. -narrative: Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. +description: Amadey is a type of malware that primarily operates as a banking Trojan. It is designed to steal sensitive information such as login credentials, credit card details, and other financial data from infected systems. The malware typically targets Windows-based computers. +narrative: Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. +Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey tags: @@ -18,4 +16,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection From 6778f0e8a3423dccac6a010663e80d85238f8123 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Jun 2023 16:54:50 -0700 Subject: [PATCH 15/16] encode fix --- stories/amadey.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/amadey.yml b/stories/amadey.yml index a9462fb8ed..f4d6b1feb0 100644 --- a/stories/amadey.yml +++ b/stories/amadey.yml @@ -3,11 +3,11 @@ id: a919a01b-3ea5-4ed4-9cbe-11cd8b64c36c version: 1 date: '2023-06-16' author: Teoderick Contreras, Splunk -description: Amadey is a type of malware that primarily operates as a banking Trojan. It is designed to steal sensitive information such as login credentials, credit card details, and other financial data from infected systems. The malware typically targets Windows-based computers. -narrative: Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. -Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. +description: This analytic story contains searches that aims to detect activities related to Amadey, a type of malware that primarily operates as a banking Trojan. It is designed to steal sensitive information such as login credentials, credit card details, and other financial data from infected systems. The malware typically targets Windows-based computers. +narrative: Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. The primary function is to steal information and further distribute malware. It aims to extract a variety of information from infected devices and attempts to evade the detection of security measures by reducing the volume of data exfiltration compared to that seen in other malicious instances. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey +- https://darktrace.com/blog/amadey-info-stealer-exploiting-n-day-vulnerabilities tags: analytic_story: Amadey category: From 3b06386b05c70af9cd9dca7056dcd7939ce9dfa3 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 23 Jun 2023 16:23:42 +0200 Subject: [PATCH 16/16] bug fix --- .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 6304652578..8505c38fb5 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -44,11 +44,8 @@ tags: - CISA AA22-257A - DHS Report TA18-074A - Azorult -<<<<<<< HEAD - Amadey -======= - Scheduled Tasks ->>>>>>> develop asset_type: Endpoint confidence: 80 impact: 70