xmrigmasscannlbrutenlacheckernsexe

detections/endpoint/detect_kportscan3_install.yml

@@ -12,7 +12,7 @@ search: `sysmon` EventCode=3 | stats values(Image) as Image values(ProcessId) as
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+  Sysmon TA. 
 known_false_positives: This tool may be used for legit purposes.
 references:
 - https://blog.trendmicro.com/trendlabs-security-intelligence/a-peek-inside-a-pos-scammers-toolbox/

detections/endpoint/detect_masscan_gui_install.yml

@@ -0,0 +1,37 @@
+name: Detect Masscan Gui Install
+id: 952f15cf-8b46-4a5b-a0eb-5b0210735918
+version: 1
+date: '2021-05-08'
+author: Rod Soto, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This query detects the install and use of Masscan_gui, an internet port scanning tool found in botnets for further expansion and and acquisition of targets.
+search: `sysmon` EventCode=3 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search Image=*Masscan* | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+`| `detect_masscan_gui_install_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Masscan gui could potentially be used for legit purposes.
+references:
+- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/
+tags:
+  analytic_story:
+  - xmrig
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1570
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.computer
+  - Processes.user
+  - Processes.Image
+  - Processes.process_id
+  - Processes.process_exec
+  security_domain: endpoint

detections/endpoint/detect_nl_brute12_install.yml

@@ -0,0 +1,36 @@
+name: Detect NL Brute12 Install
+id: 93eaedf2-b7e6-41cf-99f3-baed6cf8162a
+version: 1
+date: '2021-05-08'
+author: Rod Soto, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This query detects the install of NL Brute 1.2, a RDP brute force tool found in botnets for further expansion and and acquisition of targets.
+search: `sysmon` EventCode=1 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search Image=*NLBrute* | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`detect_nl_brute12_install_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Unknown
+references:
+- https://www.reddit.com/r/sysadmin/comments/59fhrk/compromised_server_what_is_this_tool/
+tags:
+  analytic_story:
+  - xmrig
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1570
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.computer
+  - Processes.user
+  - Processes.Image
+  - Processes.process_id
+  - Processes.process_exec
+  security_domain: endpoint

detections/endpoint/detect_nlachecker_install.yml

@@ -0,0 +1,37 @@
+name: Detect NLAchecker Install
+id: 983d892e-33c6-463f-bd46-ad5ef826d624
+version: 1
+date: '2021-05-08'
+author: Rod Soto, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This query detects the install of NLAchecker.exe, a scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers
+to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits. 
+search: `sysmon` EventCode=3 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search Image=*NLA* | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_nlachecker_install_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Unknown
+references:
+- https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3
+tags:
+  analytic_story:
+  - xmrig
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1570
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.computer
+  - Processes.user
+  - Processes.Image
+  - Processes.process_id
+  - Processes.process_exec
+  security_domain: endpoint

detections/endpoint/detect_nsexe_ip_scanner_install.yml

@@ -0,0 +1,36 @@
+name: Detect NSEXE Ip Scanner Install
+id: 70a7c839-7b67-40d5-85b4-59a5ea2c4eb4
+version: 1
+date: '2021-05-08'
+author: Rod Soto, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This query detects the install of NS.EXE, an ip scanner tool found in botnets for further expansion and and acquisition of targets.
+search: `sysmon` EventCode=1 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search process_exec=NS.exe | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_nsexe_ip_scanner_install_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Unknown
+references:
+- https://thedfirreport.com/2020/06/16/the-little-ransomware-that-couldnt-dharma/
+tags:
+  analytic_story:
+  - xmrig
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1570
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.computer
+  - Processes.user
+  - Processes.Image
+  - Processes.process_id
+  - Processes.process_exec
+  security_domain: endpoint