diff --git a/detections/endpoint/detect_kportscan3_install.yml b/detections/endpoint/detect_kportscan3_install.yml index 76dcbcb147..0ca517b011 100644 --- a/detections/endpoint/detect_kportscan3_install.yml +++ b/detections/endpoint/detect_kportscan3_install.yml @@ -12,7 +12,7 @@ search: `sysmon` EventCode=3 | stats values(Image) as Image values(ProcessId) as how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe may be used. + Sysmon TA. known_false_positives: This tool may be used for legit purposes. references: - https://blog.trendmicro.com/trendlabs-security-intelligence/a-peek-inside-a-pos-scammers-toolbox/ diff --git a/detections/endpoint/detect_masscan_gui_install.yml b/detections/endpoint/detect_masscan_gui_install.yml new file mode 100644 index 0000000000..9f22a5f159 --- /dev/null +++ b/detections/endpoint/detect_masscan_gui_install.yml @@ -0,0 +1,37 @@ +name: Detect Masscan Gui Install +id: 952f15cf-8b46-4a5b-a0eb-5b0210735918 +version: 1 +date: '2021-05-08' +author: Rod Soto, Splunk +type: batch +datamodel: +- Endpoint +description: This query detects the install and use of Masscan_gui, an internet port scanning tool found in botnets for further expansion and and acquisition of targets. +search: `sysmon` EventCode=3 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search Image=*Masscan* | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +`| `detect_masscan_gui_install_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Masscan gui could potentially be used for legit purposes. +references: +- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1570 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.computer + - Processes.user + - Processes.Image + - Processes.process_id + - Processes.process_exec + security_domain: endpoint diff --git a/detections/endpoint/detect_nl_brute12_install.yml b/detections/endpoint/detect_nl_brute12_install.yml new file mode 100644 index 0000000000..b4a18dd066 --- /dev/null +++ b/detections/endpoint/detect_nl_brute12_install.yml @@ -0,0 +1,36 @@ +name: Detect NL Brute12 Install +id: 93eaedf2-b7e6-41cf-99f3-baed6cf8162a +version: 1 +date: '2021-05-08' +author: Rod Soto, Splunk +type: batch +datamodel: +- Endpoint +description: This query detects the install of NL Brute 1.2, a RDP brute force tool found in botnets for further expansion and and acquisition of targets. +search: `sysmon` EventCode=1 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search Image=*NLBrute* | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`detect_nl_brute12_install_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Unknown +references: +- https://www.reddit.com/r/sysadmin/comments/59fhrk/compromised_server_what_is_this_tool/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1570 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.computer + - Processes.user + - Processes.Image + - Processes.process_id + - Processes.process_exec + security_domain: endpoint diff --git a/detections/endpoint/detect_nlachecker_install.yml b/detections/endpoint/detect_nlachecker_install.yml new file mode 100644 index 0000000000..7df328951e --- /dev/null +++ b/detections/endpoint/detect_nlachecker_install.yml @@ -0,0 +1,37 @@ +name: Detect NLAchecker Install +id: 983d892e-33c6-463f-bd46-ad5ef826d624 +version: 1 +date: '2021-05-08' +author: Rod Soto, Splunk +type: batch +datamodel: +- Endpoint +description: This query detects the install of NLAchecker.exe, a scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers +to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits. +search: `sysmon` EventCode=3 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search Image=*NLA* | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_nlachecker_install_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Unknown +references: +- https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3 +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1570 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.computer + - Processes.user + - Processes.Image + - Processes.process_id + - Processes.process_exec + security_domain: endpoint diff --git a/detections/endpoint/detect_nsexe_ip_scanner_install.yml b/detections/endpoint/detect_nsexe_ip_scanner_install.yml new file mode 100644 index 0000000000..adb9a8e88e --- /dev/null +++ b/detections/endpoint/detect_nsexe_ip_scanner_install.yml @@ -0,0 +1,36 @@ +name: Detect NSEXE Ip Scanner Install +id: 70a7c839-7b67-40d5-85b4-59a5ea2c4eb4 +version: 1 +date: '2021-05-08' +author: Rod Soto, Splunk +type: batch +datamodel: +- Endpoint +description: This query detects the install of NS.EXE, an ip scanner tool found in botnets for further expansion and and acquisition of targets. +search: `sysmon` EventCode=1 | stats values(Image) as Image values(ProcessId) as ProcessId by Computer, User, process_exec | search process_exec=NS.exe | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_nsexe_ip_scanner_install_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Unknown +references: +- https://thedfirreport.com/2020/06/16/the-little-ransomware-that-couldnt-dharma/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1570 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.computer + - Processes.user + - Processes.Image + - Processes.process_id + - Processes.process_exec + security_domain: endpoint