Branch was auto-updated.

detections/endpoint/windows_curl_download_to_suspicious_path.yml

@@ -0,0 +1,88 @@
+name: Windows Curl Download to Suspicious Path
+id: c32f091e-30db-11ec-8738-acde48001122
+version: 1
+date: '2021-10-19'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the use of Windows Curl.exe downloading
+  a file to a suspicious location. \
+
+  -O or --output is used when a file is to be downloaded and placed in a specified
+  location. \
+
+  During triage, review parallel processes for further behavior. In addition, identify
+  if the download was successful. If a file was downloaded, capture and analyze.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
+  IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_curl_download_to_suspicious_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible Administrators or super users will use Curl
+  for legitimate purposes. Filter as needed.
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://attack.mitre.org/techniques/T1105/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
+tags:
+  analytic_story:
+  - IceID
+  - Ingress Tool Transfer
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1105
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_curl_upload_to_remote_destination.yml

@@ -0,0 +1,96 @@
+name: Windows Curl Upload to Remote Destination
+id: 42f8f1a2-4228-11ec-aade-acde48001122
+version: 1
+date: '2021-11-10'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the use of Windows Curl.exe uploading
+  a file to a remote destination. \
+
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
+  \
+
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
+  web application, and it is, for example, how most common HTML forms on the web work.
+  \
+
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible
+  with the Windows version of Curl. Will update if identified adversary tradecraft.
+  \
+
+  Adversaries may use one of the three methods based on the remote destination and
+  what they are attempting to upload (zip vs txt). During triage, review parallel
+  processes for further behavior. In addition, identify if the upload was successful
+  in network logs. If a file was uploaded, isolate the endpoint and review.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
+  IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
+references:
+- https://everything.curl.dev/usingcurl/uploads
+- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+- https://twitter.com/d1r4c/status/1279042657508081664?s=20
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1105
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ uploading a file to a remote destination.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -0,0 +1,64 @@
+name: WinEvent Windows Task Scheduler Event Action Started
+id: b3632472-310b-11ec-9aab-acde48001122
+version: 1
+date: '2021-10-19'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic assists with identifying suspicious tasks
+  that have been registered and ran in Windows using EventID 200 (action run) and
+  201 (action completed). It is recommended to filter based on ActionName by specifying
+  specific paths not used in your environment. After some basic tuning, this may be
+  effective in capturing evasive ways to register tasks on Windows. Review parallel
+  events related to tasks being scheduled. EventID 106 will generate when a new task
+  is generated, however, that does not mean it ran. Capture any files on disk and
+  analyze.
+search: '`wineventlog_task_scheduler` EventCode IN ("200","201") | rename ComputerName
+  as dest | stats count min(_time) as firstTime max(_time) as lastTime by Message
+  dest EventCode category | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `winevent_windows_task_scheduler_event_action_started_filter`'
+how_to_implement: Task Scheduler logs are required to be collected. Enable logging
+  with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
+  and renderXml=false. Note, not translating it in XML may require a proper extraction
+  of specific items in the Message.
+known_false_positives: False positives will be present. Filter based on ActionName
+  paths or specify keywords of interest.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+tags:
+  analytic_story:
+  - IcedID
+  - Windows Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - TaskName
+  - ActionName
+  - EventID
+  - dest
+  - ProcessID
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: A Scheduled Task was scheduled and ran on $dest$.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

macros/process_curl.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_curl

macros/wineventlog_task_scheduler.yml

@@ -0,0 +1,4 @@
+definition: source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: wineventlog_task_scheduler

tests/endpoint/windows_curl_download_to_suspicious_path.test.yml

@@ -0,0 +1,12 @@
+name: Windows Curl Download to Suspicious Path Unit Test
+tests:
+- name: Windows Curl Download to Suspicious Path
+  file: endpoint/windows_curl_download_to_suspicious_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_curl.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_curl_upload_to_remote_destination.test.yml

@@ -0,0 +1,12 @@
+name: Windows Curl Upload to Remote Destination Unit Test
+tests:
+- name: Windows Curl Upload to Remote Destination
+  file: endpoint/windows_curl_upload_to_remote_destination.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_curl_upload.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml

@@ -0,0 +1,12 @@
+name: WinEvent Windows Task Scheduler Event Action Started Unit Test
+tests:
+- name: WinEvent Windows Task Scheduler Event Action Started
+  file: endpoint/winevent_windows_task_scheduler_event_action_started.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-45d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-taskschedule.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/windows_taskschedule/windows-taskschedule.log
+    source: WinEventLog:Microsoft-Windows-TaskScheduler/Operational
+    sourcetype: wineventlog