From 506732a62ba71aa48df2e67bedc10ac14e4de6e9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 1 Sep 2022 13:16:24 +0200 Subject: [PATCH 01/20] brute-ratel-3 --- ...lation_winlogon_duplicate_token_handle.yml | 73 +++++++++++++++++++ ...ogon_duplicate_handle_in_uncommon_path.yml | 73 +++++++++++++++++++ ...n_winlogon_duplicate_token_handle.test.yml | 13 ++++ ...duplicate_handle_in_uncommon_path.test.yml | 13 ++++ 4 files changed, 172 insertions(+) create mode 100644 detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml create mode 100644 detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml create mode 100644 tests/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml create mode 100644 tests/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml new file mode 100644 index 0000000000..d275c9aba9 --- /dev/null +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -0,0 +1,73 @@ +name: Windows Access Token Manipulation Winlogon Duplicate Token Handle +id: dda126d7-1d99-4f0b-b72a-4c14031f9398 +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a process access in winlogon.exe to duplicate its handle. + This technique was seen in several adversaries, threat actors and even red teams to gain privileges to their process. + This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and used it to a new process instance. + Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens. +search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 + | stats count min(_time) as firstTime max(_time) as lastTime + by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace Computer user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: third party software application may do this technique. +references: + - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle + - https://attack.mitre.org/techniques/T1134/001/ +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log + impact: 60 + kill_chain_phases: + - Exploitation + message: a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$ + mitre_attack_id: + - T1134.001 + - T1134 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - SourceProcessGUID + - TargetProcessGUID + - SourceProcessId + - TargetProcessId + - GrantedAccess + - CallTrace + - Computer + - user_id + risk_score: 36 + security_domain: endpoint diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml new file mode 100644 index 0000000000..30b96f5a91 --- /dev/null +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -0,0 +1,73 @@ +name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path +id: b8f7ed6b-0556-4c84-bffd-839c262b0278 +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a process access in winlogon.exe to duplicate its handle with a non-common or public process source path. + This technique was seen in several adversaries, threat actors and even red teams to gain privileges to their process. + This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. + Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens. +search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 + AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: 3rd party software application may do this technique. +references: + - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle + - https://attack.mitre.org/techniques/T1134/001/ +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$ + mitre_attack_id: + - T1134.001 + - T1134 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - SourceProcessGUID + - TargetProcessGUID + - SourceProcessId + - TargetProcessId + - GrantedAccess + - CallTrace + - Computer + - user_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml b/tests/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml new file mode 100644 index 0000000000..d9a4893617 --- /dev/null +++ b/tests/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml @@ -0,0 +1,13 @@ +name: Windows Access Token Manipulation Winlogon Duplicate Token Handle Unit Test +tests: +- name: Windows Access Token Manipulation Winlogon Duplicate Token Handle + file: endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml b/tests/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml new file mode 100644 index 0000000000..ce8a6ecca5 --- /dev/null +++ b/tests/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml @@ -0,0 +1,13 @@ +name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path Unit Test +tests: +- name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path + file: endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 954a9e9dd32434ccd2380ebe7c2463def0b6f13f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:19:19 +0200 Subject: [PATCH 02/20] Delete windows_gather_victim_identity_sam_info.yml --- ...indows_gather_victim_identity_sam_info.yml | 66 ------------------- 1 file changed, 66 deletions(-) delete mode 100644 detections/endpoint/windows_gather_victim_identity_sam_info.yml diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml deleted file mode 100644 index 60243af3a9..0000000000 --- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Windows Gather Victim Identity SAM Info -id: a18e85d7-8b98-4399-820c-d46a1ca3516f -version: 1 -date: '2022-08-24' -author: Teoderick Contreras, Splunk -type: Hunting -datamodel: -- Endpoint -description: The following analytic identifies a process that loads the samlib.dll module. - This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. - This hunting query can be a good indicator that a process is capable of accessing the SAM object. -search: '`sysmon` EventCode=7 ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll" AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_gather_victim_identity_sam_info_filter`' -how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will - add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. -known_false_positives: this module can be loaded by a third party application. Filter is needed. -references: -- https://redcanary.com/blog/active-breach-evading-defenses/ -- https://strontic.github.io/xcyclopedia/library/samlib.dll-0BDF6351009F6EBA5BA7E886F23263B1.html -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 30 - context: - - Source:Endpoint - - Stage:Persistence - - Stage:Privilege Escalation - - Stage:Defense Evasion - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log - impact: 30 - kill_chain_phases: - - Exploitation - message: An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information. - mitre_attack_id: - - T1589.001 - - T1589 - nist: - - DE.CM - observable: - - name: Computer - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Image - - ImageLoaded - - Computer - - EventCode - - Signed - - ProcessId - risk_score: 6 - security_domain: endpoint From ce4f5e5ad3f4587de903337f07629cf4d7e30107 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:19:35 +0200 Subject: [PATCH 03/20] Delete windows_remote_access_software_brc4_loaded_dll.test.yml --- ..._remote_access_software_brc4_loaded_dll.test.yml | 13 ------------- 1 file changed, 13 deletions(-) delete mode 100644 tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml diff --git a/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml b/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml deleted file mode 100644 index 048de62597..0000000000 --- a/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Remote Access Software BRC4 Loaded Dll Unit Test -tests: -- name: Windows Remote Access Software BRC4 Loaded Dll - file: endpoint/windows_remote_access_software_brc4_loaded_dll.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true From 22721a455428f1d6f7ef7587a4bec8a59a3dcec6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:19:45 +0200 Subject: [PATCH 04/20] Delete windows_phishing_recent_iso_exec_registry.test.yml --- ...ndows_phishing_recent_iso_exec_registry.test.yml | 13 ------------- 1 file changed, 13 deletions(-) delete mode 100644 tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml diff --git a/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml b/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml deleted file mode 100644 index bd6c8924f9..0000000000 --- a/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Phishing Recent ISO Exec Registry Unit Test -tests: -- name: Windows Phishing Recent ISO Exec Registry - file: endpoint/windows_phishing_recent_iso_exec_registry.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true From 183f1f689ec144b6ea8240917e43f0ccf112519a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:19:55 +0200 Subject: [PATCH 05/20] Delete windows_input_capture_using_credential_ui_dll.test.yml --- ...s_input_capture_using_credential_ui_dll.test.yml | 13 ------------- 1 file changed, 13 deletions(-) delete mode 100644 tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml diff --git a/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml b/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml deleted file mode 100644 index be9b725986..0000000000 --- a/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Input Capture Using Credential UI Dll Unit Test -tests: -- name: Windows Input Capture Using Credential UI Dll - file: endpoint/windows_input_capture_using_credential_ui_dll.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true From 42cf9d4d02419e933db53c1fcad4203cc258630e Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:20:04 +0200 Subject: [PATCH 06/20] Delete windows_hijack_execution_flow_version_dll_side_load.test.yml --- ...ck_execution_flow_version_dll_side_load.test.yml | 13 ------------- 1 file changed, 13 deletions(-) delete mode 100644 tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml diff --git a/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml b/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml deleted file mode 100644 index 32e1ebee01..0000000000 --- a/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Hijack Execution Flow Version Dll Side Load Unit Test -tests: -- name: Windows Hijack Execution Flow Version Dll Side Load - file: endpoint/windows_hijack_execution_flow_version_dll_side_load.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true From a04fd01b3431ecd3839dd9221fad2bd56618030b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:20:14 +0200 Subject: [PATCH 07/20] Delete windows_gather_victim_identity_sam_info.test.yml --- ...windows_gather_victim_identity_sam_info.test.yml | 13 ------------- 1 file changed, 13 deletions(-) delete mode 100644 tests/endpoint/windows_gather_victim_identity_sam_info.test.yml diff --git a/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml b/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml deleted file mode 100644 index d5d0ca38df..0000000000 --- a/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Windows Gather Victim Identity SAM Info Unit Test -tests: -- name: Windows Gather Victim Identity SAM Info - file: endpoint/windows_gather_victim_identity_sam_info.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog - update_timestamp: true From 5bcc2edeeb18e37fe028c018ae3b28ced60fe327 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:20:25 +0200 Subject: [PATCH 08/20] Delete windows_remote_access_software_brc4_loaded_dll.yml --- ...remote_access_software_brc4_loaded_dll.yml | 79 ------------------- 1 file changed, 79 deletions(-) delete mode 100644 detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml deleted file mode 100644 index 6801bc82b1..0000000000 --- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Windows Remote Access Software BRC4 Loaded Dll -id: 73cf5dcb-cf36-4167-8bbe-384fe5384d05 -version: 1 -date: '2022-08-24' -author: Teoderick Contreras, Splunk -type: Anomaly -datamodel: -- Endpoint -description: The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. - Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded - into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll - is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. - For example, credential managers are notified when a user logs on or an account password changes. - Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) - database either through in-memory techniques or through the Windows Registry where the SAM database is stored. - Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. - All of these modules are important to monitor and track and combined may lead to credentail access or dumping. -search: '`sysmon` EventCode=7 - |bin _time span=30s - | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0) - | eval BRC4_LoadedDllPath=case(match(ImageLoaded, "credui.dll"), 1, match(ImageLoaded, "dbghelp.dll"), 1, match(ImageLoaded, "samcli.dll"), 1, match(ImageLoaded, "winhttp.dll"), 1, 1=1, 0) - | stats count min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as ImageLoaded values(OriginalFileName) as OriginalFileName dc(ImageLoaded) as ImageLoadedCount by Image BRC4_LoadedDllPath BRC4_AnomalyLoadedDll Computer EventCode Signed - | where ImageLoadedCount == 4 AND (BRC4_LoadedDllPath == 1 OR BRC4_AnomalyLoadedDll == 1) - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_access_software_brc4_loaded_dll_filter`' -how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will - add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. -known_false_positives: This module can be loaded by a third party application. Filter is needed. -references: -- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ -- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ -- https://strontic.github.io/xcyclopedia/library/logoncli.dll-138871DBE68D0696D3D7FA91BC2873B1.html -- https://strontic.github.io/xcyclopedia/library/credui.dll-A5BD797BBC2DD55231B9DE99837E5461.html -- https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-manager -- https://strontic.github.io/xcyclopedia/library/samcli.dll-522D6D616EF142CDE965BD3A450A9E4C.html -- https://strontic.github.io/xcyclopedia/library/dbghelp.dll-15A55EAB307EF8C190FE6135C0A86F7C.html -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 30 - context: - - Source:Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - impact: 30 - kill_chain_phases: - - Exploitation - message: a process $Image$ loaded several modules $ImageLoaded$ that might related to credential access on $Computer$. - mitre_attack_id: - - T1219 - - T1003 - nist: - - DE.CM - observable: - - name: Computer - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Image - - ImageLoaded - - process_name - - Computer - - EventCode - - Signed - - ProcessId - risk_score: 9 - security_domain: endpoint From c1b7d97eb32a140f72d1559052bd073df8165039 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:20:39 +0200 Subject: [PATCH 09/20] Delete windows_hijack_execution_flow_version_dll_side_load.yml --- ...k_execution_flow_version_dll_side_load.yml | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml deleted file mode 100644 index e03c69afb4..0000000000 --- a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Windows Hijack Execution Flow Version Dll Side Load -id: 8351340b-ac0e-41ec-8b07-dd01bf32d6ea -version: 1 -date: '2022-08-24' -author: Teoderick Contreras, Splunk -type: Anomaly -datamodel: -- Endpoint -description: This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. - This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application - that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of - Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host. -search: '`sysmon` EventCode=7 - ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*", "*\\windows\\syswow64\\*"))) - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_hijack_execution_flow_version_dll_side_load_filter`' -how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will - add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. -known_false_positives: unknown -references: -- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 70 - context: - - Source:Endpoint - - Stage:Persistence - - Stage:Privilege Escalation - - Stage:Defense Evasion - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - impact: 50 - kill_chain_phases: - - Exploitation - message: a process $Image$ loading $ImageLoaded$ as a side load dll in $Computer$ - mitre_attack_id: - - T1574.001 - - T1574 - nist: - - DE.CM - observable: - - name: Computer - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Image - - ImageLoaded - - process_name - - Computer - - EventCode - - Signed - - ProcessId - risk_score: 35 - security_domain: endpoint From d06f714dbb369a0de3db0d0bdc3132ba9df56583 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:20:48 +0200 Subject: [PATCH 10/20] Delete windows_input_capture_using_credential_ui_dll.yml --- ..._input_capture_using_credential_ui_dll.yml | 70 ------------------- 1 file changed, 70 deletions(-) delete mode 100644 detections/endpoint/windows_input_capture_using_credential_ui_dll.yml diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml deleted file mode 100644 index 1bcb2085d2..0000000000 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Windows Input Capture Using Credential UI Dll -id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e -version: 1 -date: '2022-08-24' -author: Teoderick Contreras, Splunk -type: Hunting -datamodel: -- Endpoint -description: The following analytic identifies a process that loads the credui.dll module. - This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt - dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. - This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. - This hunting query may hit false positive for a third party application that uses a credential login UI for user login. -search: '`sysmon` EventCode=7 (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") - AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*")) - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Computer EventCode Signed ProcessId ProcessGuid - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_input_capture_using_credential_ui_dll_filter`' -how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will - add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. -known_false_positives: this module can be loaded by a third party application. Filter is needed. -references: -- https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa -- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 30 - context: - - Source:Endpoint - - Stage:Persistence - - Stage:Privilege Escalation - - Stage:Defense Evasion - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - impact: 30 - kill_chain_phases: - - Exploitation - message: a process $Image$ loaded $ImageLoaded$ in $Computer$ - mitre_attack_id: - - T1056.002 - - T1056 - nist: - - DE.CM - observable: - - name: Computer - type: Endpoint - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Image - - ImageLoaded - - process_name - - Computer - - EventCode - - Signed - - ProcessId - risk_score: 6 - security_domain: endpoint From bfee7c9b0a8cab771e3189c6fddbbfb5335dfe01 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 13:20:57 +0200 Subject: [PATCH 11/20] Delete windows_phishing_recent_iso_exec_registry.yml --- ...dows_phishing_recent_iso_exec_registry.yml | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 detections/endpoint/windows_phishing_recent_iso_exec_registry.yml diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml deleted file mode 100644 index b7644289c0..0000000000 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Windows Phishing Recent ISO Exec Registry -id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c -version: 1 -date: '2022-08-24' -author: Teoderick Contreras, Splunk -type: Hunting -datamodel: -- Endpoint -description: The following hunting analytic identifies registry artifacts when a ISO container is openedm clicked or mounted on the Windows operating system. - As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. - Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_phishing_recent_iso_exec_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process - that include the name of the process responsible for the changes from your endpoints into the `Endpoint` - datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed - and the latest TA for the endpoint product. -known_false_positives: False positives may be high depending on the environment and consistent use of ISOs. - Restrict to servers, or filter out based on commonly used ISO names. Filter as needed. -references: -- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ -tags: - analytic_story: - - Brute Ratel C4 - asset_type: Endpoint - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 80 - context: - - Source:Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log - impact: 50 - kill_chain_phases: - - Delivery - message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. - mitre_attack_id: - - T1566.001 - - T1566 - nist: - - DE.CM - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Registry.registry_key_name - - Registry.user - - Registry.registry_path - - Registry.registry_value_data - - Registry.action - - Registry.dest - risk_score: 40 - security_domain: endpoint From c1491e38d161a0d5993b0e2ee391eb02a574ad2b Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 1 Sep 2022 15:18:30 +0200 Subject: [PATCH 12/20] brute-ratel-3 --- .../windows_service_deletion_in_registry.yml | 74 +++++++++++++++++++ ...dows_service_deletion_in_registry.test.yml | 14 ++++ 2 files changed, 88 insertions(+) create mode 100644 detections/endpoint/windows_service_deletion_in_registry.yml create mode 100644 tests/endpoint/windows_service_deletion_in_registry.test.yml diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml new file mode 100644 index 0000000000..e2e3904e08 --- /dev/null +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -0,0 +1,74 @@ +name: Windows Service Deletion In Registry +id: daed6823-b51c-4843-a6ad-169708f1323e +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a registry modification due to deleted services. + Red Teams, malicious actors and adversaries may delete a security service as part of its defense evasion. + The BRC4 red teaming tool is capable of deleting a services using native windows API that leave lesser noise + and footprint in terms of process command-line detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" Registry.action = deleted + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_service_deletion_in_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: this event can be seen when administrator delete a service or uninstall/reinstall a software that create service entry, + But it is still recommended to check this alert with high priority. +references: +- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: a service registry $Registry.registry_path$ was deleted in $Registry.dest$ + mitre_attack_id: + - T1489 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/windows_service_deletion_in_registry.test.yml b/tests/endpoint/windows_service_deletion_in_registry.test.yml new file mode 100644 index 0000000000..54a7ad09e3 --- /dev/null +++ b/tests/endpoint/windows_service_deletion_in_registry.test.yml @@ -0,0 +1,14 @@ +name: Windows Service Deletion In Registry Unit Test +tests: +- name: Windows Service Deletion In Registry + file: endpoint/windows_service_deletion_in_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + update_timestamp: true From 324b58bf12dc2d0b60e490c13e0a12398358184c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 15:40:48 +0200 Subject: [PATCH 13/20] Update windows_service_deletion_in_registry.yml --- detections/endpoint/windows_service_deletion_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index e2e3904e08..9e2cb922ba 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -39,7 +39,7 @@ tags: - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log - impact: 70 + impact: 80 kill_chain_phases: - Exploitation message: a service registry $Registry.registry_path$ was deleted in $Registry.dest$ From a482779b41ea5cc71dfcd88c4cbf2bc6264c41dd Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 1 Sep 2022 16:42:25 +0200 Subject: [PATCH 14/20] brute-ratel-3 --- .../endpoint/windows_service_deletion_in_registry.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index e2e3904e08..79b74ad9c2 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -11,11 +11,11 @@ description: The following analytic identifies a registry modification due to de The BRC4 red teaming tool is capable of deleting a services using native windows API that leave lesser noise and footprint in terms of process command-line detections. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" Registry.action = deleted - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `windows_service_deletion_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From e80c5c4e853d1ce63261705f0aa1c6c518d9386a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 18:06:44 +0200 Subject: [PATCH 15/20] Update windows_access_token_manipulation_winlogon_duplicate_token_handle.yml --- ...ccess_token_manipulation_winlogon_duplicate_token_handle.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index d275c9aba9..8d3048611d 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies a process access in winlogon.exe to duplicate its handle. This technique was seen in several adversaries, threat actors and even red teams to gain privileges to their process. - This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and used it to a new process instance. + This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens. search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime From 85fc55b2812734c941e64e530cb02c0ff6b70bb9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 5 Sep 2022 10:26:55 +0200 Subject: [PATCH 16/20] brute-rate-3 --- ...ss_token_manipulation_sedebugprivilege.yml | 69 ++++++++++++++++ ...cement_modify_transcodedwallpaper_file.yml | 78 +++++++++++++++++++ ...cess_injection_with_public_source_path.yml | 75 ++++++++++++++++++ ...ken_manipulation_sedebugprivilege.test.yml | 13 ++++ ...t_modify_transcodedwallpaper_file.test.yml | 13 ++++ ...injection_with_public_source_path.test.yml | 13 ++++ 6 files changed, 261 insertions(+) create mode 100644 detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml create mode 100644 detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml create mode 100644 detections/endpoint/windows_process_injection_with_public_source_path.yml create mode 100644 tests/endpoint/windows_access_token_manipulation_sedebugprivilege.test.yml create mode 100644 tests/endpoint/windows_defacement_modify_transcodedwallpaper_file.test.yml create mode 100644 tests/endpoint/windows_process_injection_with_public_source_path.test.yml diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml new file mode 100644 index 0000000000..3d2193e6de --- /dev/null +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -0,0 +1,69 @@ +name: Windows Access Token Manipulation SeDebugPrivilege +id: 6ece9ed0-5f92-4315-889d-48560472b188 +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. + This technique was being abused by adversaries, threat actors and red-teamers to gain debug privileges on their malware process + to be able to access or debug a process to dump credentials or to inject malicious code. This anomaly detection can be a good pivot + to catch possible mimikatz, BRC4 or malware elevating their process privileges. +search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) + | stats count min(_time) as firstTime max(_time) as lastTime by ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_manipulation_sedebugprivilege_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also + required. +known_false_positives: we've seen normal process in system32 folder path and browser application doing this technique. + Filter as needed. +references: +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703 +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log + impact: 60 + kill_chain_phases: + - Exploitation + message: a process $Process_Name$ adjust its privileges with SeDebugPrivilege in $Computer$ + mitre_attack_id: + - T1134.002 + - T1134 + nist: + - DE.CM + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Process_Name + - Security_ID + - action + - result + - Process_ID + - Message + - member_dn + - ComputerName + - user + risk_score: 36 + security_domain: endpoint diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml new file mode 100644 index 0000000000..40809e57d4 --- /dev/null +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -0,0 +1,78 @@ +name: Windows Defacement Modify Transcodedwallpaper File +id: e11c3d90-5bc7-42ad-94cd-ba75db10d897 +version: 1 +date: '2022-08-25' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory + to change the wallpaper of the host machine. This technique was seen in adversaries, threat actors and red-teaming tools to deface + or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper + if a user changes it via desktop personalized setting is explorer.exe. This Anomaly analytic can be a good pivot on a process that + is not commonly used to change the wallpaper like ransomware. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid Processes.original_file_name + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | join proc_guid, _time [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid + | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] + | `windows_defacement_modify_transcodedwallpaper_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the + process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: 3rd part software application can change the wallpaper. Filter is needed. +references: +- https://forums.ivanti.com/s/article/Wallpaper-Windows-Settings-Desktop-Settings-and-the-transcodedwallpaper-jpg?language=en_US +- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_sifreli.a +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: modification or creation of transcodedwallpaper file by $process_name$ in $dest$ + mitre_attack_id: + - T1491 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - file_create_time + - file_name + - file_path + - process_name + - process_path + - process + risk_score: 6 + security_domain: endpoint diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml new file mode 100644 index 0000000000..b6093a36b8 --- /dev/null +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -0,0 +1,75 @@ +name: Windows Process Injection With Public Source Path +id: 492f09cf-5d60-4d87-99dd-0bc325532dda +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a process creating a remote thread in another process + with a public or uncommon installation process file path. This Windows API is commonly used by threat actors, red-teamers and adversaries + for process code injection to evade detections or gain privilege escalation. +search: '`sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid TargetProcessId SourceProcessId StartAddress EventCode Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_injection_with_public_source_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: some security tool or 3rd party application may do this technique. Filter is needed. +references: +- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +tags: + analytic_story: + - Brute Ratel C4 + asset_type: 80 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ + mitre_attack_id: + - T1055 + - T1055.002 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + - signature + - TargetProcessGuid + - SourceProcessGuid + - StartAddress + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/windows_access_token_manipulation_sedebugprivilege.test.yml b/tests/endpoint/windows_access_token_manipulation_sedebugprivilege.test.yml new file mode 100644 index 0000000000..ae6569743d --- /dev/null +++ b/tests/endpoint/windows_access_token_manipulation_sedebugprivilege.test.yml @@ -0,0 +1,13 @@ +name: Windows Access Token Manipulation SeDebugPrivilege Unit Test +tests: +- name: Windows Access Token Manipulation SeDebugPrivilege + file: endpoint/windows_access_token_manipulation_sedebugprivilege.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/tests/endpoint/windows_defacement_modify_transcodedwallpaper_file.test.yml b/tests/endpoint/windows_defacement_modify_transcodedwallpaper_file.test.yml new file mode 100644 index 0000000000..d076f5424b --- /dev/null +++ b/tests/endpoint/windows_defacement_modify_transcodedwallpaper_file.test.yml @@ -0,0 +1,13 @@ +name: Windows Defacement Modify Transcodedwallpaper File Unit Test +tests: +- name: Windows Defacement Modify Transcodedwallpaper File + file: endpoint/windows_defacement_modify_transcodedwallpaper_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_process_injection_with_public_source_path.test.yml b/tests/endpoint/windows_process_injection_with_public_source_path.test.yml new file mode 100644 index 0000000000..9459363c8e --- /dev/null +++ b/tests/endpoint/windows_process_injection_with_public_source_path.test.yml @@ -0,0 +1,13 @@ +name: Windows Process Injection With Public Source Path Unit Test +tests: +- name: Windows Process Injection With Public Source Path + file: endpoint/windows_process_injection_with_public_source_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 4e393e9509d7cc97471705a1808101ca4b1ff53d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Sep 2022 10:29:49 +0200 Subject: [PATCH 17/20] Update windows_defacement_modify_transcodedwallpaper_file.yml --- .../windows_defacement_modify_transcodedwallpaper_file.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index 40809e57d4..3e41ad3494 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -74,5 +74,5 @@ tags: - process_name - process_path - process - risk_score: 6 + risk_score: 9 security_domain: endpoint From 4978fdfc07dca8a96c6e860490cdd4c86579193d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 13 Sep 2022 12:53:25 -0600 Subject: [PATCH 18/20] Some fixes --- ...ss_token_manipulation_sedebugprivilege.yml | 15 ++++++----- ...lation_winlogon_duplicate_token_handle.yml | 25 ++++++++--------- ...ogon_duplicate_handle_in_uncommon_path.yml | 22 ++++++++------- ...cement_modify_transcodedwallpaper_file.yml | 7 +++-- ...cess_injection_with_public_source_path.yml | 27 ++++++++++--------- .../windows_service_deletion_in_registry.yml | 20 +++++++------- 6 files changed, 59 insertions(+), 57 deletions(-) diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 3d2193e6de..97d6002393 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -7,9 +7,8 @@ type: Anomaly datamodel: - Endpoint description: The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. - This technique was being abused by adversaries, threat actors and red-teamers to gain debug privileges on their malware process - to be able to access or debug a process to dump credentials or to inject malicious code. This anomaly detection can be a good pivot - to catch possible mimikatz, BRC4 or malware elevating their process privileges. + SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir. + This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code. search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) | stats count min(_time) as firstTime max(_time) as lastTime by ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action | `security_content_ctime(firstTime)` @@ -18,10 +17,12 @@ search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugP how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also required. -known_false_positives: we've seen normal process in system32 folder path and browser application doing this technique. - Filter as needed. +known_false_positives: Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed. references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703 +- https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113 +- https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e +- https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication tags: analytic_story: - Brute Ratel C4 @@ -39,7 +40,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: a process $Process_Name$ adjust its privileges with SeDebugPrivilege in $Computer$ + message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $ComputerName$. mitre_attack_id: - T1134.002 - T1134 @@ -56,7 +57,7 @@ tags: - Splunk Cloud required_fields: - _time - - Process_Name + - ProcessName - Security_ID - action - result diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index 8d3048611d..cd80686ee5 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -4,11 +4,9 @@ version: 1 date: '2022-08-24' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint -description: The following analytic identifies a process access in winlogon.exe to duplicate its handle. - This technique was seen in several adversaries, threat actors and even red teams to gain privileges to their process. - This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. +datamodel: [] +description: The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle. + This technique was seen in several adversaries to gain privileges for their process. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens. search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime @@ -16,12 +14,11 @@ search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: third party software application may do this technique. +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. If you are using Sysmon, you must have at least version 6.0.4 + of the Sysmon TA. +known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle - https://attack.mitre.org/techniques/T1134/001/ @@ -42,7 +39,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$ + message: A process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$ mitre_attack_id: - T1134.001 - T1134 @@ -53,6 +50,10 @@ tags: type: Endpoint role: - Victim + - name: SourceImage + type: Process Name + role: + - Parent Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index 30b96f5a91..b46fcfda5b 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -4,10 +4,9 @@ version: 1 date: '2022-08-24' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint -description: The following analytic identifies a process access in winlogon.exe to duplicate its handle with a non-common or public process source path. - This technique was seen in several adversaries, threat actors and even red teams to gain privileges to their process. +datamodel: [] +description: The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path. + This technique was seen where adversaries attempt to gain privileges to their process. This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens. search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 @@ -16,12 +15,11 @@ search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: 3rd party software application may do this technique. +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. If you are using Sysmon, you must have at least version 6.0.4 + of the Sysmon TA. +known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle - https://attack.mitre.org/techniques/T1134/001/ @@ -53,6 +51,10 @@ tags: type: Endpoint role: - Victim + - name: SourceImage + type: Process Name + role: + - Parent Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index 3e41ad3494..0791d83312 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -7,10 +7,9 @@ type: Anomaly datamodel: - Endpoint description: The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory - to change the wallpaper of the host machine. This technique was seen in adversaries, threat actors and red-teaming tools to deface + to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper - if a user changes it via desktop personalized setting is explorer.exe. This Anomaly analytic can be a good pivot on a process that - is not commonly used to change the wallpaper like ransomware. + if a user changes it via desktop personalized setting is explorer.exe. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid Processes.original_file_name | `drop_dm_object_name(Processes)` @@ -53,7 +52,7 @@ tags: nist: - DE.CM observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index b6093a36b8..c7adbab730 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -3,23 +3,20 @@ id: 492f09cf-5d60-4d87-99dd-0bc325532dda version: 1 date: '2022-08-24' author: Teoderick Contreras, Splunk -type: TTP -datamodel: -- Endpoint -description: The following analytic identifies a process creating a remote thread in another process - with a public or uncommon installation process file path. This Windows API is commonly used by threat actors, red-teamers and adversaries - for process code injection to evade detections or gain privilege escalation. +type: Hunting +datamodel: [] +description: The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries + for process injection to evade detections or gain privilege escalation. search: '`sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_with_public_source_path_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: some security tool or 3rd party application may do this technique. Filter is needed. +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. If you are using Sysmon, you must have at least version 6.0.4 + of the Sysmon TA. +known_false_positives: Some security products or third party applications may utilize CreateRemoteThread, filter as needed before enabling as a notable. references: - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ tags: @@ -39,7 +36,7 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ + message: process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$ mitre_attack_id: - T1055 - T1055.002 @@ -54,6 +51,10 @@ tags: type: Process role: - Attacker + - name: TargetImage + type: Process + role: + - Process Name product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index 3488fefd77..aec113fbea 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -3,13 +3,11 @@ id: daed6823-b51c-4843-a6ad-169708f1323e version: 1 date: '2022-08-24' author: Teoderick Contreras, Splunk -type: TTP +type: Anomaly datamodel: - Endpoint -description: The following analytic identifies a registry modification due to deleted services. - Red Teams, malicious actors and adversaries may delete a security service as part of its defense evasion. - The BRC4 red teaming tool is capable of deleting a services using native windows API that leave lesser noise - and footprint in terms of process command-line detections. +description: The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services. + Adversaries may delete a service as part of defense evasion. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name Registry.action Registry.dest @@ -21,8 +19,8 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: this event can be seen when administrator delete a service or uninstall/reinstall a software that create service entry, - But it is still recommended to check this alert with high priority. +known_false_positives: This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry, + but it is still recommended to check this alert with high priority. references: - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ tags: @@ -33,16 +31,16 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 80 + confidence: 30 context: - Source:Endpoint - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log - impact: 80 + impact: 60 kill_chain_phases: - Exploitation - message: a service registry $Registry.registry_path$ was deleted in $Registry.dest$ + message: A service was deleted on $dest$ within the Windows registry. mitre_attack_id: - T1489 nist: @@ -70,5 +68,5 @@ tags: - Processes.parent_process_name - Processes.parent_process - Processes.process_guid - risk_score: 64 + risk_score: 18 security_domain: endpoint From 71ff090c370ea4ac3de2b1f5d3d56a977d295086 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Sep 2022 14:39:40 +0200 Subject: [PATCH 19/20] Update windows_process_injection_with_public_source_path.yml --- .../windows_process_injection_with_public_source_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index c7adbab730..cd521448ea 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -54,7 +54,7 @@ tags: - name: TargetImage type: Process role: - - Process Name + - Target product: - Splunk Enterprise - Splunk Enterprise Security From 2c57c078a0dc0a606481a484ea903cdda7f26865 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 15 Sep 2022 11:21:05 -0500 Subject: [PATCH 20/20] minor --- ...indows_access_token_manipulation_sedebugprivilege.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 97d6002393..89c68e99d5 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -4,13 +4,12 @@ version: 1 date: '2022-08-24' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir. This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code. search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) - | stats count min(_time) as firstTime max(_time) as lastTime by ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action + | stats count min(_time) as firstTime max(_time) as lastTime by Computer ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_sedebugprivilege_filter`' @@ -40,14 +39,14 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $ComputerName$. + message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $Computer$. mitre_attack_id: - T1134.002 - T1134 nist: - DE.CM observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim