mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
github-actions[bot]
@@ -0,0 +1,49 @@
|
||||
name: Deny Permission using Cacls Utility
|
||||
id: b76eae28-cd25-11eb-9c92-acde48001122
|
||||
version: 1
|
||||
date: '2021-06-14'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: streaming
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic identifies a potential adversary that changes the security
|
||||
permission of a specific file or directory. This technique is commonly seen in APT
|
||||
tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent
|
||||
access to their component files.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null),
|
||||
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true
|
||||
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null),
|
||||
ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
|
||||
known_false_positives: network administrator may use this windows utility but this is not a common practice.
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
mitre_attack_id:
|
||||
- T1222
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,48 @@
|
||||
name: Grant Permission Using Cacls Utility
|
||||
id: c6da561a-cd29-11eb-ae65-acde48001122
|
||||
version: 1
|
||||
date: '2021-06-14'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: streaming
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic identifies potential adversaries that modify the security
|
||||
permission of a specific file or directory. This technique is commonly seen in APT
|
||||
tradecraft, ransomware and coinminer scripts to evade detections and restrict access to their
|
||||
component files.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null),
|
||||
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true
|
||||
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null),
|
||||
ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
|
||||
known_false_positives: network administrator may use this windows utility but this is not a common practice.
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
mitre_attack_id:
|
||||
- T1222
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,50 @@
|
||||
name: Modify ACLs Permission Of Files Or Folders
|
||||
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
|
||||
version: 1
|
||||
date: '2021-06-15'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: streaming
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic identifies suspicious modification of ACL permission to
|
||||
a files or folder to make it available to everyone or to a specific user. This technique may be used by
|
||||
the adversary to evade ACLs or protected files access. This changes is commonly
|
||||
configured by the file or directory owner with appropriate permission. This behavior
|
||||
is a good indicator if this command seen on a machine utilized by an account with
|
||||
no permission to do so.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null),
|
||||
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true)
|
||||
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
|
||||
known_false_positives: network administrator may use this windows utility. filter is needed.
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
mitre_attack_id:
|
||||
- T1222
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,51 @@
|
||||
name: WevtUtil Usage To Clear Logs
|
||||
id: 5438113c-cdd9-11eb-93b8-acde48001122
|
||||
version: 1
|
||||
date: '2021-06-15'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: streaming
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The wevtutil.exe application is the windows event log utility. This searches
|
||||
for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon,
|
||||
or system event logs.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR
|
||||
match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR
|
||||
match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting data that records process activity from your
|
||||
hosts to populate the Endpoint data model in the Processes node. You must also be
|
||||
ingesting logs with both the process name and command line from your endpoints.
|
||||
The command-line arguments are mapped to the "process" field in the Endpoint data
|
||||
model.
|
||||
known_false_positives: The wevtutil.exe application is a legitimate Windows event
|
||||
log utility. Administrators may use it to manage Windows event logs.
|
||||
references:
|
||||
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Log Manipulation
|
||||
- Ransomware
|
||||
- Clop Ransomware
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
|
||||
mitre_attack_id:
|
||||
- T1070.001
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,47 @@
|
||||
name: Wevtutil Usage To Disable Logs
|
||||
id: a4bdc944-cdd9-11eb-ac97-acde48001122
|
||||
version: 1
|
||||
date: '2021-06-15'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: streaming
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search is to detect execution of wevtutil.exe to disable logs. This
|
||||
technique was seen in several ransomware to disable the event logs to evade alerts
|
||||
and detections in compromised host.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe"
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting data that records process activity from your
|
||||
hosts to populate the Endpoint data model in the Processes node. You must also be
|
||||
ingesting logs with both the process name and command line from your endpoints.
|
||||
The command-line arguments are mapped to the "process" field in the Endpoint data
|
||||
model.
|
||||
known_false_positives: network operator may disable audit event logs for debugging purposes.
|
||||
references:
|
||||
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Log Manipulation
|
||||
- Ransomware
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
|
||||
mitre_attack_id:
|
||||
- T1070.001
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Deny Permission using Cacls Utility Unit Test
|
||||
tests:
|
||||
- name: Deny Permission using Cacls Utility
|
||||
file: endpoint/ssa___deny_permission_using_cacls_utility.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for usage of cacls deny permission to a file(s) or folder(s)
|
||||
attack_data:
|
||||
- file_name: all_icalc.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
source: WinEventLog:Security
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Grant Permission Using Cacls Utility Unit Test
|
||||
tests:
|
||||
- name: Grant Permission Using Cacls Utility
|
||||
file: endpoint/ssa___grant_permission_using_cacls_utility.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for usage of cacls grant permission to a file(s) or folder(s)
|
||||
attack_data:
|
||||
- file_name: all_icalc.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
source: WinEventLog:Security
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Modify ACLs Permission Of Files Or Folders Unit Test
|
||||
tests:
|
||||
- name: Modify ACLs Permission Of Files Or Folders
|
||||
file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for modifying permission of a file(s) or folder(s) using cacls utility.
|
||||
attack_data:
|
||||
- file_name: all_icalc.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
source: WinEventLog:Security
|
||||
@@ -0,0 +1,14 @@
|
||||
name: WevtUtil Usage To Clear Logs Unit Test
|
||||
tests:
|
||||
- name: WevtUtil Usage To Clear Logs
|
||||
file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for wevtutil clear logs command
|
||||
attack_data:
|
||||
- file_name: clear_evt.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
|
||||
source: WinEventLog:Security
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Wevtutil Usage To Disable Logs Unit Test
|
||||
tests:
|
||||
- name: Wevtutil Usage To Disable Logs
|
||||
file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for wevtutil disable logs command
|
||||
attack_data:
|
||||
- file_name: disable_evt.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
|
||||
source: WinEventLog:Security
|
||||
Reference in New Issue
Block a user