Windows Bits Job Persistence

detections/endpoint/ssa___windows_bits_job_persistence.yml

@@ -0,0 +1,96 @@
+name: Windows Bits Job Persistence
+id: 1e25e97a-8ea4-11ec-9767-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job. Typically seen combined in a oneliner or ran in sequence. If identified, review
+  the BITS job created and capture any files written to disk. It is possible for BITS
+  to be used to upload files and this may require further network data analysis to
+  identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
+  AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line, "%setnotifyflags%")
+  OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line, "%setminretrydelay%") OR like (cmd_line,
+  "%setcustomheaders%") OR like (cmd_line, "%resume%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+tags:
+  analytic_story:
+  - BITS Jobs
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to persist using BITS.
+  mitre_attack_id:
+  - T1197
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/ssa___windows_rasautou_dll_execution.yml

@@ -5,7 +5,7 @@ date: '2022-02-15'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. 
   During triage, review parent and child process behavior including file and image loads.
 search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)