diff --git a/baselines/previously_seen_command_line_arguments.yml b/baselines/previously_seen_command_line_arguments.yml index bc4759a0de..68f851079f 100644 --- a/baselines/previously_seen_command_line_arguments.yml +++ b/baselines/previously_seen_command_line_arguments.yml @@ -28,6 +28,7 @@ tags: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - Suspicious Command-Line Executions - Suspicious MSHTA Activity + - Icedid detections: - Detect Prohibited Applications Spawning cmd.exe - Processes launching netsh diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index d2ce13b87e..56fac3f698 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -29,9 +29,11 @@ known_false_positives: admin or power user may used this series of command. references: - https://labs.vipre.com/trickbot-and-its-modules/ - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/ tags: analytic_story: - Trickbot + - Icedid automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml new file mode 100644 index 0000000000..c0ad4f8398 --- /dev/null +++ b/detections/endpoint/chcp_command_execution.yml @@ -0,0 +1,68 @@ +name: CHCP Command Execution +id: 21d236ec-eec1-11eb-b23e-acde48001122 +version: 1 +date: '2021-07-27' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect execution of chcp.exe application. this utility + is used to change the active code page of the console. This technique was seen in + icedid malware to know the locale region/language/country of the compromise host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com + Processes.parent_process_name = cmd.exe Processes.parent_process=*/c* by Processes.process_name + Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id + Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. +known_false_positives: other tools or script may used this to change code page to + UTF-* or others +references: +- https://ss64.com/nt/chcp.html +- https://twitter.com/tccontre18/status/1419941156633329665?s=20 +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Recon + message: parent process $parent_process_name$ spawning chcp process $process_name$ + with parent command line $parent_process$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml new file mode 100644 index 0000000000..5d17290eba --- /dev/null +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -0,0 +1,64 @@ +name: Create Remote Thread In Shell Application +id: 10399c1e-f51e-11eb-b920-acde48001122 +version: 1 +date: '2021-08-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious process injection in command shell. + This technique was seen in IcedID where it execute cmd.exe process to inject its + shellcode as part of its execution as banking trojan. It is really uncommon to have + a create remote thread execution in the following application. +search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats + count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId + SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ + in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 9864d74ac2..4e4b474520 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -5,7 +5,7 @@ date: '2021-02-11' author: Michael Haag, Splunk type: batch datamodel: - - Endpoint +- Endpoint description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -21,12 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_html_help_renamed_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. references: @@ -49,7 +50,8 @@ tags: impact: 80 kill_chain_phases: - Actions on Objectives - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$. mitre_attack_id: - T1218.001 nist: @@ -80,11 +82,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml new file mode 100644 index 0000000000..d24f1d64cc --- /dev/null +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -0,0 +1,55 @@ +name: Drop IcedID License dat +id: b7a045fc-f14a-11eb-8e79-acde48001122 +version: 1 +date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect dropping a suspicious file named as "license.dat" + in %appdata%. This behavior seen in latest IcedID malware that contain the actual + core bot that will be injected in other process to do banking stealing. +search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" + OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) + as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1204.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 70 + confidence: 90 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Execution + message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 01042360f1..0164dfce6e 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Icedid automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index c9b8bc84fe..b2daa0ceb4 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Icedid automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml new file mode 100644 index 0000000000..00e814410d --- /dev/null +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -0,0 +1,60 @@ +name: IcedID Exfiltrated Archived File Creation +id: 0db4da70-f14b-11eb-8043-acde48001122 +version: 1 +date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious file creation namely passff.tar + and cookie.tar. This files are possible archived of stolen browser information like + history and cookies in a compromised machine with IcedID. +search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename + = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by + TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1560.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - TargetFilename + - EventCode + - process_id + - process_name + - Computer + security_domain: endpoint + impact: 80 + confidence: 90 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Collection + message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 45088726f6..c75dd71b5e 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Trickbot + - Icedid confidence: 80 context: - source:endpoint diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 0d28c474ab..e635d1c761 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -34,6 +34,7 @@ tags: analytic_story: - Ryuk Ransomware - Domain Trust Discovery + - Icedid asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml new file mode 100644 index 0000000000..ac10bc9de9 --- /dev/null +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -0,0 +1,64 @@ +name: Office Application Spawn Regsvr32 process +id: 2d9fc90c-f11f-11eb-9300-acde48001122 +version: 1 +date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious spawned process + of known MS office application due to macro or malicious code. this technique can + be seen in so many malware like Icedid that used MS office as its weapon or attack + vector to initially infect the machines. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name + = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") Processes.process_name=regsvr32.exe + by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `office_application_spawn_regsvr32_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.user + - Processes.dest + security_domain: endpoint + impact: 70 + confidence: 90 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Execution + message: Office application spawning regsvr32.exe on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index c55864fce5..90c8a0d882 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Spearphishing Attachments - Trickbot + - Icedid automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 79d24dedce..4511ad6f43 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Spearphishing Attachments - Trickbot + - Icedid automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 00cf1528e1..8ed9ccf6f4 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Icedid automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 260ccc4f77..1d8b4a3242 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -11,7 +11,7 @@ description: The following analytic identifies suspicious PowerShell script exec adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*" +search: '`powershell` EventCode=4104 (Message = "*SELECT*" OR Message = "*WMIC*") AND (Message = "*AntiVirusProduct*" OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 9ea16c9fb4..0121580b1f 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -36,6 +36,7 @@ tags: - Ransomware - Windows Persistence Techniques - 'Emotet Malware DHS Report TA18-201A ' + - Icedid asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml new file mode 100644 index 0000000000..586997bf94 --- /dev/null +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -0,0 +1,64 @@ +name: Rundll32 Create Remote Thread To A Process +id: 2dbeee3a-f067-11eb-96c0-acde48001122 +version: 1 +date: '2021-07-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe + process to cmd.exe process . This technique was seen in IcedID malware to execute + its malicious code in normal process for defense evasion and to steal sensitive + information the the compromised host. browser process. +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" + | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage + TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your endpoints + related to create remote thread or injecting codes. If you are using Sysmon, you + must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ + in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml new file mode 100644 index 0000000000..99b0196e13 --- /dev/null +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -0,0 +1,65 @@ +name: Rundll32 CreateRemoteThread In Browser +id: f8a22586-ee2d-11eb-a193-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe + process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID + malware where it hooks the browser to parse banking information as user used the + targetted browser process. +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", + "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) + as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId + StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `rundll32_createremotethread_in_browser_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your endpoints + related to create remote thread or injecting codes. If you are using Sysmon, you + must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 100 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: rundl32 process $SourceImage$ create a remote thread to browser process + $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml new file mode 100644 index 0000000000..144a3da9d9 --- /dev/null +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -0,0 +1,64 @@ +name: Rundll32 DNSQuery +id: f1483f5e-ee29-11eb-9d23-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe process having a http + connection and do a dns query in some web domain. This technique was seen in IcedID + malware where the rundll32 that execute its payload will contact amazon.com to check + internet connect and to communicate to its C&C server to download config and other + file component. +search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) + as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId direction + Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `rundll32_dnsquery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and eventcode = 22 dnsquery executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://any.run/malware-trends/icedid +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - ProcessId + - direction + - Computer + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: rundll32 process $process_name$ having a dns query to $QueryName$ in host + $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml new file mode 100644 index 0000000000..632a090c88 --- /dev/null +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -0,0 +1,61 @@ +name: Rundll32 Process Creating Exe Dll Files +id: 6338266a-ee2a-11eb-bf68-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32 process that drops executable + (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries + to drop copy of itself in temp folder or download executable drop it either appdata + or programdata as part of its execution. +search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", + "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image + TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, TargetFilename, and eventcode 11 executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://any.run/malware-trends/icedid +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - ProcessGuid + - dest + - user_id + security_domain: endpoint + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index e61686a6b3..a396994af0 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Windows Persistence Techniques - Trickbot + - Icedid automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml new file mode 100644 index 0000000000..8d198240b5 --- /dev/null +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -0,0 +1,62 @@ +name: Sqlite Module In Temp Folder +id: 0f216a38-f45f-11eb-b09c-acde48001122 +version: 1 +date: '2021-08-03' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious file creation of sqlite3.dll in + %temp% folder. This behavior was seen in IcedID malware where it download sqlite + module to parse browser database like for chrome or firefox to stole browser information + related to bank, credit card or credentials. +search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename + = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") |stats count min(_time) as + firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId + Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `sqlite_module_in_temp_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - TargetFilename + - EventCode + - ProcessId + - Image + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Collection + message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml new file mode 100644 index 0000000000..5048ec2057 --- /dev/null +++ b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml @@ -0,0 +1,67 @@ +name: Suspicious IcedID Regsvr32 Cmdline +id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 +version: 1 +date: '2021-07-27' +author: Teoderick Contreras, +type: batch +datamodel: +- Endpoint +description: this search is to detect a suspicious regsvr32 commandline "-s" to execute + a dll files. This technique was seen in IcedID malware to execute its initial downloader + dll that will download the 2nd stage loader that will download and decrypt the config + payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe + Processes.process=*-s* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used. +known_false_positives: minimal. but network operator can use this application to load + dll. +references: +- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.010 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: regsvr32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml new file mode 100644 index 0000000000..904503751f --- /dev/null +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -0,0 +1,66 @@ +name: Suspicious IcedID Rundll32 Cmdline +id: bed761f8-ee29-11eb-8bf3-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe commandline to execute + dll file. This technique was seen in IcedID malware to load its payload dll with + the following parameter to load encrypted dll payload which is the license.dat. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + Processes.process=*/i:* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: limitted. this parameter is not commonly used by windows application + but can be used by the network operator. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: rundll32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index b1d1014167..cfc2bf1edf 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Suspicious Regsvr32 Activity + - Iceid asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml new file mode 100644 index 0000000000..d178a04e46 --- /dev/null +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -0,0 +1,66 @@ +name: Suspicious Rundll32 PluginInit +id: 92d51712-ee29-11eb-b1ae-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe process with plugininit + parameter. This technique is commonly seen in IceID malware to execute its initial + dll stager to download another payload to the compromised machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + Processes.process=*PluginInit* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: third party application may used this dll export name to execute + function. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 60 + confidence: 70 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: rundll32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 9e51610551..5312bb558b 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -46,6 +46,7 @@ tags: - Windows Persistence Techniques - Ransomware - Ryuk Ransomware + - Icedid automated_detection_testing: passed confidence: 100 context: diff --git a/stories/Icedid.yml b/stories/Icedid.yml new file mode 100644 index 0000000000..25e617f011 --- /dev/null +++ b/stories/Icedid.yml @@ -0,0 +1,25 @@ +name: Icedid +id: 1d2cc747-63d7-49a9-abb8-93aa36305603 +version: 1 +date: '2021-07-29' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the IcedID banking trojan, including looking for file writes associated + with its payload, process injection, shellcode execution and data collection. +narrative: IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known + in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known + to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or + gzip dat file that contains "license.dat" which is the actual core icedid bot. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/ +tags: + analytic_story: Icedid + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/chcp_command_execution.test.yml b/tests/endpoint/chcp_command_execution.test.yml new file mode 100644 index 0000000000..0b90e5e8bd --- /dev/null +++ b/tests/endpoint/chcp_command_execution.test.yml @@ -0,0 +1,14 @@ +name: CHCP Command Execution Unit Test +tests: +- name: CHCP Command Execution + file: endpoint/chcp_command_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + \ No newline at end of file diff --git a/tests/endpoint/create_remote_thread_in_shell_application.test.yml b/tests/endpoint/create_remote_thread_in_shell_application.test.yml new file mode 100644 index 0000000000..3d45529127 --- /dev/null +++ b/tests/endpoint/create_remote_thread_in_shell_application.test.yml @@ -0,0 +1,12 @@ +name: Create Remote Thread In Shell Application Unit Test +tests: +- name: Create Remote Thread In Shell Application + file: endpoint/create_remote_thread_in_shell_application.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/drop_icedid_license_dat.test.yml b/tests/endpoint/drop_icedid_license_dat.test.yml new file mode 100644 index 0000000000..f1bc61cd4f --- /dev/null +++ b/tests/endpoint/drop_icedid_license_dat.test.yml @@ -0,0 +1,12 @@ +name: Drop IcedID License dat Unit Test +tests: +- name: Drop IcedID License dat + file: endpoint/drop_icedid_license_dat.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml b/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml new file mode 100644 index 0000000000..4d11669497 --- /dev/null +++ b/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml @@ -0,0 +1,12 @@ +name: IcedID Exfiltrated Archived File Creation Unit Test +tests: +- name: IcedID Exfiltrated Archived File Creation + file: endpoint/icedid_exfiltrated_archived_file_creation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_application_spawn_regsvr32_process.test.yml b/tests/endpoint/office_application_spawn_regsvr32_process.test.yml new file mode 100644 index 0000000000..aa9c3db3e4 --- /dev/null +++ b/tests/endpoint/office_application_spawn_regsvr32_process.test.yml @@ -0,0 +1,12 @@ +name: Office Application Spawn Regsvr32 process Unit Test +tests: +- name: Office Application Spawn Regsvr32 process + file: endpoint/office_application_spawn_regsvr32_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml b/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml new file mode 100644 index 0000000000..3e73848153 --- /dev/null +++ b/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 Create Remote Thread To A Process Unit Test +tests: +- name: Rundll32 Create Remote Thread To A Process + file: endpoint/rundll32_create_remote_thread_to_a_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_createremotethread_in_browser.test.yml b/tests/endpoint/rundll32_createremotethread_in_browser.test.yml new file mode 100644 index 0000000000..a42be77dff --- /dev/null +++ b/tests/endpoint/rundll32_createremotethread_in_browser.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 CreateRemoteThread In Browser Unit Test +tests: +- name: Rundll32 CreateRemoteThread In Browser + file: endpoint/rundll32_createremotethread_in_browser.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_dnsquery.test.yml b/tests/endpoint/rundll32_dnsquery.test.yml new file mode 100644 index 0000000000..66f19008ba --- /dev/null +++ b/tests/endpoint/rundll32_dnsquery.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 DNSQuery Unit Test +tests: +- name: Rundll32 DNSQuery + file: endpoint/rundll32_dnsquery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml b/tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml new file mode 100644 index 0000000000..594b075486 --- /dev/null +++ b/tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 Process Creating Exe Dll Files Unit Test +tests: +- name: Rundll32 Process Creating Exe Dll Files + file: endpoint/rundll32_process_creating_exe_dll_files.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/sqlite_module_in_temp_folder.test.yml b/tests/endpoint/sqlite_module_in_temp_folder.test.yml new file mode 100644 index 0000000000..95206dbdc1 --- /dev/null +++ b/tests/endpoint/sqlite_module_in_temp_folder.test.yml @@ -0,0 +1,12 @@ +name: Sqlite Module In Temp Folder Unit Test +tests: +- name: Sqlite Module In Temp Folder + file: endpoint/sqlite_module_in_temp_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml b/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml new file mode 100644 index 0000000000..6d0535e5e8 --- /dev/null +++ b/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml @@ -0,0 +1,12 @@ +name: Suspicious IcedID Regsvr32 Cmdline Unit Test +tests: +- name: Suspicious IcedID Regsvr32 Cmdline + file: endpoint/suspicious_icedid_regsvr32_cmdline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml b/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml new file mode 100644 index 0000000000..32c62eb72c --- /dev/null +++ b/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml @@ -0,0 +1,12 @@ +name: Suspicious IcedID Rundll32 Cmdline Unit Test +tests: +- name: Suspicious IcedID Rundll32 Cmdline + file: endpoint/suspicious_icedid_rundll32_cmdline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_rundll32_plugininit.test.yml b/tests/endpoint/suspicious_rundll32_plugininit.test.yml new file mode 100644 index 0000000000..9c3b0018a8 --- /dev/null +++ b/tests/endpoint/suspicious_rundll32_plugininit.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Rundll32 PluginInit Unit Test +tests: +- name: Suspicious Rundll32 PluginInit + file: endpoint/suspicious_rundll32_plugininit.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file