From d2129cb6d2ef594352d5babb4e7402a05207ce94 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 29 Jul 2021 15:19:44 +0200 Subject: [PATCH 01/28] icedid --- ...ll32_create_remote_thread_to_a_process.yml | 66 +++++++++++++++++ ...rundll32_createremotethread_in_browser.yml | 64 +++++++++++++++++ .../suspicious_icedid_regsvr32_cmdline.yml | 68 ++++++++++++++++++ .../suspicious_icedid_rundll32_cmdline.yml | 70 +++++++++++++++++++ .../suspicious_rundll32_plugininit.yml | 69 ++++++++++++++++++ ...create_remote_thread_to_a_process.test.yml | 12 ++++ ...l32_createremotethread_in_browser.test.yml | 12 ++++ ...uspicious_icedid_regsvr32_cmdline.test.yml | 12 ++++ ...uspicious_icedid_rundll32_cmdline.test.yml | 12 ++++ .../suspicious_rundll32_plugininit.test.yml | 12 ++++ 10 files changed, 397 insertions(+) create mode 100644 detections/endpoint/rundll32_create_remote_thread_to_a_process.yml create mode 100644 detections/endpoint/rundll32_createremotethread_in_browser.yml create mode 100644 detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml create mode 100644 detections/endpoint/suspicious_icedid_rundll32_cmdline.yml create mode 100644 detections/endpoint/suspicious_rundll32_plugininit.yml create mode 100644 tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml create mode 100644 tests/endpoint/rundll32_createremotethread_in_browser.test.yml create mode 100644 tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml create mode 100644 tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml create mode 100644 tests/endpoint/suspicious_rundll32_plugininit.test.yml diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml new file mode 100644 index 0000000000..ec3808d37f --- /dev/null +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -0,0 +1,66 @@ +name: Rundll32 Create Remote Thread To A Process +id: 2dbeee3a-f067-11eb-96c0-acde48001122 +version: 1 +date: '2021-07-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process + . This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive + information the the compromised host. + browser process. +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" + | stats count min(_time) as firstTime max(_time) as lastTime + by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_create_remote_thread_to_a_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your + endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source: endpoint + - stage: Defense Evasion + message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml new file mode 100644 index 0000000000..755c9df043 --- /dev/null +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -0,0 +1,64 @@ +name: Rundll32 CreateRemoteThread In Browser +id: f8a22586-ee2d-11eb-a193-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" + browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted + browser process. +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe") + | stats count min(_time) as firstTime max(_time) as lastTime + by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_createremotethread_in_browser_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your + endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source: endpoint + - stage: Defense Evasion + message: rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker \ No newline at end of file diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml new file mode 100644 index 0000000000..52fb962aa2 --- /dev/null +++ b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml @@ -0,0 +1,68 @@ +name: Suspicious IcedID Regsvr32 Cmdline +id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 +version: 1 +date: '2021-07-27' +author: Teoderick Contreras, +type: batch +datamodel: +- Endpoint +description: this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. + This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader + that will download and decrypt the config payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe + Processes.process=*-s* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_icedid_regsvr32_cmdline_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used. +known_false_positives: minimal. but network operator can use this application to load dll. +references: +- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.010 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source: endpoint + - stage: Defense Evasion + message: regsvr32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml new file mode 100644 index 0000000000..c8f30af051 --- /dev/null +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -0,0 +1,70 @@ +name: Suspicious IcedID Rundll32 Cmdline +id: bed761f8-ee29-11eb-8bf3-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe commandline to execute dll file. + This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted + dll payload which is the license.dat. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + Processes.process=*/i:* by Processes.process_name Processes.process + Processes.parent_process_name Processes.parent_process Processes.process_id + Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_icedid_rundll32_cmdline_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: limitted. this parameter is not commonly used by + windows application but can be used by the network operator. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source: endpoint + - stage: Defense Evasion + message: rundll32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml new file mode 100644 index 0000000000..21b2d37c0a --- /dev/null +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -0,0 +1,69 @@ +name: Suspicious Rundll32 PluginInit +id: 92d51712-ee29-11eb-b1ae-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe process with plugininit parameter. + This technique is commonly seen in IceID malware to execute its initial dll stager to download another + payload to the compromised machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + Processes.process=*PluginInit* by Processes.process_name Processes.process + Processes.parent_process_name Processes.parent_process Processes.process_id + Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_rundll32_plugininit_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: third party application may used this dll export name to execute function. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - source: endpoint + - stage: Defense Evasion + message: rundll32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml b/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml new file mode 100644 index 0000000000..3e73848153 --- /dev/null +++ b/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 Create Remote Thread To A Process Unit Test +tests: +- name: Rundll32 Create Remote Thread To A Process + file: endpoint/rundll32_create_remote_thread_to_a_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_createremotethread_in_browser.test.yml b/tests/endpoint/rundll32_createremotethread_in_browser.test.yml new file mode 100644 index 0000000000..a42be77dff --- /dev/null +++ b/tests/endpoint/rundll32_createremotethread_in_browser.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 CreateRemoteThread In Browser Unit Test +tests: +- name: Rundll32 CreateRemoteThread In Browser + file: endpoint/rundll32_createremotethread_in_browser.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml b/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml new file mode 100644 index 0000000000..6d0535e5e8 --- /dev/null +++ b/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml @@ -0,0 +1,12 @@ +name: Suspicious IcedID Regsvr32 Cmdline Unit Test +tests: +- name: Suspicious IcedID Regsvr32 Cmdline + file: endpoint/suspicious_icedid_regsvr32_cmdline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml b/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml new file mode 100644 index 0000000000..32c62eb72c --- /dev/null +++ b/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml @@ -0,0 +1,12 @@ +name: Suspicious IcedID Rundll32 Cmdline Unit Test +tests: +- name: Suspicious IcedID Rundll32 Cmdline + file: endpoint/suspicious_icedid_rundll32_cmdline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_rundll32_plugininit.test.yml b/tests/endpoint/suspicious_rundll32_plugininit.test.yml new file mode 100644 index 0000000000..9c3b0018a8 --- /dev/null +++ b/tests/endpoint/suspicious_rundll32_plugininit.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Rundll32 PluginInit Unit Test +tests: +- name: Suspicious Rundll32 PluginInit + file: endpoint/suspicious_rundll32_plugininit.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 5054148a72d1913e60d8345b4cd9d49eeea3a841 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 29 Jul 2021 17:14:14 +0200 Subject: [PATCH 02/28] story --- stories/Icedid.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 stories/Icedid.yml diff --git a/stories/Icedid.yml b/stories/Icedid.yml new file mode 100644 index 0000000000..25e617f011 --- /dev/null +++ b/stories/Icedid.yml @@ -0,0 +1,25 @@ +name: Icedid +id: 1d2cc747-63d7-49a9-abb8-93aa36305603 +version: 1 +date: '2021-07-29' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the IcedID banking trojan, including looking for file writes associated + with its payload, process injection, shellcode execution and data collection. +narrative: IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known + in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known + to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or + gzip dat file that contains "license.dat" which is the actual core icedid bot. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/ +tags: + analytic_story: Icedid + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 2d13569fff7869d2f1be7205873f925293e33a43 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 30 Jul 2021 12:34:15 +0200 Subject: [PATCH 03/28] icedid story --- ...previously_seen_command_line_arguments.yml | 1 + detections/endpoint/eventvwr_uac_bypass.yml | 1 + detections/endpoint/fodhelper_uac_bypass.yml | 1 + ..._spawning_rundll32_or_regsvr32_process.yml | 1 + ...ice_application_spawn_regsvr32_process.yml | 65 +++++++++++++++++++ ...ice_application_spawn_rundll32_process.yml | 1 + .../office_document_executing_macro_code.yml | 1 + .../office_product_spawning_mshta.yml | 1 + .../registry_keys_used_for_persistence.yml | 1 + ...ule_task_with_rundll32_command_trigger.yml | 1 + ...ious_regsvr32_register_suspicious_path.yml | 1 + ...pplication_spawn_regsvr32_process.test.yml | 12 ++++ 12 files changed, 87 insertions(+) create mode 100644 detections/endpoint/office_application_spawn_regsvr32_process.yml create mode 100644 tests/endpoint/office_application_spawn_regsvr32_process.test.yml diff --git a/baselines/previously_seen_command_line_arguments.yml b/baselines/previously_seen_command_line_arguments.yml index bc4759a0de..68f851079f 100644 --- a/baselines/previously_seen_command_line_arguments.yml +++ b/baselines/previously_seen_command_line_arguments.yml @@ -28,6 +28,7 @@ tags: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - Suspicious Command-Line Executions - Suspicious MSHTA Activity + - Icedid detections: - Detect Prohibited Applications Spawning cmd.exe - Processes launching netsh diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 01042360f1..0164dfce6e 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Icedid automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index c9b8bc84fe..b2daa0ceb4 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Icedid automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 45088726f6..c75dd71b5e 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Trickbot + - Icedid confidence: 80 context: - source:endpoint diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml new file mode 100644 index 0000000000..4aa6627b89 --- /dev/null +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -0,0 +1,65 @@ +name: Office Application Spawn Regsvr32 process +id: 2d9fc90c-f11f-11eb-9300-acde48001122 +version: 1 +date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious spawned process + of known MS office application due to macro or malicious code. this technique can + be seen in so many malware like Icedid that used MS office as its weapon or attack + vector to initially infect the machines. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name + = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") + Processes.process_name=regsvr32.exe by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `office_application_spawn_regsvr32_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.user + - Processes.dest + security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Execution + message: Office application spawning regsvr32.exe on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index c55864fce5..90c8a0d882 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Spearphishing Attachments - Trickbot + - Icedid automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 79d24dedce..4511ad6f43 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Spearphishing Attachments - Trickbot + - Icedid automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 00cf1528e1..8ed9ccf6f4 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Icedid automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 9ea16c9fb4..0121580b1f 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -36,6 +36,7 @@ tags: - Ransomware - Windows Persistence Techniques - 'Emotet Malware DHS Report TA18-201A ' + - Icedid asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index e61686a6b3..a396994af0 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Windows Persistence Techniques - Trickbot + - Icedid automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index b1d1014167..cfc2bf1edf 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Suspicious Regsvr32 Activity + - Iceid asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/tests/endpoint/office_application_spawn_regsvr32_process.test.yml b/tests/endpoint/office_application_spawn_regsvr32_process.test.yml new file mode 100644 index 0000000000..aa9c3db3e4 --- /dev/null +++ b/tests/endpoint/office_application_spawn_regsvr32_process.test.yml @@ -0,0 +1,12 @@ +name: Office Application Spawn Regsvr32 process Unit Test +tests: +- name: Office Application Spawn Regsvr32 process + file: endpoint/office_application_spawn_regsvr32_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 1722daa5142a77d6ffe67c0ea963b421cb44ff0a Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 30 Jul 2021 17:33:42 +0200 Subject: [PATCH 04/28] icedid_mod_sig --- detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 260ccc4f77..1d8b4a3242 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -11,7 +11,7 @@ description: The following analytic identifies suspicious PowerShell script exec adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*" +search: '`powershell` EventCode=4104 (Message = "*SELECT*" OR Message = "*WMIC*") AND (Message = "*AntiVirusProduct*" OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' From 5de991e4616c7984b124a6dd4d820477df1399a0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 30 Jul 2021 17:46:06 +0200 Subject: [PATCH 05/28] icedid_mod_sig --- detections/endpoint/account_discovery_with_net_app.yml | 2 ++ detections/endpoint/nltest_domain_trust_discovery.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index d2ce13b87e..56fac3f698 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -29,9 +29,11 @@ known_false_positives: admin or power user may used this series of command. references: - https://labs.vipre.com/trickbot-and-its-modules/ - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html +- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/ tags: analytic_story: - Trickbot + - Icedid automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 0d28c474ab..e635d1c761 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -34,6 +34,7 @@ tags: analytic_story: - Ryuk Ransomware - Domain Trust Discovery + - Icedid asset_type: Endpoint automated_detection_testing: passed cis20: From 3f9c187e11fe22a5ff6823b43b5d58f5ac54ace0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 3 Aug 2021 13:00:06 +0200 Subject: [PATCH 06/28] icedid --- detections/endpoint/rundll32_dnsquery.yml | 63 +++++++++++++++++++ ...undll32_process_creating_exe_dll_files.yml | 63 +++++++++++++++++++ tests/endpoint/rundll32_dnsquery.test.yml | 12 ++++ ...32_process_creating_exe_dll_files.test.yml | 12 ++++ 4 files changed, 150 insertions(+) create mode 100644 detections/endpoint/rundll32_dnsquery.yml create mode 100644 detections/endpoint/rundll32_process_creating_exe_dll_files.yml create mode 100644 tests/endpoint/rundll32_dnsquery.test.yml create mode 100644 tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml new file mode 100644 index 0000000000..65c33ad50c --- /dev/null +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -0,0 +1,63 @@ +name: Rundll32 DNSQuery +id: f1483f5e-ee29-11eb-9d23-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe process having a http connection and do + a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload + will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. +search: '`sysmon` EventCode=22 process_name="rundll32.exe" + | stats count min(_time) as firstTime max(_time) as lastTime + by Image QueryName QueryStatus ProcessId direction Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_dnsquery_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and eventcode = 22 dnsquery executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://any.run/malware-trends/icedid +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - ProcessId + - direction + - Computer + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source: endpoint + - stage: Defense Evasion + message: rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker \ No newline at end of file diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml new file mode 100644 index 0000000000..8267b00feb --- /dev/null +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -0,0 +1,63 @@ +name: Rundll32 Process Creating Exe Dll Files +id: 6338266a-ee2a-11eb-bf68-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. + this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable + drop it either appdata or programdata as part of its execution. +search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",) + | stats count min(_time) as firstTime max(_time) as lastTime + by Image TargetFilename ProcessGuid dest user_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_process_creating_exe_dll_files_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, TargetFilename, and eventcode 11 executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://any.run/malware-trends/icedid +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - ProcessGuid + - dest + - user_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source: endpoint + - stage: Defense Evasion + message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/tests/endpoint/rundll32_dnsquery.test.yml b/tests/endpoint/rundll32_dnsquery.test.yml new file mode 100644 index 0000000000..66f19008ba --- /dev/null +++ b/tests/endpoint/rundll32_dnsquery.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 DNSQuery Unit Test +tests: +- name: Rundll32 DNSQuery + file: endpoint/rundll32_dnsquery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml b/tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml new file mode 100644 index 0000000000..594b075486 --- /dev/null +++ b/tests/endpoint/rundll32_process_creating_exe_dll_files.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 Process Creating Exe Dll Files Unit Test +tests: +- name: Rundll32 Process Creating Exe Dll Files + file: endpoint/rundll32_process_creating_exe_dll_files.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 51b72ea3b35bae5792efab7ec6f98744fafdaa44 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 3 Aug 2021 14:24:34 +0200 Subject: [PATCH 07/28] icedid --- .../winevent_scheduled_task_created_within_public_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 9e51610551..5312bb558b 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -46,6 +46,7 @@ tags: - Windows Persistence Techniques - Ransomware - Ryuk Ransomware + - Icedid automated_detection_testing: passed confidence: 100 context: From 8539d351da5bd5df19f5f01f300e177f500912cb Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 4 Aug 2021 11:49:52 +0200 Subject: [PATCH 08/28] icedid --- detections/endpoint/rundll32_createremotethread_in_browser.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 755c9df043..9eb6a9c0d9 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -9,7 +9,7 @@ datamodel: description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted browser process. -search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe") +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` From c7e8f72fa6099d2b468595365a905e44169db55e Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 5 Aug 2021 13:36:35 +0200 Subject: [PATCH 09/28] icedid --- .../endpoint/chcp_command_execution.yml | 70 +++++++++++++++++++ ...ate_remote_thread_in_shell_application.yml | 65 +++++++++++++++++ .../endpoint/drop_icedid_license_dat.yml | 57 +++++++++++++++ ...did_exfiltrated_archived_file_creation.yml | 61 ++++++++++++++++ .../endpoint/sqlite_module_in_temp_folder.yml | 63 +++++++++++++++++ .../endpoint/chcp_command_execution.test.yml | 14 ++++ ...emote_thread_in_shell_application.test.yml | 12 ++++ .../endpoint/drop_icedid_license_dat.test.yml | 12 ++++ ...xfiltrated_archived_file_creation.test.yml | 12 ++++ .../sqlite_module_in_temp_folder.test.yml | 12 ++++ 10 files changed, 378 insertions(+) create mode 100644 detections/endpoint/chcp_command_execution.yml create mode 100644 detections/endpoint/create_remote_thread_in_shell_application.yml create mode 100644 detections/endpoint/drop_icedid_license_dat.yml create mode 100644 detections/endpoint/icedid_exfiltrated_archived_file_creation.yml create mode 100644 detections/endpoint/sqlite_module_in_temp_folder.yml create mode 100644 tests/endpoint/chcp_command_execution.test.yml create mode 100644 tests/endpoint/create_remote_thread_in_shell_application.test.yml create mode 100644 tests/endpoint/drop_icedid_license_dat.test.yml create mode 100644 tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml create mode 100644 tests/endpoint/sqlite_module_in_temp_folder.test.yml diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml new file mode 100644 index 0000000000..e3ba5b05e0 --- /dev/null +++ b/detections/endpoint/chcp_command_execution.yml @@ -0,0 +1,70 @@ +name: CHCP Command Execution +id: 21d236ec-eec1-11eb-b23e-acde48001122 +version: 1 +date: '2021-07-27' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect execution of chcp.exe application. + this utility is used to change the active code page of the console. + This technique was seen in icedid malware to know the locale region/language/country of the compromise host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes + where Processes.process_name=chcp.com Processes.parent_process_name = cmd.exe + Processes.parent_process=*/c* by Processes.process_name Processes.process + Processes.parent_process_name Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `chcp_command_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. +known_false_positives: other tools or script may used this to change code page to UTF-* or others +references: +- https://ss64.com/nt/chcp.html +- https://twitter.com/tccontre18/status/1419941156633329665?s=20 +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - source: endpoint + - stage: recon + message: parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml new file mode 100644 index 0000000000..5236bd4f97 --- /dev/null +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -0,0 +1,65 @@ +name: Create Remote Thread In Shell Application +id: 10399c1e-f51e-11eb-b920-acde48001122 +version: 1 +date: '2021-08-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious process injection in command shell. + This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as + banking trojan. It is really uncommon to have a create remote thread execution in the following application. +search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") + | stats count min(_time) as firstTime max(_time) as lastTime + by TargetImage TargetProcessId SourceProcessId EventCode StartAddress SourceImage Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `create_remote_thread_in_shell_application_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source: endpoint + - stage: Defense Evasion + message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml new file mode 100644 index 0000000000..08e02852c3 --- /dev/null +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -0,0 +1,57 @@ +name: Drop IcedID License.dat +id: b7a045fc-f14a-11eb-8e79-acde48001122 +version: 1 +date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. + This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process + to do banking stealing. +search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") + |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_icedid_license_dat_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1204.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - source: endpoint + - stage: Execution + message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml new file mode 100644 index 0000000000..8b118ebb46 --- /dev/null +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -0,0 +1,61 @@ +name: IcedID Exfiltrated Archived File Creation +id: 0db4da70-f14b-11eb-8043-acde48001122 +version: 1 +date: '2021-07-30' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious file creation namely passff.tar and cookie.tar. + This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. +search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") + |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `icedid_exfiltrated_archived_file_creation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1560.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - TargetFilename + - EventCode + - process_id + - process_name + - Computer + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - source: endpoint + - stage: Collection + message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml new file mode 100644 index 0000000000..2678a0873e --- /dev/null +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -0,0 +1,63 @@ +name: Sqlite Module In Temp Folder +id: 0f216a38-f45f-11eb-b09c-acde48001122 +version: 1 +date: '2021-08-03' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder. + This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome + or firefox to stole browser information related to bank, credit card or credentials. +search: '`sysmon` EventCode= 11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") + |stats count min(_time) as firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId Image + process_id process_name Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `sqlite_module_in_temp_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.cisecurity.org/white-papers/security-primer-icedid/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - TargetFilename + - EventCode + - ProcessId + - Image + security_domain: endpoint + impact: 30 + confidence: 50 + # (impact * confidence)/100 + risk_score: 15 + context: + - source: endpoint + - stage: Collection + message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/tests/endpoint/chcp_command_execution.test.yml b/tests/endpoint/chcp_command_execution.test.yml new file mode 100644 index 0000000000..0b90e5e8bd --- /dev/null +++ b/tests/endpoint/chcp_command_execution.test.yml @@ -0,0 +1,14 @@ +name: CHCP Command Execution Unit Test +tests: +- name: CHCP Command Execution + file: endpoint/chcp_command_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + \ No newline at end of file diff --git a/tests/endpoint/create_remote_thread_in_shell_application.test.yml b/tests/endpoint/create_remote_thread_in_shell_application.test.yml new file mode 100644 index 0000000000..3d45529127 --- /dev/null +++ b/tests/endpoint/create_remote_thread_in_shell_application.test.yml @@ -0,0 +1,12 @@ +name: Create Remote Thread In Shell Application Unit Test +tests: +- name: Create Remote Thread In Shell Application + file: endpoint/create_remote_thread_in_shell_application.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/drop_icedid_license_dat.test.yml b/tests/endpoint/drop_icedid_license_dat.test.yml new file mode 100644 index 0000000000..06522fb413 --- /dev/null +++ b/tests/endpoint/drop_icedid_license_dat.test.yml @@ -0,0 +1,12 @@ +name: Drop IcedID License.dat Unit Test +tests: +- name: Drop IcedID License.dat + file: endpoint/drop_icedid_license_dat.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml b/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml new file mode 100644 index 0000000000..ee7cf5e8cf --- /dev/null +++ b/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml @@ -0,0 +1,12 @@ +name: IcedID Exfiltrated Archived File Creation Unit Test +tests: +- name: IcedID Exfiltrated Archived File Creation + file: detections/endpoint/icedid_exfiltrated_archived_file_creation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/sqlite_module_in_temp_folder.test.yml b/tests/endpoint/sqlite_module_in_temp_folder.test.yml new file mode 100644 index 0000000000..95206dbdc1 --- /dev/null +++ b/tests/endpoint/sqlite_module_in_temp_folder.test.yml @@ -0,0 +1,12 @@ +name: Sqlite Module In Temp Folder Unit Test +tests: +- name: Sqlite Module In Temp Folder + file: endpoint/sqlite_module_in_temp_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 6ccaf94f2f791ff865b7d130807039e421892d0a Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 5 Aug 2021 13:39:05 +0200 Subject: [PATCH 10/28] icedid --- .../endpoint/icedid_exfiltrated_archived_file_creation.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml b/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml index ee7cf5e8cf..4d11669497 100644 --- a/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml +++ b/tests/endpoint/icedid_exfiltrated_archived_file_creation.test.yml @@ -1,7 +1,7 @@ name: IcedID Exfiltrated Archived File Creation Unit Test tests: - name: IcedID Exfiltrated Archived File Creation - file: detections/endpoint/icedid_exfiltrated_archived_file_creation.yml + file: endpoint/icedid_exfiltrated_archived_file_creation.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 34377e6310a0c45add63fd427e5edf28393eb12c Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 5 Aug 2021 13:42:29 +0200 Subject: [PATCH 11/28] icedid --- tests/endpoint/drop_icedid_license_dat.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/drop_icedid_license_dat.test.yml b/tests/endpoint/drop_icedid_license_dat.test.yml index 06522fb413..f1bc61cd4f 100644 --- a/tests/endpoint/drop_icedid_license_dat.test.yml +++ b/tests/endpoint/drop_icedid_license_dat.test.yml @@ -1,6 +1,6 @@ -name: Drop IcedID License.dat Unit Test +name: Drop IcedID License dat Unit Test tests: -- name: Drop IcedID License.dat +- name: Drop IcedID License dat file: endpoint/drop_icedid_license_dat.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' From ede0bd767531a330382100b5cf1bf5a84eccf3b0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 5 Aug 2021 13:48:42 +0200 Subject: [PATCH 12/28] icedid --- detections/endpoint/drop_icedid_license_dat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index 08e02852c3..554714afe1 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -1,4 +1,4 @@ -name: Drop IcedID License.dat +name: Drop IcedID License dat id: b7a045fc-f14a-11eb-8e79-acde48001122 version: 1 date: '2021-07-30' From 4d47c30783381b0b468a1d067144fc2b1fb669e3 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 13:10:18 +0000 Subject: [PATCH 13/28] Added detection testing service results inRundll32 Create Remote Thread To A Process --- ...ll32_create_remote_thread_to_a_process.yml | 48 +++++++++---------- 1 file changed, 23 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index ec3808d37f..7904772b59 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -6,20 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process - . This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive - information the the compromised host. - browser process. +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe + process to cmd.exe process . This technique was seen in IcedID malware to execute + its malicious code in normal process for defense evasion and to steal sensitive + information the the compromised host. browser process. search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" - | stats count min(_time) as firstTime max(_time) as lastTime - by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `rundll32_create_remote_thread_to_a_process_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage + TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the SourceImage, TargetImage, and EventCode executions from your - endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the SourceImage, TargetImage, and EventCode executions from your endpoints + related to create remote thread or injecting codes. If you are using Sysmon, you + must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: - https://www.joesandbox.com/analysis/380662/0/html @@ -38,24 +36,24 @@ tags: - Splunk Cloud required_fields: - _time - - SourceImage - - TargetImage - - TargetProcessId - - SourceProcessId - - StartAddress - - EventCode - - Computer + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer security_domain: endpoint impact: 70 confidence: 80 - # (impact * confidence)/100 risk_score: 56 - context: - - source: endpoint + context: + - source: endpoint - stage: Defense Evasion - message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ + message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ + in host $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim @@ -63,4 +61,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From f9d9e07f7b8430ce1603099af4bf384473164528 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 13:34:25 +0000 Subject: [PATCH 14/28] Added detection testing service results inRundll32 CreateRemoteThread In Browser --- ...rundll32_createremotethread_in_browser.yml | 49 ++++++++++--------- 1 file changed, 25 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 9eb6a9c0d9..726f98cf62 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -6,19 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" - browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted - browser process. -search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") - | stats count min(_time) as firstTime max(_time) as lastTime - by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe + process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID + malware where it hooks the browser to parse banking information as user used the + targetted browser process. +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", + "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) + as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId + StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_createremotethread_in_browser_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the SourceImage, TargetImage, and EventCode executions from your - endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the SourceImage, TargetImage, and EventCode executions from your endpoints + related to create remote thread or injecting codes. If you are using Sysmon, you + must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: - https://www.joesandbox.com/analysis/380662/0/html @@ -37,28 +37,29 @@ tags: - Splunk Cloud required_fields: - _time - - SourceImage - - TargetImage - - TargetProcessId - - SourceProcessId - - StartAddress - - EventCode - - Computer + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer security_domain: endpoint impact: 70 confidence: 100 - # (impact * confidence)/100 risk_score: 70 - context: - - source: endpoint + context: + - source: endpoint - stage: Defense Evasion - message: rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ + message: rundl32 process $SourceImage$ create a remote thread to browser process + $TargetImage$ in host $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim - name: SourceImage type: process name role: - - Attacker \ No newline at end of file + - Attacker + automated_detection_testing: passed From 0fde378b6fcd3331a881a7ce4d508f5d8faeee0e Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 13:36:42 +0000 Subject: [PATCH 15/28] Added detection testing service results inRundll32 DNSQuery --- detections/endpoint/rundll32_dnsquery.yml | 43 ++++++++++++----------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index 65c33ad50c..71c47f352a 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -6,19 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious rundll32.exe process having a http connection and do - a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload - will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. -search: '`sysmon` EventCode=22 process_name="rundll32.exe" - | stats count min(_time) as firstTime max(_time) as lastTime - by Image QueryName QueryStatus ProcessId direction Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious rundll32.exe process having a http + connection and do a dns query in some web domain. This technique was seen in IcedID + malware where the rundll32 that execute its payload will contact amazon.com to check + internet connect and to communicate to its C&C server to download config and other + file component. +search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) + as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId direction + Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and eventcode = 22 dnsquery executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + logs with the process name and eventcode = 22 dnsquery executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: - https://any.run/malware-trends/icedid @@ -37,27 +37,28 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - QueryName - - QueryStatus - - ProcessId - - direction + - Image + - QueryName + - QueryStatus + - ProcessId + - direction - Computer security_domain: endpoint impact: 70 confidence: 80 - # (impact * confidence)/100 risk_score: 56 context: - - source: endpoint + - source: endpoint - stage: Defense Evasion - message: rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ + message: rundll32 process $process_name$ having a dns query to $QueryName$ in host + $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim - name: process_name type: process name role: - - Attacker \ No newline at end of file + - Attacker + automated_detection_testing: passed From de016c4686406d2261413a9b702dce56c93a07b2 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 13:45:14 +0000 Subject: [PATCH 16/28] Added detection testing service results inRundll32 Process Creating Exe Dll Files --- ...undll32_process_creating_exe_dll_files.yml | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index 8267b00feb..48cc4f7668 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -6,15 +6,14 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. - this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable - drop it either appdata or programdata as part of its execution. -search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",) - | stats count min(_time) as firstTime max(_time) as lastTime - by Image TargetFilename ProcessGuid dest user_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `rundll32_process_creating_exe_dll_files_filter`' +description: This search is to detect a suspicious rundll32 process that drops executable + (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries + to drop copy of itself in temp folder or download executable drop it either appdata + or programdata as part of its execution. +search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", + "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image + TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -37,22 +36,21 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - TargetFilename - - ProcessGuid - - dest - - user_id + - Image + - TargetFilename + - ProcessGuid + - dest + - user_id security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - - source: endpoint + - source: endpoint - stage: Defense Evasion message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim @@ -60,4 +58,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 7ac92524f1e991425b31c66869961a49159538ef Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:00:49 +0000 Subject: [PATCH 17/28] Added detection testing service results inSuspicious IcedID Rundll32 Cmdline --- .../suspicious_icedid_rundll32_cmdline.yml | 44 +++++++++---------- 1 file changed, 20 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index c8f30af051..4a7e38e572 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -6,24 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious rundll32.exe commandline to execute dll file. - This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted - dll payload which is the license.dat. +description: This search is to detect a suspicious rundll32.exe commandline to execute + dll file. This technique was seen in IcedID malware to load its payload dll with + the following parameter to load encrypted dll payload which is the license.dat. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*/i:* by Processes.process_name Processes.process - Processes.parent_process_name Processes.parent_process Processes.process_id - Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_icedid_rundll32_cmdline_filter`' + Processes.process=*/i:* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: limitted. this parameter is not commonly used by - windows application but can be used by the network operator. +known_false_positives: limitted. this parameter is not commonly used by windows application + but can be used by the network operator. references: - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ tags: @@ -41,25 +38,24 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest - - user + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user security_domain: endpoint impact: 70 confidence: 80 - # (impact * confidence)/100 risk_score: 56 context: - - source: endpoint + - source: endpoint - stage: Defense Evasion message: rundll32 process $process_name$ with commandline $process$ in host $dest$ observable: - - name: dest + - name: dest type: Hostname role: - Victim @@ -67,4 +63,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From e0b24a19844f1161e24a1f6469dc93f039639022 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:08:16 +0000 Subject: [PATCH 18/28] Added detection testing service results inSuspicious Rundll32 PluginInit --- .../suspicious_rundll32_plugininit.yml | 39 +++++++++---------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index 21b2d37c0a..236dd6679e 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -6,23 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious rundll32.exe process with plugininit parameter. - This technique is commonly seen in IceID malware to execute its initial dll stager to download another - payload to the compromised machine. +description: This search is to detect a suspicious rundll32.exe process with plugininit + parameter. This technique is commonly seen in IceID malware to execute its initial + dll stager to download another payload to the compromised machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*PluginInit* by Processes.process_name Processes.process - Processes.parent_process_name Processes.parent_process Processes.process_id - Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_rundll32_plugininit_filter`' + Processes.process=*PluginInit* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: third party application may used this dll export name to execute function. +known_false_positives: third party application may used this dll export name to execute + function. references: - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ tags: @@ -40,25 +38,24 @@ tags: - Splunk Cloud required_fields: - _time - - process_name + - process_name - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest - user security_domain: endpoint impact: 60 confidence: 70 - # (impact * confidence)/100 risk_score: 42 context: - - source: endpoint + - source: endpoint - stage: Defense Evasion message: rundll32 process $process_name$ with commandline $process$ in host $dest$ observable: - - name: dest + - name: dest type: Hostname role: - Victim @@ -66,4 +63,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 2b3346a7c59868b5c9f19150352f64984ca18799 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:09:32 +0000 Subject: [PATCH 19/28] Added detection testing service results inCreate Remote Thread In Shell Application --- ...ate_remote_thread_in_shell_application.yml | 45 +++++++++---------- 1 file changed, 22 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 5236bd4f97..38cd1190f8 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -6,19 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious process injection in command shell. - This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as - banking trojan. It is really uncommon to have a create remote thread execution in the following application. -search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") - | stats count min(_time) as firstTime max(_time) as lastTime - by TargetImage TargetProcessId SourceProcessId EventCode StartAddress SourceImage Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `create_remote_thread_in_shell_application_filter`' +description: This search is to detect suspicious process injection in command shell. + This technique was seen in IcedID where it execute cmd.exe process to inject its + shellcode as part of its execution as banking trojan. It is really uncommon to have + a create remote thread execution in the following application. +search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats + count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId + SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ @@ -37,24 +36,24 @@ tags: - Splunk Cloud required_fields: - _time - - SourceImage - - TargetImage - - TargetProcessId - - SourceProcessId - - StartAddress - - EventCode - - Computer + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer security_domain: endpoint impact: 70 confidence: 100 - # (impact * confidence)/100 risk_score: 70 - context: - - source: endpoint + context: + - source: endpoint - stage: Defense Evasion - message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ + message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ + in host $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim @@ -62,4 +61,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From ea12f5178331085440f1298d8910eb5bef26c0f1 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:10:58 +0000 Subject: [PATCH 20/28] Added detection testing service results inOffice Application Spawn Regsvr32 process --- ...ice_application_spawn_regsvr32_process.yml | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 4aa6627b89..ac10bc9de9 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -10,14 +10,13 @@ description: this detection was designed to identifies suspicious spawned proces of known MS office application due to macro or malicious code. this technique can be seen in so many malware like Icedid that used MS office as its weapon or attack vector to initially infect the machines. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") - Processes.process_name=regsvr32.exe by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name + = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") Processes.process_name=regsvr32.exe + by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_application_spawn_regsvr32_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -41,18 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.process_guid - - Processes.user - - Processes.dest + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.process_guid + - Processes.user + - Processes.dest security_domain: endpoint impact: 70 confidence: 90 - # (impact * confidence)/100 risk_score: 63 context: - Source:Endpoint @@ -62,4 +60,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 8c20f6fdb07e5bd1696c188bf233d3ec9ab5c3c5 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:11:56 +0000 Subject: [PATCH 21/28] Added detection testing service results inCHCP Command Execution --- .../endpoint/chcp_command_execution.yml | 46 +++++++++---------- 1 file changed, 22 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index e3ba5b05e0..6421bb3d36 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -6,23 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect execution of chcp.exe application. - this utility is used to change the active code page of the console. - This technique was seen in icedid malware to know the locale region/language/country of the compromise host. +description: This search is to detect execution of chcp.exe application. this utility + is used to change the active code page of the console. This technique was seen in + icedid malware to know the locale region/language/country of the compromise host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes - where Processes.process_name=chcp.com Processes.parent_process_name = cmd.exe - Processes.parent_process=*/c* by Processes.process_name Processes.process - Processes.parent_process_name Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `chcp_command_execution_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com + Processes.parent_process_name = cmd.exe Processes.parent_process=*/c* by Processes.process_name + Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id + Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. -known_false_positives: other tools or script may used this to change code page to UTF-* or others +known_false_positives: other tools or script may used this to change code page to + UTF-* or others references: - https://ss64.com/nt/chcp.html - https://twitter.com/tccontre18/status/1419941156633329665?s=20 @@ -41,25 +39,25 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest - user security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - - source: endpoint + - source: endpoint - stage: recon - message: parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ + message: parent process $parent_process_name$ spawning chcp process $process_name$ + with parent command line $parent_process$ observable: - - name: dest + - name: dest type: Hostname role: - Victim @@ -67,4 +65,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From a79f8718eb3a876bb8b1bbb4eecde4078bc19bb0 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:25:26 +0000 Subject: [PATCH 22/28] Added detection testing service results inIcedID Exfiltrated Archived File Creation --- ...did_exfiltrated_archived_file_creation.yml | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 8b118ebb46..a2f404f7bf 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -6,17 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious file creation namely passff.tar and cookie.tar. - This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. -search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") - |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `icedid_exfiltrated_archived_file_creation_filter`' +description: This search is to detect a suspicious file creation namely passff.tar + and cookie.tar. This files are possible archived of stolen browser information like + history and cookies in a compromised machine with IcedID. +search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename + = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by + TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://www.cisecurity.org/white-papers/security-primer-icedid/ @@ -35,22 +35,21 @@ tags: - Splunk Cloud required_fields: - _time - - TargetFilename - - EventCode - - process_id - - process_name - - Computer + - TargetFilename + - EventCode + - process_id + - process_name + - Computer security_domain: endpoint impact: 80 confidence: 90 - # (impact * confidence)/100 risk_score: 72 context: - - source: endpoint + - source: endpoint - stage: Collection message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim @@ -58,4 +57,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 442cbd978788d78295b550882b550b5dbd4a1304 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:26:02 +0000 Subject: [PATCH 23/28] Added detection testing service results inDrop IcedID License dat --- .../endpoint/drop_icedid_license_dat.yml | 24 +++++++++---------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index 554714afe1..f6aa872095 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -6,14 +6,13 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. - This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process - to do banking stealing. -search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") - |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id process_name Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `drop_icedid_license_dat_filter`' +description: This search is to detect dropping a suspicious file named as "license.dat" + in %appdata%. This behavior seen in latest IcedID malware that contain the actual + core bot that will be injected in other process to do banking stealing. +search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" + OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) + as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -39,14 +38,13 @@ tags: security_domain: endpoint impact: 70 confidence: 90 - # (impact * confidence)/100 risk_score: 63 - context: - - source: endpoint + context: + - source: endpoint - stage: Execution message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim @@ -54,4 +52,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 665a99e197afa27a06369f11694c812850fd173e Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 14:54:43 +0000 Subject: [PATCH 24/28] Added detection testing service results inSuspicious IcedID Regsvr32 Cmdline --- .../suspicious_icedid_regsvr32_cmdline.yml | 41 +++++++++---------- 1 file changed, 20 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml index 52fb962aa2..f9ecb7665b 100644 --- a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml @@ -6,22 +6,22 @@ author: Teoderick Contreras, type: batch datamodel: - Endpoint -description: this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. - This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader - that will download and decrypt the config payload. +description: this search is to detect a suspicious regsvr32 commandline "-s" to execute + a dll files. This technique was seen in IcedID malware to execute its initial downloader + dll that will download the 2nd stage loader that will download and decrypt the config + payload. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe - Processes.process=*-s* by Processes.process_name Processes.process Processes.parent_process_name - Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_icedid_regsvr32_cmdline_filter`' + Processes.process=*-s* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used. -known_false_positives: minimal. but network operator can use this application to load dll. +known_false_positives: minimal. but network operator can use this application to load + dll. references: - https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/ tags: @@ -39,25 +39,24 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest - user security_domain: endpoint impact: 70 confidence: 80 - # (impact * confidence)/100 risk_score: 56 context: - - source: endpoint + - source: endpoint - stage: Defense Evasion message: regsvr32 process $process_name$ with commandline $process$ in host $dest$ observable: - - name: dest + - name: dest type: Hostname role: - Victim @@ -65,4 +64,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 5e8393c3b7036205e9182dd820a685bc09d984f0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 5 Aug 2021 17:22:35 +0200 Subject: [PATCH 25/28] icedid --- detections/endpoint/sqlite_module_in_temp_folder.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index 2678a0873e..0d985ab25a 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -9,9 +9,8 @@ datamodel: description: This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder. This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome or firefox to stole browser information related to bank, credit card or credentials. -search: '`sysmon` EventCode= 11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") - |stats count min(_time) as firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId Image - process_id process_name Computer +search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") + |stats count min(_time) as firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sqlite_module_in_temp_folder_filter`' @@ -44,9 +43,9 @@ tags: - Image security_domain: endpoint impact: 30 - confidence: 50 + confidence: 30 # (impact * confidence)/100 - risk_score: 15 + risk_score: 9 context: - source: endpoint - stage: Collection From 4e3dc7fe9ce73e0ddda59a50dd9fcdb3a33f377b Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Aug 2021 15:43:52 +0000 Subject: [PATCH 26/28] Added detection testing service results inSqlite Module In Temp Folder --- .../endpoint/sqlite_module_in_temp_folder.yml | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index 0d985ab25a..b6ba9d0b2a 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -6,18 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder. - This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome - or firefox to stole browser information related to bank, credit card or credentials. -search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") - |stats count min(_time) as firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId Image - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious file creation of sqlite3.dll in + %temp% folder. This behavior was seen in IcedID malware where it download sqlite + module to parse browser database like for chrome or firefox to stole browser information + related to bank, credit card or credentials. +search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename + = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") |stats count min(_time) as + firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId + Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sqlite_module_in_temp_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://www.cisecurity.org/white-papers/security-primer-icedid/ @@ -36,22 +37,21 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - TargetFilename - - EventCode - - ProcessId + - process_name + - TargetFilename + - EventCode + - ProcessId - Image security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - - source: endpoint + - source: endpoint - stage: Collection message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ observable: - - name: Computer + - name: Computer type: Hostname role: - Victim @@ -59,4 +59,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From f7bb6e308d83ca4983f8c47bc00d405bb6f015f8 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 11 Aug 2021 20:32:46 -0600 Subject: [PATCH 27/28] Added detection testing service results inDetect HTML Help Renamed --- .../endpoint/detect_html_help_renamed.yml | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 9864d74ac2..4e4b474520 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -5,7 +5,7 @@ date: '2021-02-11' author: Michael Haag, Splunk type: batch datamodel: - - Endpoint +- Endpoint description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -21,12 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_html_help_renamed_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. references: @@ -49,7 +50,8 @@ tags: impact: 80 kill_chain_phases: - Actions on Objectives - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$. mitre_attack_id: - T1218.001 nist: @@ -80,11 +82,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path From dcfab01e14dfa8d496894b74d490ae5df436971b Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 12 Aug 2021 09:25:43 +0200 Subject: [PATCH 28/28] icedid --- detections/endpoint/chcp_command_execution.yml | 4 ++-- .../endpoint/create_remote_thread_in_shell_application.yml | 4 ++-- detections/endpoint/drop_icedid_license_dat.yml | 4 ++-- .../endpoint/icedid_exfiltrated_archived_file_creation.yml | 4 ++-- .../endpoint/rundll32_create_remote_thread_to_a_process.yml | 4 ++-- .../endpoint/rundll32_createremotethread_in_browser.yml | 4 ++-- detections/endpoint/rundll32_dnsquery.yml | 4 ++-- .../endpoint/rundll32_process_creating_exe_dll_files.yml | 4 ++-- detections/endpoint/sqlite_module_in_temp_folder.yml | 4 ++-- detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml | 4 ++-- detections/endpoint/suspicious_icedid_rundll32_cmdline.yml | 4 ++-- detections/endpoint/suspicious_rundll32_plugininit.yml | 4 ++-- 12 files changed, 24 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index 6421bb3d36..c0ad4f8398 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -52,8 +52,8 @@ tags: confidence: 30 risk_score: 9 context: - - source: endpoint - - stage: recon + - Source:Endpoint + - Stage:Recon message: parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ observable: diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 38cd1190f8..5d17290eba 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -48,8 +48,8 @@ tags: confidence: 100 risk_score: 70 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ observable: diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index f6aa872095..d24f1d64cc 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -40,8 +40,8 @@ tags: confidence: 90 risk_score: 63 context: - - source: endpoint - - stage: Execution + - Source:Endpoint + - Stage:Execution message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ observable: - name: Computer diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index a2f404f7bf..00e814410d 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -45,8 +45,8 @@ tags: confidence: 90 risk_score: 72 context: - - source: endpoint - - stage: Collection + - Source:Endpoint + - Stage:Collection message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ observable: - name: Computer diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 7904772b59..586997bf94 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -48,8 +48,8 @@ tags: confidence: 80 risk_score: 56 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ observable: diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 726f98cf62..99b0196e13 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -49,8 +49,8 @@ tags: confidence: 100 risk_score: 70 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ observable: diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index 71c47f352a..144a3da9d9 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -48,8 +48,8 @@ tags: confidence: 80 risk_score: 56 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ observable: diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index 48cc4f7668..632a090c88 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -46,8 +46,8 @@ tags: confidence: 100 risk_score: 80 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ observable: - name: Computer diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index b6ba9d0b2a..8d198240b5 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -47,8 +47,8 @@ tags: confidence: 30 risk_score: 9 context: - - source: endpoint - - stage: Collection + - Source:Endpoint + - Stage:Collection message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ observable: - name: Computer diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml index f9ecb7665b..5048ec2057 100644 --- a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml @@ -52,8 +52,8 @@ tags: confidence: 80 risk_score: 56 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: regsvr32 process $process_name$ with commandline $process$ in host $dest$ observable: - name: dest diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 4a7e38e572..904503751f 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -51,8 +51,8 @@ tags: confidence: 80 risk_score: 56 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: rundll32 process $process_name$ with commandline $process$ in host $dest$ observable: - name: dest diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index 236dd6679e..d178a04e46 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -51,8 +51,8 @@ tags: confidence: 70 risk_score: 42 context: - - source: endpoint - - stage: Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: rundll32 process $process_name$ with commandline $process$ in host $dest$ observable: - name: dest