Branch was auto-updated.

detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -8,7 +8,7 @@ datamodel:
 - Endpoint_Processes
 description: The following analytic identifies native living off the land binaries within the Windows
   operating system that may be abused by adversaries by moving it to a new directory.
-  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
+  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
 search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
   "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
   "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
@@ -16,13 +16,13 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmd.exe" OR 
-  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="csc.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
-  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="explorer.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
-  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="hh.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
+  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
+  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
   process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
   process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
-  process_name="reg.exe" OR process_name="regedit.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
+  process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 
   | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
@@ -88,4 +88,4 @@ tags:
   risk_score: 49
   risk_severity: medium
   security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml

@@ -1,21 +1,23 @@
-name: Detect Dump LSASS Memory using comsvcs
+name: Windows Rundll32 Comsvcs Memory Dump
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
-version: 2
-date: '2021-11-29'
+version: 4
+date: '2022-04-14'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
 - Endpoint_Processes
-description: The following analytic identifies credential dumping using comsvcs.dll
-  with `regsvr32.exe`. This technique is common with adversaries who would like to
-  dump the memory of lsass.exe and perform offline password cracking.
+description: The following analytic identifies memory dumping using comsvcs.dll with the minidump function
+  with `rundll32.exe`. This technique is common with adversaries who would like to
+  dump the memory of lsass.exe.
 search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
   "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
   "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
   null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
   "event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT
-  NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
+  NULL AND process_name LIKE "%rundll32.exe%"
+  AND match_regex(process, /(?i)MiniDump[\s;]+/)=true
+  AND match_regex(process, /(?i)comsvcs.dll\s+/)=true 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
   body=create_map(["event_id", event_id, "process_name", process_name, "process",
   process]) | into write_ssa_detected_events();'
@@ -30,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - Suspicious Rundll32 Activity
   asset_type: Endpoint
   cis20:
   - CIS 8
@@ -41,10 +44,10 @@ tags:
   - Stage:Credential Access
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
-  impact: 70
+  impact: 40
   kill_chain_phases:
   - Actions on Objectives
-  message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$
+  message: A dump of a process was attempted using comsvcs.dll with the minidump function on endpoint $dest_device_id$
     by user $dest_device_user$.
   mitre_attack_id:
   - T1003.003
@@ -68,6 +71,6 @@ tags:
   - _time
   - dest_device_id
   - process
-  risk_score: 70
+  risk_score: 40
   risk_severity: medium
   security_domain: endpoint

tests/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.test.yml

@@ -1,7 +1,7 @@
-name: Detect Dump LSASS Memory using comsvcs Unit Test
+name: Windows Rundll32 Comsvcs Memory Dump Unit Test
 tests:
-- name: Detect Dump LSASS Memory using comsvcs
-  file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+- name: Windows Rundll32 Comsvcs Memory Dump
+  file: endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
   pass_condition: '@count_gt(0)'
   description: Test credential dumping detections
   attack_data: