Branch was auto-updated.

detections/endpoint/windows_disable_memory_crash_dump.yml

@@ -0,0 +1,92 @@
+name: Windows Disable Memory Crash Dump
+id: 59e54602-9680-11ec-a8a6-acde48001122
+version: 1
+date: '2022-02-25'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper.
+  To disable crash dumps, the value must be set to 0. 
+  This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check).
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid Registry.registry_key_name  | `drop_dm_object_name(Registry)`
+  |join process_guid [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)`  | fields _time dest user parent_process_name parent_process process_name
+  process_path process process_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process process_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `windows_disable_memory_crash_dump_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node.
+known_false_positives: unknown
+references:
+  - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+  - https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
+tags:
+  analytic_story:
+  - Data Destruction
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1485
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time 
+  - Filesystem.process_id 
+  - Filesystem.file_name 
+  - Filesystem.user 
+  - Filesystem.file_path 
+  - Filesystem.dest
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid
+  security_domain: endpoint
+  impact: 90
+  confidence: 100 
+  # (impact * confidence)/100
+  risk_score: 90
+  context: 
+  - Source:Endpoint
+  - Stage:Persistence
+  - Privilege Escalation
+  message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16 

tests/endpoint/windows_disable_memory_crash_dump.test.yml

@@ -0,0 +1,12 @@
+name: Windows Disable Memory Crash Dump Unit Test
+tests:
+- name: Windows Disable Memory Crash Drump
+  file: endpoint/windows_disable_memory_crash_dump.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog