From 51823d81d35ee0ce7ee7b660fe211733aac75071 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 5 Mar 2021 10:30:34 -0700 Subject: [PATCH 1/3] Sunburst malware renamed NOBELIUM Group Renaming Sunburst Malware to NOBELIUM Group --- baselines/previously_seen_running_windows_services.yml | 2 +- .../previously_seen_running_windows_services_update.yml | 2 +- .../detect_prohibited_applications_spawning_cmd_exe.yml | 2 +- .../malicious_powershell_process___encoded_command.yml | 2 +- .../endpoint/sc_exe_manipulating_windows_services.yml | 2 +- .../scheduled_task_deleted_or_created_via_cmd.yml | 2 +- .../schtasks_scheduling_job_on_remote_system.yml | 2 +- detections/endpoint/windows_adfind_exe.yml | 2 +- .../endpoint/first_time_seen_running_windows_service.yml | 2 +- .../sunburst_correlation_dll_and_network_event.yml | 2 +- detections/experimental/web/supernova_webshell.yml | 2 +- detections/network/detect_outbound_smb_traffic.yml | 2 +- detections/network/tor_traffic.yml | 2 +- stories/{sunburst_malware.yml => nobelium_group.yml} | 9 +++++---- 14 files changed, 18 insertions(+), 17 deletions(-) rename stories/{sunburst_malware.yml => nobelium_group.yml} (82%) diff --git a/baselines/previously_seen_running_windows_services.yml b/baselines/previously_seen_running_windows_services.yml index bc6496cf54..772f12e108 100644 --- a/baselines/previously_seen_running_windows_services.yml +++ b/baselines/previously_seen_running_windows_services.yml @@ -18,7 +18,7 @@ tags: analytic_story: - Orangeworm Attack Group - Windows Service Abuse - - Sunburst Malware + - NOBELIUM Group deployments: - 90 Day Baseline detections: diff --git a/baselines/previously_seen_running_windows_services_update.yml b/baselines/previously_seen_running_windows_services_update.yml index 9fada7ff36..e27de638bc 100644 --- a/baselines/previously_seen_running_windows_services_update.yml +++ b/baselines/previously_seen_running_windows_services_update.yml @@ -23,7 +23,7 @@ tags: analytic_story: - Orangeworm Attack Group - Windows Service Abuse - - Sunburst Malware + - NOBELIUM Group deployments: - Hourly Cache Updates detections: diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index 509d2c5873..71d6cfae28 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -27,7 +27,7 @@ tags: - Suspicious Command-Line Executions - Suspicious MSHTA Activity - Suspicious Zoom Child Processes - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index ae5c7cde68..d0716dd22c 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -25,7 +25,7 @@ references: [] tags: analytic_story: - Malicious PowerShell - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 1d634d0a46..87b24c5fd9 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -28,7 +28,7 @@ tags: - Orangeworm Attack Group - Windows Persistence Techniques - Disabling Security Tools - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 6041f950c7..d6fa8d8dca 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -25,7 +25,7 @@ references: [] tags: analytic_story: - DHS Report TA18-074A - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 445e44861c..7619cc7187 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -26,7 +26,7 @@ references: [] tags: analytic_story: - Lateral Movement - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index d83a5319bc..43796f1380 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -29,7 +29,7 @@ references: - https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html tags: analytic_story: - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml index 4e96c879de..83b31906f8 100644 --- a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml +++ b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Windows Service Abuse - Orangeworm Attack Group - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint cis20: - CIS 2 diff --git a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml index fac0c15d6f..e942474d48 100644 --- a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml +++ b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml @@ -23,7 +23,7 @@ references: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html tags: analytic_story: - - Sunburst Malware + - NOBELIUM Group asset_type: Windows cis20: - CIS 6 diff --git a/detections/experimental/web/supernova_webshell.yml b/detections/experimental/web/supernova_webshell.yml index fc8f34a6dd..7ddfa8f635 100644 --- a/detections/experimental/web/supernova_webshell.yml +++ b/detections/experimental/web/supernova_webshell.yml @@ -23,7 +23,7 @@ references: - https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/ tags: analytic_story: - - Sunburst Malware + - NOBELIUM Group cis20: - CIS 4 - CIS 13 diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index f501f5e6ab..ba9a8ffd97 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -41,7 +41,7 @@ tags: analytic_story: - Hidden Cobra Malware - DHS Report TA18-074A - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint cis20: - CIS 12 diff --git a/detections/network/tor_traffic.yml b/detections/network/tor_traffic.yml index cc8a33a88f..469ca3e1d0 100644 --- a/detections/network/tor_traffic.yml +++ b/detections/network/tor_traffic.yml @@ -26,7 +26,7 @@ tags: - Prohibited Traffic Allowed or Protocol Mismatch - Ransomware - Command and Control - - Sunburst Malware + - NOBELIUM Group asset_type: Endpoint cis20: - CIS 9 diff --git a/stories/sunburst_malware.yml b/stories/nobelium_group.yml similarity index 82% rename from stories/sunburst_malware.yml rename to stories/nobelium_group.yml index 69bc44d62b..c9e0f60c23 100644 --- a/stories/sunburst_malware.yml +++ b/stories/nobelium_group.yml @@ -1,6 +1,6 @@ -name: Sunburst Malware +name: NOBELIUM Group id: 758196b5-2e21-424f-a50c-6e421ce926c2 -version: 1 +version: 2 date: '2020-12-14' author: Patrick Bareiss, Splunk type: batch @@ -9,16 +9,17 @@ description: Sunburst is a trojanized updates to SolarWinds Orion IT monitoring this campaign gained access to numerous public and private organizations around the world. narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures - (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the + (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. references: +- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ tags: - analytic_story: Sunburst Malware + analytic_story: NOBELIUM Group category: - Adversary Tactics product: From e6ce96e5a176bfc1e12c92cf3ecaf3c7f82caf8b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 5 Mar 2021 13:10:59 -0700 Subject: [PATCH 2/3] Detect Mimikatz Using Loaded Images --- .../endpoint/detect_mimikatz_using_loaded_images.yml | 2 +- .../detect_rundll32_inline_hta_execution.yml | 1 + stories/nobelium_group.yml | 2 +- .../detect_mimikatz_using_loaded_images.test.yml | 12 ++++++++++++ 4 files changed, 15 insertions(+), 2 deletions(-) create mode 100644 tests/endpoint/detect_mimikatz_using_loaded_images.test.yml diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 65b460710f..a683f8a317 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -20,7 +20,7 @@ how_to_implement: This search needs Sysmon Logs and a sysmon configuration, whic with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: Other tools can import the same DLLs. These tools should be - part of a whitelist. + part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. references: - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html tags: diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 0bf9d3d37a..6b047592f2 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Suspicious MSHTA Activity + - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/stories/nobelium_group.yml b/stories/nobelium_group.yml index c9e0f60c23..4f953ee032 100644 --- a/stories/nobelium_group.yml +++ b/stories/nobelium_group.yml @@ -2,7 +2,7 @@ name: NOBELIUM Group id: 758196b5-2e21-424f-a50c-6e421ce926c2 version: 2 date: '2020-12-14' -author: Patrick Bareiss, Splunk +author: Patrick Bareiss, Michael Haag, Splunk type: batch description: Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind diff --git a/tests/endpoint/detect_mimikatz_using_loaded_images.test.yml b/tests/endpoint/detect_mimikatz_using_loaded_images.test.yml new file mode 100644 index 0000000000..17f93b292c --- /dev/null +++ b/tests/endpoint/detect_mimikatz_using_loaded_images.test.yml @@ -0,0 +1,12 @@ +name: Detect Mimikatz Using Loaded Images Unit Test +tests: +- name: Detect Mimikatz Using Loaded Images + file: endpoint/detect_mimikatz_using_loaded_images.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 2e68a791494f4557a5d29753ef41615724425348 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 5 Mar 2021 20:31:06 +0000 Subject: [PATCH 3/3] Added detection testing service results inDetect Mimikatz Using Loaded Images --- detections/endpoint/detect_mimikatz_using_loaded_images.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index a683f8a317..bb4b888db7 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -20,7 +20,8 @@ how_to_implement: This search needs Sysmon Logs and a sysmon configuration, whic with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: Other tools can import the same DLLs. These tools should be - part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. + part of a whitelist. False positives may be present with any process that authenticates + or uses credentials, PowerShell included. Filter based on parent process. references: - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html tags: @@ -44,3 +45,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log