admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-03 09:36:20 -08:00
committed by GitHub
parent 6418569b7c e0a51669dc
commit 9630754ef4
53 changed files with 2863 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
+2 -2
View File
@@ -457,10 +457,10 @@ jobs:
- name: Enrich detections with TAs
env:
GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_ACCESS_TOKEN }}
GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
source venv/bin/activate
python3 -m pip install security_content_automation/requirements.txt
python3 -m pip install -r security_content_automation/requirements.txt
python3 security_content_automation/enrich_detections.py
- name: Make YAMLs Pretty
detections/endpoint/cmd_carry_out_string_command_parameter.yml
+1
View File
@@ -33,6 +33,7 @@ tags:
- IcedID
- Log4Shell CVE-2021-44228
- WhisperGate
- Hermetic Wiper
automated_detection_testing: passed
confidence: 50
context:
detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+1
View File
@@ -32,6 +32,7 @@ tags:
analytic_story:
- Active Directory Lateral Movement
- Trickbot
- Hermetic Wiper
automated_detection_testing: passed
confidence: 100
context:
detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+1
View File
@@ -38,6 +38,7 @@ tags:
- XMRig
- Remcos
- WhisperGate
- Hermetic Wiper
automated_detection_testing: passed
confidence: 70
context:
detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
+1
View File
@@ -32,6 +32,7 @@ tags:
analytic_story:
- Suspicious Regsvr32 Activity
- Remcos
- Hermetic Wiper
automated_detection_testing: passed
confidence: 60
context:
detections/endpoint/ssa___windows_bits_job_persistence.yml
+91
View File
@@ -0,0 +1,91 @@
name: Windows Bits Job Persistence
id: 1e25e97a-8ea4-11ec-9767-acde48001122
version: 1
date: '2022-02-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
The query identifies the parameters used to create, resume or add a file to a BITS
job. Typically seen combined in a oneliner or ran in sequence. If identified, review
the BITS job created and capture any files written to disk. It is possible for BITS
to be used to upload files and this may require further network data analysis to
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line, "%setnotifyflags%")
OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line, "%setminretrydelay%") OR like (cmd_line,
"%setcustomheaders%") OR like (cmd_line, "%resume%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
tags:
analytic_story:
- BITS Jobs
- Living Off The Land
automated_detection_testing: passed
confidence: 80
context:
- Source:Endpoint
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
mitre_attack_id:
- T1197
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 56
security_domain: endpoint
detections/endpoint/ssa___windows_bitsadmin_download_file.yml
+96
View File
@@ -0,0 +1,96 @@
name: Windows Bitsadmin Download File
id: d76e8188-8f5a-11ec-ace4-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
object. In addition, look for `download` or `upload` on the command-line, the switches
are not required to perform a transfer. Capture any files downloaded. Review the
reputation of the IP or domain used. Typically once executed, a follow on command
will be used to execute the dropped file. Note that the network connection or file
modification events related will not spawn or create from `bitsadmin.exe`, but the
artifacts will appear in a parallel process of `svchost.exe` with a command-line
similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
and child processes to capture any behaviors and artifacts. In some suspicious and
malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
to list out the jobs during investigation.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
tags:
analytic_story:
- Ingress Tool Transfer
- BITS Jobs
- DarkSide Ransomware
- Living Off The Land
automated_detection_testing: passed
confidence: 70
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1197
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 49
security_domain: endpoint
detections/endpoint/ssa___windows_certutil_decode_file.yml
+90
View File
@@ -0,0 +1,90 @@
name: Windows CertUtil Decode File
id: b06983f4-8f72-11ec-ab50-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
file that was downloaded. Once decoded, it will be loaded by a parallel process.
Note that there are two additional command switches that may be used - `encodehex`
and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
further execution. During triage, identify the source of the file being decoded.
Review its contents or execution behavior for further analysis.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%decode%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Typically seen used to `encode` files, but it is possible to
see legitimate use of `decode`. Filter based on parent-child relationship, file
paths, endpoint or user.
references:
- https://attack.mitre.org/techniques/T1140/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
tags:
analytic_story:
- Deobfuscate-Decode Files or Information
- Living Off The Land
automated_detection_testing: passed
confidence: 80
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
impact: 50
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file on disk.
mitre_attack_id:
- T1140
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 40
security_domain: endpoint
detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+87
View File
@@ -0,0 +1,87 @@
name: Windows CertUtil URLCache Download
id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Certutil.exe may download a file from a remote destination using `-urlcache`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%urlcache%"))
| eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Command and Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
impact: 90
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 90
security_domain: endpoint
detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
+88
View File
@@ -0,0 +1,88 @@
name: Windows CertUtil VerifyCtl Download
id: 9ac29c40-8f6b-11ec-b19a-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
\ During triage, capture any files on disk and review. Review the reputation of
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%verifyctl%"))
| eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Command and Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
impact: 90
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 90
security_domain: endpoint
detections/endpoint/ssa___windows_mshta_child_process.yml
+90
View File
@@ -0,0 +1,90 @@
name: Windows MSHTA Child Process
id: f63f7e9c-9526-11ec-9fc7-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies child processes spawning from "mshta.exe".
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, parent process
"mshta.exe" and its child process.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR process_name="cmd.exe" OR
process_name="scrcons.exe" OR process_name="colorcpl.exe" OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1218.005
- T1218
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
security_domain: endpoint
impact: 80
confidence: 100
# (impact * confidence)/100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to
download an additional payload.
nist:
- PR.PT
- DE.CM
cis20:
- CIS 8
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
detections/endpoint/ssa___windows_mshta_command_line_url.yml
+93
View File
@@ -0,0 +1,93 @@
name: Windows MSHTA Command-Line URL
id: 9b35c538-94ef-11ec-9439-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
utility is used to make remote http connections. Adversaries may use mshta.exe to
proxy the download and execution of remote .hta files. The analytic identifies command
line arguments of http and https being used. This technique is commonly used by
malicious software to bypass preventative controls. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "rundll32.exe" and its parent process.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: It is possible legitimate applications may perform this behavior
and will need to be filtered.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1218.005
- T1218
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
security_domain: endpoint
impact: 80
confidence: 100
# (impact * confidence)/100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to
download an additional payload.
nist:
- PR.PT
- DE.CM
cis20:
- CIS 8
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml
+91
View File
@@ -0,0 +1,91 @@
name: Windows MSHTA Inline HTA Execution
id: 24962154-9524-11ec-9333-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies "mshta.exe" execution with inline protocol
handlers. "JavaScript", "VBScript", and "About" are the only supported options when
invoking HTA content directly on the command-line. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "mshta.exe" and its parent process.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, "%about%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1218.005
- T1218
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
security_domain: endpoint
impact: 80
confidence: 100
# (impact * confidence)/100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, indicative of defense
evasion.
nist:
- PR.PT
- DE.CM
cis20:
- CIS 8
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+88
View File
@@ -0,0 +1,88 @@
name: Windows PowerShell Start-BitsTransfer
id: 0bafd086-8f61-11ec-996e-acde48001122
version: 1
date: '2022-02-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
functionality is present. This technique variation is not as commonly used by adversaries,
but has been abused in the past. Lesser known uses include the ability to set the
`-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
is used, it is highly possible files will be archived. During triage, review parallel
processes and process lineage. Capture any files on disk and review. For the remote
domain or IP, what is the reputation?
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
(cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Limited false positives. It is possible administrators will
utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
process or command-line arguments.
references:
- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
tags:
analytic_story:
- BITS Jobs
- Living Off The Land
automated_detection_testing: passed
cis20: []
confidence: 70
context:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1197
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 49
security_domain: endpoint
detections/endpoint/ssa___windows_rasautou_dll_execution.yml
+79
View File
@@ -0,0 +1,79 @@
name: Windows Rasautou DLL Execution
id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
version: 1
date: '2022-02-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability.
During triage, review parent and child process behavior including file and image loads.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
references:
- https://github.com/mandiant/DueDLLigence
- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Living Off The Land
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1055.001
- T1218
- T1055
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
security_domain: endpoint
impact: 80
confidence: 100
# (impact * confidence)/100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml
+97
View File
@@ -0,0 +1,97 @@
name: Windows Rundll32 Inline HTA Execution
id: 0caa1dd6-94f5-11ec-9786-acde48001122
version: 1
date: '2022-02-23'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies "rundll32.exe" execution with inline
protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
options when invoking HTA content directly on the command-line. This type of behavior
is commonly observed with fileless malware or application whitelisting bypass techniques.
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, process
"rundll32.exe" and its parent process.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe" AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, "%about%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
tags:
analytic_story:
- Suspicious MSHTA Activity
- NOBELIUM Group
- Living Off The Land
asset_type: Endpoint
automated_detection_testing: passed
cis20:
- CIS 8
confidence: 80
context:
- Source:Endpoint
- Stage:Initial Access
- Stage:Execution
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: Suspicious $process_name$ inline HTA execution on $dest_device_id$.
mitre_attack_id:
- T1218
- T1218.005
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 56
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
detections/endpoint/suspicious_process_file_path.yml
+1
View File
@@ -35,6 +35,7 @@ tags:
- XMRig
- Remcos
- WhisperGate
- Hermetic Wiper
automated_detection_testing: passed
confidence: 50
context:
detections/endpoint/windows_disable_memory_crash_dump.yml
+93
View File
@@ -0,0 +1,93 @@
name: Windows Disable Memory Crash Dump
id: 59e54602-9680-11ec-a8a6-acde48001122
version: 1
date: '2022-02-25'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper.
To disable crash dumps, the value must be set to 0.
This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check).
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)`
|join process_guid [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` | fields _time dest user parent_process_name parent_process process_name
process_path process process_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process process_guid registry_path registry_value_name registry_value_data
registry_key_name | `windows_disable_memory_crash_dump_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node.
known_false_positives: unknown
references:
- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
- https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
tags:
analytic_story:
- Data Destruction
- Ransomware
- Hermetic Wiper
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1485
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Filesystem.file_create_time
- Filesystem.process_id
- Filesystem.file_name
- Filesystem.user
- Filesystem.file_path
- Filesystem.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
security_domain: endpoint
impact: 90
confidence: 100
# (impact * confidence)/100
risk_score: 90
context:
- Source:Endpoint
- Stage:Persistence
- Privilege Escalation
message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$.
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
nist:
- DE.CM
cis20:
- CIS 3
- CIS 5
- CIS 16
detections/endpoint/windows_file_without_extension_in_critical_folder.yml
+1
View File
@@ -35,6 +35,7 @@ references:
tags:
analytic_story:
- Data Destruction
- Hermetic Wiper
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
kill_chain_phases:
detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+72
View File
@@ -0,0 +1,72 @@
name: Windows Modify Show Compress Color And Info Tip Registry
id: b7548c2e-9a10-11ec-99e3-acde48001122
version: 1
date: '2022-03-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is to look for suspicious registry modification related to file compression color and information tips.
This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS
file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions
related to file compression attribution in terms of color in NTFS file system.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*"
AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data
| `windows_modify_show_compress_color_and_info_tip_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
known_false_positives: unknown
references:
- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Hermetic Wiper
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
security_domain: endpoint
impact: 50
confidence: 50
# (impact * confidence)/100
risk_score: 25
context:
- Source:Endpoint
- Stage:Defense Evasion
message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$
observable:
- name: dest
type: Endpoint
role:
- Victim
nist:
- DE.CM
cis20:
- CIS 3
- CIS 5
- CIS 16
detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
+1
View File
@@ -26,6 +26,7 @@ references:
tags:
analytic_story:
- Data Destruction
- Hermetic Wiper
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
kill_chain_phases:
detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+1
View File
@@ -27,6 +27,7 @@ references:
tags:
analytic_story:
- WhisperGate
- Hermetic Wiper
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log
kill_chain_phases:
detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
+73
View File
@@ -0,0 +1,73 @@
name: TCP Command and Scripting Interpreter Outbound LDAP Traffic
id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449
version: 1
date: '2022-02-17'
author: Jose Hernandez, Michael Haag, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"), "collection<string>", [])[0]
| where dest_port=389 OR dest_port=1389 OR dest_port=636
| where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port, "dest_ip", dest_ip])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on network traffic, specifically data that populates the Network_Traffic datamodel.
To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic events.
known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate.
references:
- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a
tags:
analytic_story:
- Log4Shell CVE-2021-44228
cis20:
- CIS 13
confidence: 70
context:
- Scope:Outbound
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
impact: 50
kill_chain_phases:
- Execution
message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$
mitre_attack_id:
- T1059
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
risk_severity: low
security_domain: network
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
Vendored
+8 -10
View File
@@ -20,20 +20,18 @@ references:
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
that warrants investigating.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"),
"string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"),
"string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"),
"string", null) | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
| where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
Vendored
+99
View File
@@ -0,0 +1,99 @@
author: Jose Hernandez, Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-17'
description: Malicious actors often abuse misconfigured LDAP servers or applications
that use the LDAP servers in organizations. Outbound LDAP traffic should not be
allowed outbound through your perimeter firewall. This search will help determine
if you have any LDAP connections to IP addresses outside of private (RFC1918) address
space.
how_to_implement: To successfully implement this search you need to be ingesting information
on network traffic, specifically data that populates the Network_Traffic datamodel.
To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic
events.
id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449
known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
allowed outbound through your perimeter firewall. Please check those servers to
verify if the activity is legitimate.
name: TCP Command and Scripting Interpreter Outbound LDAP Traffic
product:
- Splunk Behavioral Analytics
references:
- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a
risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting
to dest ip $dest_ip$
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event,
"event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"),
"collection<string>", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636
| where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip,
cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port,
"dest_ip", dest_ip]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Log4Shell CVE-2021-44228
cis20:
- CIS 13
confidence: 70
context:
- Scope:Outbound
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
impact: 50
kill_chain_phases:
- Execution
message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting
to dest ip $dest_ip$
mitre_attack_id:
- T1059
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
risk_severity: low
security_domain: network
test:
name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
file_name: pantraffic.txt
source: pan:traffic
sourcetype: pan:traffic
description: Test PAN Traffic Logs LDAP outbound connection
file: network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
name: PAN Traffic Logs
pass_condition: '@count_gt(0)'
type: Anomaly
version: 1
dist/ssa/srs/ssa___windows_bits_job_persistence.yml
Vendored
+106
View File
@@ -0,0 +1,106 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-15'
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
The query identifies the parameters used to create, resume or add a file to a BITS
job. Typically seen combined in a oneliner or ran in sequence. If identified, review
the BITS job created and capture any files written to disk. It is possible for BITS
to be used to upload files and this may require further network data analysis to
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 1e25e97a-8ea4-11ec-9767-acde48001122
known_false_positives: Limited false positives will be present. Typically, applications
will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
(legitimate applications) or parent process.
name: Windows Bits Job Persistence
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1197/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line,
"%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line,
"%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line,
"%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
tags:
analytic_story:
- BITS Jobs
- Living Off The Land
automated_detection_testing: passed
confidence: 80
context:
- Source:Endpoint
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
mitre_attack_id:
- T1197
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 56
risk_severity: medium
security_domain: endpoint
test:
name: Windows Bits Job Persistence Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
file_name: bits-windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_bits_job_persistence.yml
name: Windows Bits Job Persistence
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
Vendored
+110
View File
@@ -0,0 +1,110 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-16'
description: The following query identifies Microsoft Background Intelligent Transfer
Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
object. In addition, look for `download` or `upload` on the command-line, the switches
are not required to perform a transfer. Capture any files downloaded. Review the
reputation of the IP or domain used. Typically once executed, a follow on command
will be used to execute the dropped file. Note that the network connection or file
modification events related will not spawn or create from `bitsadmin.exe`, but the
artifacts will appear in a parallel process of `svchost.exe` with a command-line
similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel
and child processes to capture any behaviors and artifacts. In some suspicious and
malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
to list out the jobs during investigation.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: d76e8188-8f5a-11ec-ace4-acde48001122
known_false_positives: Limited false positives, however it may be required to filter
based on parent process name or network connection.
name: Windows Bitsadmin Download File
product:
- Splunk Behavioral Analytics
references:
- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe"
AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Ingress Tool Transfer
- BITS Jobs
- DarkSide Ransomware
- Living Off The Land
automated_detection_testing: passed
confidence: 70
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1197
- T1105
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 49
risk_severity: low
security_domain: endpoint
test:
name: Windows Bitsadmin Download File Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
file_name: bits-windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_bitsadmin_download_file.yml
name: Windows Bitsadmin Download File
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_certutil_decode_file.yml
Vendored
+106
View File
@@ -0,0 +1,106 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-16'
description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
file that was downloaded. Once decoded, it will be loaded by a parallel process.
Note that there are two additional command switches that may be used - `encodehex`
and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
further execution. During triage, identify the source of the file being decoded.
Review its contents or execution behavior for further analysis.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: b06983f4-8f72-11ec-ab50-acde48001122
known_false_positives: Typically seen used to `encode` files, but it is possible to
see legitimate use of `decode`. Filter based on parent-child relationship, file
paths, endpoint or user.
name: Windows CertUtil Decode File
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1140/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
on disk.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Deobfuscate-Decode Files or Information
- Living Off The Land
automated_detection_testing: passed
confidence: 80
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
impact: 50
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file
on disk.
mitre_attack_id:
- T1140
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 40
risk_severity: low
security_domain: endpoint
test:
name: Windows CertUtil Decode File Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
file_name: windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_certutil_decode_file.yml
name: Windows CertUtil Decode File
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
Vendored
+101
View File
@@ -0,0 +1,101 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-16'
description: Certutil.exe may download a file from a remote destination using `-urlcache`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
During triage, capture any files on disk and review. Review the reputation of the
remote IP or domain in question.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: 8cb1ad38-8f6d-11ec-87a3-acde48001122
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
name: Windows CertUtil URLCache Download
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
"%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Command and Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
impact: 90
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 90
risk_severity: high
security_domain: endpoint
test:
name: Windows CertUtil URLCache Download Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
file_name: T1105-windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_certutil_urlcache_download.yml
name: Windows CertUtil URLCache Download
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
Vendored
+102
View File
@@ -0,0 +1,102 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-16'
description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
This behavior does require a URL to be passed on the command-line. In addition,
`-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
be used. It is not entirely common for `certutil.exe` to contact public IP space.
\ During triage, capture any files on disk and review. Review the reputation of
the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
id: 9ac29c40-8f6b-11ec-b19a-acde48001122
known_false_positives: Limited false positives in most environments, however tune
as needed based on parent-child relationship or network connection.
name: Windows CertUtil VerifyCtl Download
product:
- Splunk Behavioral Analytics
references:
- https://attack.mitre.org/techniques/T1105/
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe"
AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line,
"%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Ingress Tool Transfer
- DarkSide Ransomware
- Living Off The Land
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Command and Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
impact: 90
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 90
risk_severity: high
security_domain: endpoint
test:
name: Windows CertUtil VerifyCtl Download Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
file_name: T1105-windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_certutil_verifyctl_download_.yml
name: Windows CertUtil VerifyCtl Download
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
Vendored
+99
View File
@@ -0,0 +1,99 @@
author: Lou Stella, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-17'
description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
It has a scripting mode intended for complex scripted backup operations. This feature
also allows for execution of arbitrary unsigned code. This analytic looks for the
usage of the scripting mode flags in executions of DiskShadow. During triage, compare
to known backup behavior in your environment and then review the scripts called
by diskshadow.
how_to_implement: To successfully implement this search you need to be ingesting information
on processes that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
id: aa502688-9037-11ec-842d-acde48001122
known_false_positives: Administrators using the DiskShadow tool in their infrastructure
as a main backup tool with scripts will cause false positives
name: Windows Diskshadow Proxy Execution
product:
- Splunk Behavioral Analytics
references:
- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe"
AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Living Off The Land
cis20:
- CIS 8
confidence: 70
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
mitre_attack_id:
- T1218
nist:
- DE.CM
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: User
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 49
risk_severity: low
security_domain: endpoint
test:
name: BA Windows Diskshadow Proxy Execution Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log
file_name: windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_diskshadow_proxy_execution.yml
name: BA Windows Diskshadow Proxy Execution
pass_condition: '@count_gt(0)'
type: Anomaly
version: 1
dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
Vendored
+99
View File
@@ -0,0 +1,99 @@
author: Lou Stella, Splunk
datamodel:
- Endpoint_Registry
date: '2022-02-18'
description: The following search identifies Eventvwr bypass by identifying the registry
modification into a specific path that eventvwr.msc looks to (but is not valid)
upon execution. A successful attack will include a suspicious command to be executed
upon eventvwr.msc loading. Upon triage, review the parallel processes that have
executed. Identify any additional registry modifications on the endpoint that may
look suspicious. Remediate as necessary.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Registry` datamodel.
id: 66adff66-90d9-11ec-aba7-acde48001122
known_false_positives: None known at this time.
name: Windows Eventvwr UAC Bypass
product:
- Splunk Behavioral Analytics
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://attack.mitre.org/techniques/T1548/002
- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
risk_message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"),
"string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
"string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
"string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
"string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Defense Evasion Tactics
- IcedID
- Living Off The Land
cis20:
- CIS 14
confidence: 100
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
impact: 80
kill_chain_phases:
- Privilege Escalation
message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
mitre_attack_id:
- T1548.002
- T1548
nist:
- DE.AE
observable:
- name: dest_device_id
role:
- Victim
type: Hostname
- name: dest_user_id
role:
- Victim
type: User
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- event_id
- registry_path
- registry_hive
- registry_value_name
- registry_key_name
- registry_value_type
- registry_value_data
- process_guid
risk_score: 80
risk_severity: high
security_domain: endpoint
test:
name: Windows Eventvwr UAC Bypass Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
file_name: windows-sysmon-registry.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
file: endpoint/ssa___windows_eventvwr_uac_bypass.yml
name: Windows Eventvwr UAC Bypass
pass_condition: '@count_gt(0)'
type: Anomaly
version: 1
dist/ssa/srs/ssa___windows_mshta_child_process.yml
Vendored
+107
View File
@@ -0,0 +1,107 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-23'
description: The following analytic identifies child processes spawning from "mshta.exe".
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, parent process
"mshta.exe" and its child process.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
id: f63f7e9c-9526-11ec-9fc7-acde48001122
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
name: Windows MSHTA Child Process
product:
- Splunk Behavioral Analytics
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR
process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe"
OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
cis20:
- CIS 8
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1218.005
- T1218
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
risk_severity: high
security_domain: endpoint
test:
name: Windows MSHTA Child Process Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
file_name: windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_mshta_child_process.yml
name: Windows MSHTA Child Process
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_mshta_command-line_url.yml
Vendored
+109
View File
@@ -0,0 +1,109 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-23'
description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
utility is used to make remote http connections. Adversaries may use mshta.exe to
proxy the download and execution of remote .hta files. The analytic identifies command
line arguments of http and https being used. This technique is commonly used by
malicious software to bypass preventative controls. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "rundll32.exe" and its parent process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 9b35c538-94ef-11ec-9439-acde48001122
known_false_positives: It is possible legitimate applications may perform this behavior
and will need to be filtered.
name: Windows MSHTA Command-Line URL
product:
- Splunk Behavioral Analytics
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
cis20:
- CIS 8
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
destination to download an additional payload.
mitre_attack_id:
- T1218.005
- T1218
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
risk_severity: high
security_domain: endpoint
test:
name: Windows MSHTA Command-Line URL Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
file_name: windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_mshta_command_line_url.yml
name: Windows MSHTA Command-Line URL
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml
Vendored
+107
View File
@@ -0,0 +1,107 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-23'
description: The following analytic identifies "mshta.exe" execution with inline protocol
handlers. "JavaScript", "VBScript", and "About" are the only supported options when
invoking HTA content directly on the command-line. The search will return the first
time and last time these command-line arguments were used for these executions,
as well as the target system, the user, process "mshta.exe" and its parent process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 24962154-9524-11ec-9333-acde48001122
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
name: Windows MSHTA Inline HTA Execution
product:
- Splunk Behavioral Analytics
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, indicative
of defense evasion.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe"
AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
"%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Suspicious MSHTA Activity
- Living Off The Land
cis20:
- CIS 8
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA,
indicative of defense evasion.
mitre_attack_id:
- T1218.005
- T1218
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
risk_severity: high
security_domain: endpoint
test:
name: Windows MSHTA Inline HTA Execution Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
file_name: windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_mshta_inline_hta_execution.yml
name: Windows MSHTA Inline HTA Execution
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml
Vendored
+103
View File
@@ -0,0 +1,103 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-16'
description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
functionality is present. This technique variation is not as commonly used by adversaries,
but has been abused in the past. Lesser known uses include the ability to set the
`-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload`
is used, it is highly possible files will be archived. During triage, review parallel
processes and process lineage. Capture any files on disk and review. For the remote
domain or IP, what is the reputation?
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
id: 0bafd086-8f61-11ec-996e-acde48001122
known_false_positives: Limited false positives. It is possible administrators will
utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
process or command-line arguments.
name: Windows PowerShell Start-BitsTransfer
product:
- Splunk Behavioral Analytics
references:
- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
(cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
tags:
analytic_story:
- BITS Jobs
- Living Off The Land
automated_detection_testing: passed
cis20: []
confidence: 70
context:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $dest_user_id$ attempting to download a file.
mitre_attack_id:
- T1197
- T1105
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 49
risk_severity: low
security_domain: endpoint
test:
name: Windows PowerShell Start-BitsTransfer Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
file_name: T1197_windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
name: Windows PowerShell Start-BitsTransfer
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
Vendored
+101
View File
@@ -0,0 +1,101 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-15'
description: The following analytic identifies the Windows Windows Remote Auto Dialer,
rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
parent and child process behavior including file and image loads.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 6f42b8ce-1e15-11ec-ad5a-acde48001122
known_false_positives: False positives will be limited to applications that require
Rasautou.exe to load a DLL from disk. Filter as needed.
name: Windows Rasautou DLL Execution
product:
- Splunk Behavioral Analytics
references:
- https://github.com/mandiant/DueDLLigence
- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ attempting to load a DLL in a suspicious manner.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe"
AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Living Off The Land
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ attempting to load a DLL in a suspicious manner.
mitre_attack_id:
- T1055.001
- T1218
- T1055
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
risk_severity: high
security_domain: endpoint
test:
name: Windows Rasautou DLL Execution Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
file_name: windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_rasautou_dll_execution.yml
name: Windows Rasautou DLL Execution
pass_condition: '@count_gt(0)'
type: TTP
version: 1
dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml
Vendored
+112
View File
@@ -0,0 +1,112 @@
author: Michael Haag, Splunk
datamodel:
- Endpoint_Processes
date: '2022-02-23'
description: The following analytic identifies "rundll32.exe" execution with inline
protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
options when invoking HTA content directly on the command-line. This type of behavior
is commonly observed with fileless malware or application whitelisting bypass techniques.
The search will return the first time and last time these command-line arguments
were used for these executions, as well as the target system, the user, process
"rundll32.exe" and its parent process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
id: 0caa1dd6-94f5-11ec-9786-acde48001122
known_false_positives: Although unlikely, some legitimate applications may exhibit
this behavior, triggering a false positive.
name: Windows Rundll32 Inline HTA Execution
product:
- Splunk Behavioral Analytics
references:
- https://github.com/redcanaryco/AtomicTestHarnesses
- https://redcanary.com/blog/introducing-atomictestharnesses/
- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
risk_message: Suspicious $process_name$ inline HTA execution on $dest_device_id$.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe"
AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line,
"%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
tags:
analytic_story:
- Suspicious MSHTA Activity
- NOBELIUM Group
- Living Off The Land
asset_type: Endpoint
automated_detection_testing: passed
cis20:
- CIS 8
confidence: 80
context:
- Source:Endpoint
- Stage:Initial Access
- Stage:Execution
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: Suspicious $process_name$ inline HTA execution on $dest_device_id$.
mitre_attack_id:
- T1218
- T1218.005
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
role:
- Victim
type: User
- name: dest_device_id
role:
- Victim
type: Hostname
- name: parent_process_name
role:
- Parent Process
type: Parent Process
- name: process_name
role:
- Child Process
type: Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 56
risk_severity: medium
security_domain: endpoint
supported_tas:
- Splunk_TA_microsoft_sysmon
test:
name: Windows Rundll32 Inline HTA Execution Unit Test
tests:
- attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
file_name: windows-security.log
source: WinEventLog:Security
file: endpoint/ssa___windows_rundll32_inline_hta_execution.yml
name: Windows Rundll32 Inline HTA Execution
pass_condition: '@count_gt(0)'
type: TTP
version: 1
stories/hermeticwiper.yml
+22
View File
@@ -0,0 +1,22 @@
name: Hermetic Wiper
id: b7511c2e-9a10-11ec-99e3-acde48001122
version: 1
date: '2022-03-02'
author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk
description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities
that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.
narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting
multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.
references:
- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
tags:
analytic_story: Hermetic Wiper
category:
- Malware
- Adversary Tactics
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
usecase: Advanced Threat Detection
tests/endpoint/ssa___windows_bits_job_persistence.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows Bits Job Persistence Unit Test
tests:
- name: Windows Bits Job Persistence
file: endpoint/ssa___windows_bits_job_persistence.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: bits-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows Bitsadmin Download File Unit Test
tests:
- name: Windows Bitsadmin Download File
file: endpoint/ssa___windows_bitsadmin_download_file.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: bits-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_certutil_decode_file.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows CertUtil Decode File Unit Test
tests:
- name: Windows CertUtil Decode File
file: endpoint/ssa___windows_certutil_decode_file.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows CertUtil URLCache Download Unit Test
tests:
- name: Windows CertUtil URLCache Download
file: endpoint/ssa___windows_certutil_urlcache_download.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: T1105-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows CertUtil VerifyCtl Download Unit Test
tests:
- name: Windows CertUtil VerifyCtl Download
file: endpoint/ssa___windows_certutil_verifyctl_download_.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: T1105-windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_mshta_child_process.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows MSHTA Child Process Unit Test
tests:
- name: Windows MSHTA Child Process
file: endpoint/ssa___windows_mshta_child_process.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_mshta_command_line_url.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows MSHTA Command-Line URL Unit Test
tests:
- name: Windows MSHTA Command-Line URL
file: endpoint/ssa___windows_mshta_command_line_url.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_mshta_inline_hta_execution.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows MSHTA Inline HTA Execution Unit Test
tests:
- name: Windows MSHTA Inline HTA Execution
file: endpoint/ssa___windows_mshta_inline_hta_execution.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows PowerShell Start-BitsTransfer Unit Test
tests:
- name: Windows PowerShell Start-BitsTransfer
file: endpoint/ssa___windows_powershell_start_bitstransfer.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: T1197_windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows Rasautou DLL Execution Unit Test
tests:
- name: Windows Rasautou DLL Execution
file: endpoint/ssa___windows_rasautou_dll_execution.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log
source: WinEventLog:Security
tests/endpoint/ssa___windows_rundll32_inline_hta_execution.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows Rundll32 Inline HTA Execution Unit Test
tests:
- name: Windows Rundll32 Inline HTA Execution
file: endpoint/ssa___windows_rundll32_inline_hta_execution.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log
source: WinEventLog:Security
tests/endpoint/windows_disable_memory_crash_dump.test.yml
+12
View File
@@ -0,0 +1,12 @@
name: Windows Disable Memory Crash Dump Unit Test
tests:
- name: Windows Disable Memory Crash Drump
file: endpoint/windows_disable_memory_crash_dump.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml
+12
View File
@@ -0,0 +1,12 @@
name: Windows Modify Show Compress Color And Info Tip Registry Unit Test
tests:
- name: Windows Modify Show Compress Color And Info Tip Registry
file: endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml
+11
View File
@@ -0,0 +1,11 @@
name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test
tests:
- name: PAN Traffic Logs
file: network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
pass_condition: '@count_gt(0)'
description: Test PAN Traffic Logs LDAP outbound connection
attack_data:
- file_name: pantraffic.txt
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
source: pan:traffic
sourcetype: pan:traffic