From 9ba8b98bb7a59b4b06e5e87ab69423b98fe2b1a1 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Feb 2022 14:09:25 -0700 Subject: [PATCH 01/40] SSA Rasautou --- .../ssa___windows_rasautou_dll_execution.yml | 80 +++++++++++++++++++ ...___windows_rasautou_dll_execution.test.yml | 9 +++ 2 files changed, 89 insertions(+) create mode 100644 detections/endpoint/ssa___windows_rasautou_dll_execution.yml create mode 100644 tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml new file mode 100644 index 0000000000..f46482b50e --- /dev/null +++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -0,0 +1,80 @@ +name: Windows Rasautou DLL Execution +id: 6f42b8be-8e96-11ec-ad5a-acde48001122 +version: 1 +date: '2022-02-15' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. + During triage, review parent and child process behavior including file and image loads. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe" + AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();'' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed. +references: + - https://github.com/mandiant/DueDLLigence + - https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1 + - https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 + - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055.001 + - T1218 + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml b/tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml new file mode 100644 index 0000000000..d617f00e0b --- /dev/null +++ b/tests/endpoint/ssa___windows_rasautou_dll_execution.test.yml @@ -0,0 +1,9 @@ +name: Windows Rasautou DLL Execution Unit Test +tests: +- name: Windows Rasautou DLL Execution + file: endpoint/ssa___windows_rasautou_dll_execution.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log + source: WinEventLog:Security \ No newline at end of file From c708484703c96c17782cdb9ebbc04bd6355badfb Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Feb 2022 14:14:16 -0700 Subject: [PATCH 02/40] oops --- detections/endpoint/ssa___windows_rasautou_dll_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml index f46482b50e..89ddec23e7 100644 --- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -1,5 +1,5 @@ name: Windows Rasautou DLL Execution -id: 6f42b8be-8e96-11ec-ad5a-acde48001122 +id: 6f42b8ce-1e15-11ec-ad5a-acde48001122 version: 1 date: '2022-02-15' author: Michael Haag, Splunk From 9082c7c43d3ac975a3518db9d58cb02dc2d02f65 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Feb 2022 14:34:11 -0700 Subject: [PATCH 03/40] Windows Bits Job Persistence --- .../ssa___windows_bits_job_persistence.yml | 96 +++++++++++++++++++ .../ssa___windows_rasautou_dll_execution.yml | 2 +- 2 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/ssa___windows_bits_job_persistence.yml diff --git a/detections/endpoint/ssa___windows_bits_job_persistence.yml b/detections/endpoint/ssa___windows_bits_job_persistence.yml new file mode 100644 index 0000000000..2a95e98e52 --- /dev/null +++ b/detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -0,0 +1,96 @@ +name: Windows Bits Job Persistence +id: 1e25e97a-8ea4-11ec-9767-acde48001122 +version: 1 +date: '2022-02-15' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. + The query identifies the parameters used to create, resume or add a file to a BITS + job. Typically seen combined in a oneliner or ran in sequence. If identified, review + the BITS job created and capture any files written to disk. It is possible for BITS + to be used to upload files and this may require further network data analysis to + identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe" + AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line, "%setnotifyflags%") + OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line, "%setminretrydelay%") OR like (cmd_line, + "%setcustomheaders%") OR like (cmd_line, "%resume%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives will be present. Typically, applications + will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments + (legitimate applications) or parent process. +references: +- https://attack.mitre.org/techniques/T1197/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute +- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ +tags: + analytic_story: + - BITS Jobs + automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to persist using BITS. + mitre_attack_id: + - T1197 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml index 89ddec23e7..f13a226f93 100644 --- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -5,7 +5,7 @@ date: '2022-02-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads. search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) From 6b6727b3d7849b5f2071684cfe55bbf99fd69465 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Feb 2022 12:19:01 -0700 Subject: [PATCH 04/40] BITS --- .../ssa___windows_bits_job_persistence.yml | 28 +++--- .../ssa___windows_bitsadmin_download_file.yml | 95 +++++++++++++++++++ .../ssa___windows_rasautou_dll_execution.yml | 30 +++--- ...sa___windows_bits_job_persistence.test.yml | 9 ++ ...__windows_bitsadmin_download_file.test.yml | 9 ++ 5 files changed, 138 insertions(+), 33 deletions(-) create mode 100644 detections/endpoint/ssa___windows_bitsadmin_download_file.yml create mode 100644 tests/endpoint/ssa___windows_bits_job_persistence.test.yml create mode 100644 tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml diff --git a/detections/endpoint/ssa___windows_bits_job_persistence.yml b/detections/endpoint/ssa___windows_bits_job_persistence.yml index 2a95e98e52..90f86d36ef 100644 --- a/detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -55,15 +55,15 @@ tags: kill_chain_phases: - Exploitation message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to persist using BITS. + on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. mitre_attack_id: - T1197 observable: - - name: user + - name: dest_user_id type: User role: - Victim - - name: dest + - name: dest_device_id type: Hostname role: - Victim @@ -76,21 +76,15 @@ tags: role: - Child Process product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Behavioral Analytics required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml new file mode 100644 index 0000000000..4db79b5266 --- /dev/null +++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -0,0 +1,95 @@ +name: Windows Bitsadmin Download File +id: d76e8188-8f5a-11ec-ace4-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote + object. In addition, look for `download` or `upload` on the command-line, the switches + are not required to perform a transfer. Capture any files downloaded. Review the + reputation of the IP or domain used. Typically once executed, a follow on command + will be used to execute the dropped file. Note that the network connection or file + modification events related will not spawn or create from `bitsadmin.exe`, but the + artifacts will appear in a parallel process of `svchost.exe` with a command-line + similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel + and child processes to capture any behaviors and artifacts. In some suspicious and + malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` + to list out the jobs during investigation. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe" + AND (like (cmd_pyline, "%transfer%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives, however it may be required to filter + based on parent process name or network connection. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download +- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md +- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +tags: + analytic_story: + - Ingress Tool Transfer + - BITS Jobs + - DarkSide Ransomware + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1197 + - T1105 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml index f13a226f93..7299d8c16a 100644 --- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();'' + | into write_ssa_detected_events();' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed. references: @@ -40,22 +40,16 @@ tags: - T1218 - T1055 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Behavioral Analytics required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line security_domain: endpoint impact: 80 confidence: 100 @@ -66,7 +60,11 @@ tags: - Stage:Defense Evasion message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. observable: - - name: dest + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id type: Hostname role: - Victim diff --git a/tests/endpoint/ssa___windows_bits_job_persistence.test.yml b/tests/endpoint/ssa___windows_bits_job_persistence.test.yml new file mode 100644 index 0000000000..3eabc78bcc --- /dev/null +++ b/tests/endpoint/ssa___windows_bits_job_persistence.test.yml @@ -0,0 +1,9 @@ +name: Windows Bits Job Persistence Unit Test +tests: +- name: Windows Bits Job Persistence + file: endpoint/ssa___windows_bits_job_persistence.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: bits-windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + source: WinEventLog:Security \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml b/tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml new file mode 100644 index 0000000000..1ad73b02a0 --- /dev/null +++ b/tests/endpoint/ssa___windows_bitsadmin_download_file.test.yml @@ -0,0 +1,9 @@ +name: Windows Bitsadmin Download File Unit Test +tests: +- name: Windows Bitsadmin Download File + file: endpoint/ssa___windows_bitsadmin_download_file.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: bits-windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + source: WinEventLog:Security \ No newline at end of file From 87aad0493ce2a1653912e585a4d9898972c28db9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Feb 2022 13:16:13 -0700 Subject: [PATCH 05/40] start-bitstransfer --- .../ssa___windows_bitsadmin_download_file.yml | 2 +- ..._windows_powershell_start_bitstransfer.yml | 86 +++++++++++++++++++ ...ows_powershell_start_bitstransfer.test.yml | 9 ++ 3 files changed, 96 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml create mode 100644 tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml index 4db79b5266..bf5e67aa59 100644 --- a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -54,7 +54,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml new file mode 100644 index 0000000000..1db53c5774 --- /dev/null +++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -0,0 +1,86 @@ +name: Windows PowerShell Start-BitsTransfer +id: 0bafd086-8f61-11ec-996e-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar + functionality is present. This technique variation is not as commonly used by adversaries, + but has been abused in the past. Lesser known uses include the ability to set the + `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` + is used, it is highly possible files will be archived. During triage, review parallel + processes and process lineage. Capture any files on disk and review. For the remote + domain or IP, what is the reputation? +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="powershell.exe" + AND (like (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Limited false positives. It is possible administrators will + utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent + process or command-line arguments. +references: +- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 +- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs +tags: + analytic_story: + - BITS Jobs + automated_detection_testing: passed + cis20: [] + confidence: 70 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1197 + - T1105 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 49 + security_domain: endpoint diff --git a/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml new file mode 100644 index 0000000000..d25253492b --- /dev/null +++ b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml @@ -0,0 +1,9 @@ +name: Windows PowerShell Start-BitsTransfer Unit Test +tests: +- name: Windows PowerShell Start-BitsTransfer + file: endpoint/ssa___windows_powershell_start_bitstransfer.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: bits-windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + source: WinEventLog:Security \ No newline at end of file From 271ee724c5d9e4f4029e21ba198fa7f56b577775 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Feb 2022 14:09:18 -0700 Subject: [PATCH 06/40] certutil - verifyctl --- ...___windows_certutil_verifyctl_download.yml | 90 +++++++++++++++++++ ...ndows_certutil_verifyctl_download.test.yml | 9 ++ 2 files changed, 99 insertions(+) create mode 100644 detections/endpoint/ssa___windows_certutil_verifyctl_download.yml create mode 100644 tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml diff --git a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml new file mode 100644 index 0000000000..0e557ab3d0 --- /dev/null +++ b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -0,0 +1,90 @@ +name: Windows CertUtil VerifyCtl Download +id: 9ac29c40-8f6b-11ec-b19a-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. + This behavior does require a URL to be passed on the command-line. In addition, + `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will + be used. It is not entirely common for `certutil.exe` to contact public IP space. + \ During triage, capture any files on disk and review. Review the reputation of + the remote IP or domain in question. Using `-VerifyCtl`, the file will either be + written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" + AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%") + OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, + "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, + "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line, + "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +tags: + analytic_story: + - Ingress Tool Transfer + - DarkSide Ransomware + automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Command and Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1105 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 90 + security_domain: endpoint diff --git a/tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml b/tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml new file mode 100644 index 0000000000..2183a1f706 --- /dev/null +++ b/tests/endpoint/ssa___windows_certutil_verifyctl_download.test.yml @@ -0,0 +1,9 @@ +name: Windows CertUtil VerifyCtl Download Unit Test +tests: +- name: Windows CertUtil VerifyCtl Download + file: endpoint/ssa___windows_certutil_verifyctl_download_.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: T1105-windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + source: WinEventLog:Security \ No newline at end of file From eecd75c4a9b0721ae873be8e20944474e7bb5240 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Feb 2022 14:24:50 -0700 Subject: [PATCH 07/40] urlcache --- ...a___windows_certutil_urlcache_download.yml | 86 +++++++++++++++++++ ...___windows_certutil_verifyctl_download.yml | 9 +- ...indows_certutil_urlcache_download.test.yml | 9 ++ 3 files changed, 98 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/ssa___windows_certutil_urlcache_download.yml create mode 100644 tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml new file mode 100644 index 0000000000..244afa2e5d --- /dev/null +++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -0,0 +1,86 @@ +name: Windows CertUtil URLCache Download +id: 8cb1ad38-8f6d-11ec-87a3-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: Certutil.exe may download a file from a remote destination using `-urlcache`. + This behavior does require a URL to be passed on the command-line. In addition, + `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will + be used. It is not entirely common for `certutil.exe` to contact public IP space. + However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ + During triage, capture any files on disk and review. Review the reputation of the + remote IP or domain in question. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%urlcache%")) + | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html +tags: + analytic_story: + - Ingress Tool Transfer + - DarkSide Ransomware + automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Command and Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1105 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index 0e557ab3d0..53795c5bd6 100644 --- a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -19,12 +19,9 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" - AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%") - OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, - "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, - "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line, - "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp, + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line, "%verifyctl%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", diff --git a/tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml b/tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml new file mode 100644 index 0000000000..939e25e254 --- /dev/null +++ b/tests/endpoint/ssa___windows_certutil_urlcache_download.test.yml @@ -0,0 +1,9 @@ +name: Windows CertUtil URLCache Download Unit Test +tests: +- name: Windows CertUtil URLCache Download + file: endpoint/ssa___windows_certutil_urlcache_download.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: T1105-windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + source: WinEventLog:Security \ No newline at end of file From 252ed2576ff3e5bb71c887e6489dd3b443ba1ff4 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Feb 2022 14:30:10 -0700 Subject: [PATCH 08/40] Update ssa___windows_certutil_urlcache_download.yml --- .../endpoint/ssa___windows_certutil_urlcache_download.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml index 244afa2e5d..4d42ecf8c3 100644 --- a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -5,7 +5,7 @@ date: '2022-02-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will From cf94f81798ee1430a379ed3fc7367c7985ec6c07 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 17 Feb 2022 10:10:49 -0700 Subject: [PATCH 09/40] Windows CertUtil Decode File --- .../ssa___windows_certutil_decode_file.yml | 89 +++++++++++++++++++ ...sa___windows_certutil_decode_file.test.yml | 9 ++ 2 files changed, 98 insertions(+) create mode 100644 detections/endpoint/ssa___windows_certutil_decode_file.yml create mode 100644 tests/endpoint/ssa___windows_certutil_decode_file.test.yml diff --git a/detections/endpoint/ssa___windows_certutil_decode_file.yml b/detections/endpoint/ssa___windows_certutil_decode_file.yml new file mode 100644 index 0000000000..ce33b4835a --- /dev/null +++ b/detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -0,0 +1,89 @@ +name: Windows CertUtil Decode File +id: b06983f4-8f72-11ec-ab50-acde48001122 +version: 1 +date: '2022-02-16' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: CertUtil.exe may be used to `encode` and `decode` a file, including PE + and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` + and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded + file that was downloaded. Once decoded, it will be loaded by a parallel process. + Note that there are two additional command switches that may be used - `encodehex` + and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for + further execution. During triage, identify the source of the file being decoded. + Review its contents or execution behavior for further analysis. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Typically seen used to `encode` files, but it is possible to + see legitimate use of `decode`. Filter based on parent-child relationship, file + paths, endpoint or user. +references: + - https://attack.mitre.org/techniques/T1140/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md + - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil + - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ +tags: + analytic_story: + - Deobfuscate-Decode Files or Information + automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log + impact: 50 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file on disk. + mitre_attack_id: + - T1140 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 40 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_certutil_decode_file.test.yml b/tests/endpoint/ssa___windows_certutil_decode_file.test.yml new file mode 100644 index 0000000000..795b187b5d --- /dev/null +++ b/tests/endpoint/ssa___windows_certutil_decode_file.test.yml @@ -0,0 +1,9 @@ +name: Windows CertUtil Decode File Unit Test +tests: +- name: Windows CertUtil Decode File + file: endpoint/ssa___windows_certutil_decode_file.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log + source: WinEventLog:Security \ No newline at end of file From db3605c7535b43bb0246ffbc5a41a3dc76cce8bb Mon Sep 17 00:00:00 2001 From: d1vious Date: Fri, 18 Feb 2022 14:26:17 -0500 Subject: [PATCH 10/40] adding ssa detection --- ...ting_interpreter_outbound_ldap_traffic.yml | 82 +++++++++++++++++++ ...rpreter_outbound_ldap_traffic.yml.test.yml | 10 +++ 2 files changed, 92 insertions(+) create mode 100644 detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml create mode 100644 tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml new file mode 100644 index 0000000000..c9ff63df3d --- /dev/null +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -0,0 +1,82 @@ +name: Windows Command and Scripting Interpreter Outbound LDAP Traffic +id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 +version: 1 +date: '2022-02-17' +author: Jose Hernandez, Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. +Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. +This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on network traffic, specifically data that populates the Network_Traffic datamodel. + To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic events. +known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. +Please check those servers to verify if the activity is legitimate. +references: +- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ +- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html +- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a +tags: + analytic_story: + - Log4Shell CVE-2021-44228 + cis20: + - CIS 13 + confidence: 70 + context: + - Scope:Outbound + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + impact: 50 + kill_chain_phases: + - Execution + message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ + mitre_attack_id: + - T1059 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + risk_severity: low + security_domain: network diff --git a/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml b/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml new file mode 100644 index 0000000000..b8276b1001 --- /dev/null +++ b/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml @@ -0,0 +1,10 @@ +name: Windows Powershell DownloadFile Unit Test +tests: +- name: Windows Powershell DownloadFile + file: endpoint/ssa___windows_powershell_downloadfile.yml + pass_condition: '@count_gt(0)' + description: Test Windows Powershell DownloadFile detections + attack_data: + - file_name: downloadfile_windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + source: WinEventLog:Security From ba97944d046162d3f42a72b0dccd74c54f3b3be8 Mon Sep 17 00:00:00 2001 From: d1vious Date: Fri, 18 Feb 2022 17:39:23 -0500 Subject: [PATCH 11/40] adding ldap detection --- ...ting_interpreter_outbound_ldap_traffic.yml | 11 +- ...ting_interpreter_outbound_ldap_traffic.yml | 103 ++++++++++++++++++ ...rpreter_outbound_ldap_traffic.yml.test.yml | 10 -- ...interpreter_outbound_ldap_traffic.test.yml | 11 ++ 4 files changed, 118 insertions(+), 17 deletions(-) create mode 100644 dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml delete mode 100644 tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml create mode 100644 tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index c9ff63df3d..612039120b 100644 --- a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -1,4 +1,4 @@ -name: Windows Command and Scripting Interpreter Outbound LDAP Traffic +name: TCP Command and Scripting Interpreter Outbound LDAP Traffic id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 version: 1 date: '2022-02-17' @@ -6,9 +6,7 @@ author: Jose Hernandez, Michael Haag, Splunk type: Anomaly datamodel: - Endpoint_Processes -description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. -Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. -This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. +description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), @@ -26,8 +24,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map how_to_implement: To successfully implement this search you need to be ingesting information on network traffic, specifically data that populates the Network_Traffic datamodel. To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic events. -known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. -Please check those servers to verify if the activity is legitimate. +known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate. references: - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ - https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html @@ -43,7 +40,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt impact: 50 kill_chain_phases: - Execution diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml new file mode 100644 index 0000000000..5d7bb37e09 --- /dev/null +++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -0,0 +1,103 @@ +author: Jose Hernandez, Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-17' +description: Malicious actors often abuse misconfigured LDAP servers or applications + that use the LDAP servers in organizations. Outbound LDAP traffic should not be + allowed outbound through your perimeter firewall. This search will help determine + if you have any LDAP connections to IP addresses outside of private (RFC1918) address + space. +how_to_implement: To successfully implement this search you need to be ingesting information + on network traffic, specifically data that populates the Network_Traffic datamodel. + To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic + events. +id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 +known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be + allowed outbound through your perimeter firewall. Please check those servers to + verify if the activity is legitimate. +name: TCP Command and Scripting Interpreter Outbound LDAP Traffic +product: +- Splunk Behavioral Analytics +references: +- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ +- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html +- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a +risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting + to dest ip $dest_ip$ +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Log4Shell CVE-2021-44228 + cis20: + - CIS 13 + confidence: 70 + context: + - Scope:Outbound + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + impact: 50 + kill_chain_phases: + - Execution + message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting + to dest ip $dest_ip$ + mitre_attack_id: + - T1059 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + risk_severity: low + security_domain: network +test: + name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + file_name: pantraffic.txt + source: pan:traffic + sourcetype: pan:traffic + description: Test PAN Traffic Logs LDAP outbound connection + file: network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml + name: PAN Traffic Logs + pass_condition: '@count_gt(0)' +type: Anomaly +version: 1 diff --git a/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml b/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml deleted file mode 100644 index b8276b1001..0000000000 --- a/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Windows Powershell DownloadFile Unit Test -tests: -- name: Windows Powershell DownloadFile - file: endpoint/ssa___windows_powershell_downloadfile.yml - pass_condition: '@count_gt(0)' - description: Test Windows Powershell DownloadFile detections - attack_data: - - file_name: downloadfile_windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log - source: WinEventLog:Security diff --git a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml new file mode 100644 index 0000000000..5b4a1868c4 --- /dev/null +++ b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml @@ -0,0 +1,11 @@ +name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test +tests: +- name: PAN Traffic Logs + file: network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml + pass_condition: '@count_gt(0)' + description: Test PAN Traffic Logs LDAP outbound connection + attack_data: + - file_name: pantraffic.txt + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + source: pan:traffic + sourcetype: pan:traffic From dfb089db4e451a244f4fcf990f44b860be7cc67c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 22 Feb 2022 14:58:49 -0700 Subject: [PATCH 12/40] Update ssa___windows_certutil_decode_file.yml --- detections/endpoint/ssa___windows_certutil_decode_file.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_certutil_decode_file.yml b/detections/endpoint/ssa___windows_certutil_decode_file.yml index ce33b4835a..a6e43eac7f 100644 --- a/detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -5,7 +5,7 @@ date: '2022-02-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint_Processes description: CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded From e61f56eb055cf924f66d1dd720e5d73ace3f3b2c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 22 Feb 2022 15:13:43 -0700 Subject: [PATCH 13/40] Update ssa___windows_bitsadmin_download_file.yml --- detections/endpoint/ssa___windows_bitsadmin_download_file.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml index bf5e67aa59..9a5b2f07f4 100644 --- a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -25,7 +25,7 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe" - AND (like (cmd_pyline, "%transfer%")) | eval start_time=timestamp, + AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", From 02684a07410c64828f40c86ca5d0f7cec800c7c5 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 09:56:45 -0700 Subject: [PATCH 14/40] Fixed Powershell Bits --- .../endpoint/ssa___windows_powershell_start_bitstransfer.yml | 2 +- .../ssa___windows_powershell_start_bitstransfer.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 1db53c5774..0b39967922 100644 --- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -45,7 +45,7 @@ tags: - Source:Endpoint - Stage:Exfiltration dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log impact: 70 kill_chain_phases: - Exploitation diff --git a/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml index d25253492b..a3f44da9d0 100644 --- a/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml +++ b/tests/endpoint/ssa___windows_powershell_start_bitstransfer.test.yml @@ -4,6 +4,6 @@ tests: file: endpoint/ssa___windows_powershell_start_bitstransfer.yml pass_condition: '@count_gt(0)' attack_data: - - file_name: bits-windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + - file_name: T1197_windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log source: WinEventLog:Security \ No newline at end of file From d90e9559baff82a5c5b8a56f8a297cf12be98b0f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 10:34:13 -0700 Subject: [PATCH 15/40] logic issue --- .../ssa___windows_powershell_start_bitstransfer.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 0b39967922..9667316393 100644 --- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -19,8 +19,10 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="powershell.exe" - AND (like (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, + | where cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", From 1012679be3add09ade7a42a7a15ff896f502c7a5 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 10:48:09 -0700 Subject: [PATCH 16/40] working bits --- ..._windows_powershell_start_bitstransfer.yml | 21 +++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 9667316393..3a1547b905 100644 --- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -13,19 +13,18 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? -search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) - | where cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like - (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), - "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) - | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search you need to be ingesting information From 1bddc5433aa08b1f9228fc1994722b22419a16de Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 14:18:24 -0700 Subject: [PATCH 17/40] analytic story --- detections/endpoint/ssa___windows_bits_job_persistence.yml | 1 + detections/endpoint/ssa___windows_bitsadmin_download_file.yml | 1 + detections/endpoint/ssa___windows_certutil_decode_file.yml | 1 + detections/endpoint/ssa___windows_certutil_urlcache_download.yml | 1 + .../endpoint/ssa___windows_certutil_verifyctl_download.yml | 1 + .../endpoint/ssa___windows_powershell_start_bitstransfer.yml | 1 + detections/endpoint/ssa___windows_rasautou_dll_execution.yml | 1 + 7 files changed, 7 insertions(+) diff --git a/detections/endpoint/ssa___windows_bits_job_persistence.yml b/detections/endpoint/ssa___windows_bits_job_persistence.yml index 90f86d36ef..8a0d8a1285 100644 --- a/detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - BITS Jobs + - Living Off The Land automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml index 9a5b2f07f4..e84abf65c9 100644 --- a/detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -48,6 +48,7 @@ tags: - Ingress Tool Transfer - BITS Jobs - DarkSide Ransomware + - Living Off The Land automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/ssa___windows_certutil_decode_file.yml b/detections/endpoint/ssa___windows_certutil_decode_file.yml index a6e43eac7f..fae5ef1811 100644 --- a/detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -43,6 +43,7 @@ references: tags: analytic_story: - Deobfuscate-Decode Files or Information + - Living Off The Land automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml index 4d42ecf8c3..1d7955ddc4 100644 --- a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -40,6 +40,7 @@ tags: analytic_story: - Ingress Tool Transfer - DarkSide Ransomware + - Living Off The Land automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index 53795c5bd6..ea9c35ec10 100644 --- a/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -41,6 +41,7 @@ tags: analytic_story: - Ingress Tool Transfer - DarkSide Ransomware + - Living Off The Land automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 3a1547b905..2b8dbd75bc 100644 --- a/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -39,6 +39,7 @@ references: tags: analytic_story: - BITS Jobs + - Living Off The Land automated_detection_testing: passed cis20: [] confidence: 70 diff --git a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml index 7299d8c16a..3e6e6e5f52 100644 --- a/detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Living Off The Land dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log kill_chain_phases: From a658de3e25b176d2f0131d525fb115d8def831b9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 15:03:51 -0700 Subject: [PATCH 18/40] MSHTA URl --- .../ssa___windows_mshta_command_line_url.yml | 93 +++++++++++++++++++ ...___windows_mshta_command_line_url.test.yml | 9 ++ 2 files changed, 102 insertions(+) create mode 100644 detections/endpoint/ssa___windows_mshta_command_line_url.yml create mode 100644 tests/endpoint/ssa___windows_mshta_command_line_url.test.yml diff --git a/detections/endpoint/ssa___windows_mshta_command_line_url.yml b/detections/endpoint/ssa___windows_mshta_command_line_url.yml new file mode 100644 index 0000000000..5606f0dc1c --- /dev/null +++ b/detections/endpoint/ssa___windows_mshta_command_line_url.yml @@ -0,0 +1,93 @@ +name: Windows MSHTA Command-Line URL +id: 9b35c538-94ef-11ec-9439-acde48001122 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) + utility is used to make remote http connections. Adversaries may use mshta.exe to + proxy the download and execution of remote .hta files. The analytic identifies command + line arguments of http and https being used. This technique is commonly used by + malicious software to bypass preventative controls. The search will return the first + time and last time these command-line arguments were used for these executions, + as well as the target system, the user, process "rundll32.exe" and its parent process. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible legitimate applications may perform this behavior + and will need to be filtered. +references: + - https://github.com/redcanaryco/AtomicTestHarnesses + - https://redcanary.com/blog/introducing-atomictestharnesses/ + - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.005 + - T1218 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to + download an additional payload. + nist: + - PR.PT + - DE.CM + cis20: + - CIS 8 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_mshta_command_line_url.test.yml b/tests/endpoint/ssa___windows_mshta_command_line_url.test.yml new file mode 100644 index 0000000000..b5d8fa3e40 --- /dev/null +++ b/tests/endpoint/ssa___windows_mshta_command_line_url.test.yml @@ -0,0 +1,9 @@ +name: Windows MSHTA Command-Line URL Unit Test +tests: +- name: Windows MSHTA Command-Line URL + file: endpoint/ssa___windows_mshta_command_line_url.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security \ No newline at end of file From c9654f36cf0bd18e279a7a76a73ecdb1f5ee2c50 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 15:23:30 -0700 Subject: [PATCH 19/40] rundll32 inline --- ..._windows_rundll32_inline_hta_execution.yml | 97 +++++++++++++++++++ ...ows_rundll32_inline_hta_execution.test.yml | 9 ++ 2 files changed, 106 insertions(+) create mode 100644 detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml create mode 100644 tests/endpoint/ssa___windows_rundll32_inline_hta_execution.test.yml diff --git a/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml new file mode 100644 index 0000000000..d66cbe9df7 --- /dev/null +++ b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -0,0 +1,97 @@ +name: Windows Rundll32 Inline HTA Execution +id: 0caa1dd6-94f5-11ec-9786-acde48001122 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies "rundll32.exe" execution with inline + protocol handlers. "JavaScript", "VBScript", and "About" are the only supported + options when invoking HTA content directly on the command-line. This type of behavior + is commonly observed with fileless malware or application whitelisting bypass techniques. + The search will return the first time and last time these command-line arguments + were used for these executions, as well as the target system, the user, process + "rundll32.exe" and its parent process. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe" AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, "%about%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +tags: + analytic_story: + - Suspicious MSHTA Activity + - NOBELIUM Group + - Living Off The Land + asset_type: Endpoint + automated_detection_testing: passed + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Suspicious $process_name$ inline HTA execution on $dest_device_id$. + mitre_attack_id: + - T1218 + - T1218.005 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 56 + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/tests/endpoint/ssa___windows_rundll32_inline_hta_execution.test.yml b/tests/endpoint/ssa___windows_rundll32_inline_hta_execution.test.yml new file mode 100644 index 0000000000..af29be37cf --- /dev/null +++ b/tests/endpoint/ssa___windows_rundll32_inline_hta_execution.test.yml @@ -0,0 +1,9 @@ +name: Windows Rundll32 Inline HTA Execution Unit Test +tests: +- name: Windows Rundll32 Inline HTA Execution + file: endpoint/ssa___windows_rundll32_inline_hta_execution.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security \ No newline at end of file From e67e0c92bba1752ea9a3bd5ae4aafa9d1c9d53e3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 20:56:51 -0700 Subject: [PATCH 20/40] mshta inline --- ...a___windows_mshta_inline_hta_execution.yml | 91 +++++++++++++++++++ ...indows_mshta_inline_hta_execution.test.yml | 9 ++ 2 files changed, 100 insertions(+) create mode 100644 detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml create mode 100644 tests/endpoint/ssa___windows_mshta_inline_hta_execution.test.yml diff --git a/detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml new file mode 100644 index 0000000000..708cb1d7b2 --- /dev/null +++ b/detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -0,0 +1,91 @@ +name: Windows MSHTA Inline HTA Execution +id: 24962154-9524-11ec-9333-acde48001122 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies "mshta.exe" execution with inline protocol + handlers. "JavaScript", "VBScript", and "About" are the only supported options when + invoking HTA content directly on the command-line. The search will return the first + time and last time these command-line arguments were used for these executions, + as well as the target system, the user, process "mshta.exe" and its parent process. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, "%about%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.005 + - T1218 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, indicative of defense + evasion. + nist: + - PR.PT + - DE.CM + cis20: + - CIS 8 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_mshta_inline_hta_execution.test.yml b/tests/endpoint/ssa___windows_mshta_inline_hta_execution.test.yml new file mode 100644 index 0000000000..3ed94dc93a --- /dev/null +++ b/tests/endpoint/ssa___windows_mshta_inline_hta_execution.test.yml @@ -0,0 +1,9 @@ +name: Windows MSHTA Inline HTA Execution Unit Test +tests: +- name: Windows MSHTA Inline HTA Execution + file: endpoint/ssa___windows_mshta_inline_hta_execution.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security \ No newline at end of file From dbce7115044b547243c5c701490cdc7419bb6df3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 23 Feb 2022 21:53:31 -0700 Subject: [PATCH 21/40] mshta child --- .../ssa___windows_mshta_child_process.yml | 90 +++++++++++++++++++ ...ssa___windows_mshta_child_process.test.yml | 9 ++ 2 files changed, 99 insertions(+) create mode 100644 detections/endpoint/ssa___windows_mshta_child_process.yml create mode 100644 tests/endpoint/ssa___windows_mshta_child_process.test.yml diff --git a/detections/endpoint/ssa___windows_mshta_child_process.yml b/detections/endpoint/ssa___windows_mshta_child_process.yml new file mode 100644 index 0000000000..d1c0effc0e --- /dev/null +++ b/detections/endpoint/ssa___windows_mshta_child_process.yml @@ -0,0 +1,90 @@ +name: Windows MSHTA Child Process +id: f63f7e9c-9526-11ec-9fc7-acde48001122 +version: 1 +date: '2022-02-23' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies child processes spawning from "mshta.exe". + The search will return the first time and last time these command-line arguments + were used for these executions, as well as the target system, the user, parent process + "mshta.exe" and its child process. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR process_name="cmd.exe" OR + process_name="scrcons.exe" OR process_name="colorcpl.exe" OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe" + OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.005 + - T1218 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to + download an additional payload. + nist: + - PR.PT + - DE.CM + cis20: + - CIS 8 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_mshta_child_process.test.yml b/tests/endpoint/ssa___windows_mshta_child_process.test.yml new file mode 100644 index 0000000000..b43d03d153 --- /dev/null +++ b/tests/endpoint/ssa___windows_mshta_child_process.test.yml @@ -0,0 +1,9 @@ +name: Windows MSHTA Child Process Unit Test +tests: +- name: Windows MSHTA Child Process + file: endpoint/ssa___windows_mshta_child_process.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security \ No newline at end of file From f7a8cb0cc59961b445fd28c62c5b088f5f34b09d Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 24 Feb 2022 20:22:13 -0700 Subject: [PATCH 22/40] Working on --- .../ssa___windows_mshta_child_process.yml | 2 +- .../ssa___windows_wmiprvse_spawn_mshta.yml | 90 +++++++++++++++++++ ...sa___windows_wmiprvse_spawn_mshta.test.yml | 9 ++ 3 files changed, 100 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml create mode 100644 tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml diff --git a/detections/endpoint/ssa___windows_mshta_child_process.yml b/detections/endpoint/ssa___windows_mshta_child_process.yml index d1c0effc0e..d5980dbe8d 100644 --- a/detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/detections/endpoint/ssa___windows_mshta_child_process.yml @@ -10,7 +10,7 @@ description: The following analytic identifies child processes spawning from "m The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml new file mode 100644 index 0000000000..1b5308cb3d --- /dev/null +++ b/detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml @@ -0,0 +1,90 @@ +name: Windows Wmiprvse Spawn MSHTA +id: ba0a50e2-9598-11ec-9c6b-acde48001122 +version: 1 +date: '2022-02-24' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This + behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe + or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn + mshta.exe from svchost.exe. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="wmiprvse.exe" parent_process_name="svchost.exe" AND process_name="mshta.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +references: +- https://codewhitesec.blogspot.com/2018/07/lethalhta.html +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.005 + - T1218 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ potentially indicative of defense evasion. + nist: + - PR.PT + - DE.CM + cis20: + - CIS 8 + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml b/tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml new file mode 100644 index 0000000000..b6b779c4d8 --- /dev/null +++ b/tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml @@ -0,0 +1,9 @@ +name: Windows Wmiprvse Spawn MSHTA Unit Test +tests: +- name: Windows Wmiprvse Spawn MSHTA + file: endpoint/ssa___windows_wmiprvse_spawn_mshta.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + source: WinEventLog:Security \ No newline at end of file From 6a50f02ff475b074a80e192b314275c65f5140ce Mon Sep 17 00:00:00 2001 From: d1vious Date: Thu, 24 Feb 2022 23:05:31 -0500 Subject: [PATCH 23/40] working detection --- detections/endpoint/ssa___windows_powersh.yml | 94 +++++++++++++++++++ ...ting_interpreter_outbound_ldap_traffic.yml | 18 ++-- ...ting_interpreter_outbound_ldap_traffic.yml | 24 ++--- ...interpreter_outbound_ldap_traffic.test.yml | 2 +- 4 files changed, 111 insertions(+), 27 deletions(-) create mode 100644 detections/endpoint/ssa___windows_powersh.yml diff --git a/detections/endpoint/ssa___windows_powersh.yml b/detections/endpoint/ssa___windows_powersh.yml new file mode 100644 index 0000000000..939778867e --- /dev/null +++ b/detections/endpoint/ssa___windows_powersh.yml @@ -0,0 +1,94 @@ +name: Windows Powershell DownloadFile +id: 46440222-81d5-44b1-a376-19dcd70d1b08 +version: 1 +date: '2022-02-11' +author: Jose Hernandez, Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: The following analytic identifies the use of PowerShell downloading a + file using `DownloadFile` method. This particular method is utilized in many different + PowerShell frameworks to download files and output to disk. Identify the source + (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell + transaction logs are available, review for further details of the implant. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present and filtering will need to occur + by parent process or command line argument. It may be required to modify this query + to an EDR product for more granular coverage. +references: +- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md +tags: + analytic_story: + - Malicious PowerShell + - Ingress Tool Transfer + - Log4Shell CVE-2021-44228 + cis20: + - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:LateralMovement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + impact: 50 + kill_chain_phases: + - Lateral Movement + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile + within PowerShell. + mitre_attack_id: + - T1020 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + risk_severity: low + security_domain: endpoint diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 612039120b..91e98d560d 100644 --- a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -8,18 +8,12 @@ datamodel: - Endpoint_Processes description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" - OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like - (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), "string", null) + | where dest_port=389 OR dest_port=1389 OR dest_port=636 + | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port, "dest_ip", dest_ip]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search you need to be ingesting information on network traffic, specifically data that populates the Network_Traffic datamodel. @@ -40,7 +34,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log impact: 50 kill_chain_phases: - Execution diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 5d7bb37e09..4136fd59e8 100644 --- a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -25,19 +25,15 @@ references: risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" - OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like - (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, + "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), + "string", null) | where dest_port=389 OR dest_port=1389 OR dest_port=636 | where + NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, + cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port, + "dest_ip", dest_ip]) | into write_ssa_detected_events();' tags: analytic_story: - Log4Shell CVE-2021-44228 @@ -49,7 +45,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log impact: 50 kill_chain_phases: - Execution @@ -91,7 +87,7 @@ test: name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test tests: - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log file_name: pantraffic.txt source: pan:traffic sourcetype: pan:traffic diff --git a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml index 5b4a1868c4..41564782d6 100644 --- a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml +++ b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml @@ -6,6 +6,6 @@ tests: description: Test PAN Traffic Logs LDAP outbound connection attack_data: - file_name: pantraffic.txt - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log source: pan:traffic sourcetype: pan:traffic From f14eec3bd7aacf4a852eebc093f6b71d6ba0e549 Mon Sep 17 00:00:00 2001 From: d1vious Date: Thu, 24 Feb 2022 23:07:52 -0500 Subject: [PATCH 24/40] cleaning up a mistakenly added file --- detections/endpoint/ssa___windows_powersh.yml | 94 ------------------- 1 file changed, 94 deletions(-) delete mode 100644 detections/endpoint/ssa___windows_powersh.yml diff --git a/detections/endpoint/ssa___windows_powersh.yml b/detections/endpoint/ssa___windows_powersh.yml deleted file mode 100644 index 939778867e..0000000000 --- a/detections/endpoint/ssa___windows_powersh.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: Windows Powershell DownloadFile -id: 46440222-81d5-44b1-a376-19dcd70d1b08 -version: 1 -date: '2022-02-11' -author: Jose Hernandez, Michael Haag, Splunk -type: Anomaly -datamodel: -- Endpoint_Processes -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadFile` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" - OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like - (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Malicious PowerShell - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - cis20: - - CIS 8 - confidence: 70 - context: - - Source:Endpoint - - Stage:LateralMovement - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log - impact: 50 - kill_chain_phases: - - Lateral Movement - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile - within PowerShell. - mitre_attack_id: - - T1020 - nist: - - PR.PT - - DE.CM - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - cmd_line - risk_score: 35 - risk_severity: low - security_domain: endpoint From cbc3611298c3ccfa981062c363c291d6e1dd0eba Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 25 Feb 2022 14:28:31 -0700 Subject: [PATCH 25/40] The Blizzard of Haag --- .../windows_disable_memory_crash_drump.yml | 85 +++++++++++++++++++ ...indows_disable_memory_crash_drump.test.yml | 12 +++ 2 files changed, 97 insertions(+) create mode 100644 detections/endpoint/windows_disable_memory_crash_drump.yml create mode 100644 tests/endpoint/windows_disable_memory_crash_drump.test.yml diff --git a/detections/endpoint/windows_disable_memory_crash_drump.yml b/detections/endpoint/windows_disable_memory_crash_drump.yml new file mode 100644 index 0000000000..3d71bc22ad --- /dev/null +++ b/detections/endpoint/windows_disable_memory_crash_drump.yml @@ -0,0 +1,85 @@ +name: Windows Disable Memory Crash Drump +id: 59e54602-9680-11ec-a8a6-acde48001122 +version: 1 +date: '2022-02-25' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a process that is attempting to disable the ability on Windows to prevent a memory crash dump. This was recently identified being utilized by HermeticWiper. + To disable crash dumps, the value must be set to 0. + This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check). +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name Registry.registry_value_data + Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` + |join process_guid [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.parent_process_name Processes.parent_process + Processes.process_guid | `drop_dm_object_name(Processes)` | fields _time dest user parent_process_name parent_process process_name + process_path process process_guid registry_path registry_value_name registry_value_data + registry_key_name] | table _time dest user parent_process_name parent_process process_name + process_path process process_guid registry_path registry_value_name registry_value_data + registry_key_name | `windows_disable_memory_crash_drump_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: + - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options +tags: + analytic_story: + - Data Destruction + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + - Filesystem.dest + security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - source:endpoint + - stage:Persistence + - Privilege Escalation + message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 diff --git a/tests/endpoint/windows_disable_memory_crash_drump.test.yml b/tests/endpoint/windows_disable_memory_crash_drump.test.yml new file mode 100644 index 0000000000..e2e66c7725 --- /dev/null +++ b/tests/endpoint/windows_disable_memory_crash_drump.test.yml @@ -0,0 +1,12 @@ +name: Windows Disable Memory Crash Drump Unit Test +tests: +- name: Windows Disable Memory Crash Drump + file: endpoint/windows_disable_memory_crash_drump.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 54054b2d09e1e932c07fc2316cb5091a437b63d3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 25 Feb 2022 14:31:01 -0700 Subject: [PATCH 26/40] Drump to Dump --- ..._crash_drump.yml => windows_disable_memory_crash_dump.yml} | 4 ++-- ...mp.test.yml => windows_disable_memory_crash_dump.test.yml} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{windows_disable_memory_crash_drump.yml => windows_disable_memory_crash_dump.yml} (96%) rename tests/endpoint/{windows_disable_memory_crash_drump.test.yml => windows_disable_memory_crash_dump.test.yml} (79%) diff --git a/detections/endpoint/windows_disable_memory_crash_drump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml similarity index 96% rename from detections/endpoint/windows_disable_memory_crash_drump.yml rename to detections/endpoint/windows_disable_memory_crash_dump.yml index 3d71bc22ad..6bf0eead37 100644 --- a/detections/endpoint/windows_disable_memory_crash_drump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -1,4 +1,4 @@ -name: Windows Disable Memory Crash Drump +name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 version: 1 date: '2022-02-25' @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data - registry_key_name | `windows_disable_memory_crash_drump_filter`' + registry_key_name | `windows_disable_memory_crash_dump_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. diff --git a/tests/endpoint/windows_disable_memory_crash_drump.test.yml b/tests/endpoint/windows_disable_memory_crash_dump.test.yml similarity index 79% rename from tests/endpoint/windows_disable_memory_crash_drump.test.yml rename to tests/endpoint/windows_disable_memory_crash_dump.test.yml index e2e66c7725..9d4b7636bd 100644 --- a/tests/endpoint/windows_disable_memory_crash_drump.test.yml +++ b/tests/endpoint/windows_disable_memory_crash_dump.test.yml @@ -1,7 +1,7 @@ -name: Windows Disable Memory Crash Drump Unit Test +name: Windows Disable Memory Crash Dump Unit Test tests: - name: Windows Disable Memory Crash Drump - file: endpoint/windows_disable_memory_crash_drump.yml + file: endpoint/windows_disable_memory_crash_dump.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 47dbc6b946360faae5e8d823ee9756ec49294375 Mon Sep 17 00:00:00 2001 From: d1vious Date: Sat, 26 Feb 2022 13:39:28 -0500 Subject: [PATCH 27/40] using a different field --- ...mand_and_scripting_interpreter_outbound_ldap_traffic.yml | 2 +- ...mand_and_scripting_interpreter_outbound_ldap_traffic.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 91e98d560d..790077c1d4 100644 --- a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint_Processes description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), "string", null) + "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"), "collection", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636 | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 4136fd59e8..5fe63a798b 100644 --- a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -26,9 +26,9 @@ risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure c to dest ip $dest_ip$ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, - "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), - "string", null) | where dest_port=389 OR dest_port=1389 OR dest_port=636 | where - NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, + "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"), + "collection", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636 + | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), From 550e5496149f71fc74b3baff73d6232fb82479d1 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Feb 2022 07:29:37 -0700 Subject: [PATCH 28/40] Update windows_disable_memory_crash_dump.yml --- detections/endpoint/windows_disable_memory_crash_dump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 6bf0eead37..ebe26edba3 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a process that is attempting to disable the ability on Windows to prevent a memory crash dump. This was recently identified being utilized by HermeticWiper. +description: The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper. To disable crash dumps, the value must be set to 0. This feature is typically modified to perform a memory crash dump when a computer stops unexpectedly because of a Stop error (also known as a blue screen, system crash, or bug check). search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry From efe95670b961983012d884a6da25753e9aec5533 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 28 Feb 2022 13:57:32 -0700 Subject: [PATCH 29/40] removed --- .../ssa___windows_wmiprvse_spawn_mshta.yml | 90 ------------------- ...sa___windows_wmiprvse_spawn_mshta.test.yml | 9 -- 2 files changed, 99 deletions(-) delete mode 100644 detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml delete mode 100644 tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml deleted file mode 100644 index 1b5308cb3d..0000000000 --- a/detections/endpoint/ssa___windows_wmiprvse_spawn_mshta.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: Windows Wmiprvse Spawn MSHTA -id: ba0a50e2-9598-11ec-9c6b-acde48001122 -version: 1 -date: '2022-02-24' -author: Michael Haag, Splunk -type: TTP -datamodel: -- Endpoint -description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This - behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe - or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn - mshta.exe from svchost.exe. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="wmiprvse.exe" parent_process_name="svchost.exe" AND process_name="mshta.exe" - | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: Although unlikely, some legitimate applications may exhibit - this behavior, triggering a false positive. -references: -- https://codewhitesec.blogspot.com/2018/07/lethalhta.html -- https://github.com/redcanaryco/AtomicTestHarnesses -- https://redcanary.com/blog/introducing-atomictestharnesses/ -tags: - analytic_story: - - Suspicious MSHTA Activity - - Living Off The Land - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1218.005 - - T1218 - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - cmd_line - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest_device_id$ by user $dest_user_id$ potentially indicative of defense evasion. - nist: - - PR.PT - - DE.CM - cis20: - - CIS 8 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml b/tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml deleted file mode 100644 index b6b779c4d8..0000000000 --- a/tests/endpoint/ssa___windows_wmiprvse_spawn_mshta.test.yml +++ /dev/null @@ -1,9 +0,0 @@ -name: Windows Wmiprvse Spawn MSHTA Unit Test -tests: -- name: Windows Wmiprvse Spawn MSHTA - file: endpoint/ssa___windows_wmiprvse_spawn_mshta.yml - pass_condition: '@count_gt(0)' - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log - source: WinEventLog:Security \ No newline at end of file From e9c7accd0fd5e94eca10e568e55f9c5afbdc8a81 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 2 Mar 2022 11:50:13 +0100 Subject: [PATCH 30/40] hwiper_more_ioc --- ...w_compress_color_and_info_tip_registry.yml | 69 +++++++++++++++++++ ...press_color_and_info_tip_registry.test.yml | 12 ++++ 2 files changed, 81 insertions(+) create mode 100644 detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml create mode 100644 tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml new file mode 100644 index 0000000000..125d614440 --- /dev/null +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -0,0 +1,69 @@ +name: Windows Modify Show Compress Color And Info Tip Registry +id: b7548c2e-9a10-11ec-99e3-acde48001122 +version: 1 +date: '2022-03-02' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to look for suspicious registry modification related to file compression color and information tips. + This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS + file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions + related to file compression attribution in terms of color in NTFS file system. +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" + AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip") + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.parent_process_name Processes.parent_process + Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | fields _time dest user parent_process_name parent_process process_name + process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path + process proc_guid registry_path registry_value_name registry_value_data + | `windows_modify_show_compress_color_and_info_tip_registry_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_name + - Registry.dest Registry.user + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml b/tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml new file mode 100644 index 0000000000..414d732b9c --- /dev/null +++ b/tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml @@ -0,0 +1,12 @@ +name: Windows Modify Show Compress Color And Info Tip Registry Unit Test +tests: +- name: Windows Modify Show Compress Color And Info Tip Registry + file: endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From c4305d913257b12f5ac068ab922a9d4d82286501 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 2 Mar 2022 10:11:42 -0800 Subject: [PATCH 31/40] Update windows_disable_memory_crash_dump.yml minnor yml updates --- .../endpoint/windows_disable_memory_crash_dump.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index ebe26edba3..5216175c4c 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint registry_key_name | `windows_disable_memory_crash_dump_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node. known_false_positives: unknown references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html @@ -50,14 +50,21 @@ tags: - Filesystem.user - Filesystem.file_path - Filesystem.dest + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid security_domain: endpoint impact: 90 confidence: 100 # (impact * confidence)/100 risk_score: 90 context: - - source:endpoint - - stage:Persistence + - Source:Endpoint + - Stage:Persistence - Privilege Escalation message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$. observable: From 65b497ac5ee391341eb241b69ded55ca4c1db01b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 11:18:26 -0800 Subject: [PATCH 32/40] yml changes --- ...ows_modify_show_compress_color_and_info_tip_registry.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 125d614440..ff86c50101 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -24,8 +24,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. +known_false_positives: unknown references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html tags: From d41712757c765346baa4eaf56fac18408313cd96 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 2 Mar 2022 12:13:37 -0800 Subject: [PATCH 33/40] analyticstory --- stories/hermeticwiper.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 stories/hermeticwiper.yml diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml new file mode 100644 index 0000000000..885a354c60 --- /dev/null +++ b/stories/hermeticwiper.yml @@ -0,0 +1,23 @@ +name: Hermetic Wiper +id: +version: 1 +date: '2022-03-02' +author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk +description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities + that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic + story looks for abuse of Regsvr32, Executables written in administrative SMB Share, Suspcious processes, Disabling of Memory Crash DUmp and more. +narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting + multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. +references: +- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/ +- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a +tags: + analytic_story: Hermetic Wiper + category: + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 25c0e67f5c0a21958ddcc14ba906859391eb1b5c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 12:13:51 -0800 Subject: [PATCH 34/40] adding ssa_package with risk sev --- ...ohibited_applications_spawning_cmd_exe.yml | 18 ++- .../ssa___windows_bits_job_persistence.yml | 106 +++++++++++++++++ .../ssa___windows_bitsadmin_download_file.yml | 110 ++++++++++++++++++ .../ssa___windows_certutil_decode_file.yml | 106 +++++++++++++++++ ...a___windows_certutil_urlcache_download.yml | 101 ++++++++++++++++ ...___windows_certutil_verifyctl_download.yml | 102 ++++++++++++++++ ...a___windows_diskshadow_proxy_execution.yml | 99 ++++++++++++++++ .../srs/ssa___windows_eventvwr_uac_bypass.yml | 99 ++++++++++++++++ ..._windows_powershell_start-bitstransfer.yml | 103 ++++++++++++++++ .../ssa___windows_rasautou_dll_execution.yml | 101 ++++++++++++++++ 10 files changed, 935 insertions(+), 10 deletions(-) create mode 100644 dist/ssa/srs/ssa___windows_bits_job_persistence.yml create mode 100644 dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml create mode 100644 dist/ssa/srs/ssa___windows_certutil_decode_file.yml create mode 100644 dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml create mode 100644 dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml create mode 100644 dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml create mode 100644 dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml create mode 100644 dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml create mode 100644 dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 45c1a2f14a..9be3a7d033 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -20,20 +20,18 @@ references: risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating. -search: '| from read_ssa_enriched_events() - - | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) - | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), - parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", - null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event, - "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null) - | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), + "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), + "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", + null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"), + "string", null) | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe" - AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%")))) + AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false))) OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%")))) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml new file mode 100644 index 0000000000..174f8227ff --- /dev/null +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -0,0 +1,106 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-15' +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. + The query identifies the parameters used to create, resume or add a file to a BITS + job. Typically seen combined in a oneliner or ran in sequence. If identified, review + the BITS job created and capture any files written to disk. It is possible for BITS + to be used to upload files and this may require further network data analysis to + identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +id: 1e25e97a-8ea4-11ec-9767-acde48001122 +known_false_positives: Limited false positives will be present. Typically, applications + will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments + (legitimate applications) or parent process. +name: Windows Bits Job Persistence +product: +- Splunk Behavioral Analytics +references: +- https://attack.mitre.org/techniques/T1197/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute +- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe" + AND (like (cmd_line, "%create%") OR like (cmd_line, "%addfile%")OR like (cmd_line, + "%setnotifyflags%") OR like (cmd_line, "%setnotifycmdline%") OR like (cmd_line, + "%setminretrydelay%") OR like (cmd_line, "%setcustomheaders%") OR like (cmd_line, + "%resume%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +tags: + analytic_story: + - BITS Jobs + - Living Off The Land + automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. + mitre_attack_id: + - T1197 + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 56 + risk_severity: medium + security_domain: endpoint +test: + name: Windows Bits Job Persistence Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + file_name: bits-windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_bits_job_persistence.yml + name: Windows Bits Job Persistence + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml new file mode 100644 index 0000000000..8f504a9a0b --- /dev/null +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -0,0 +1,110 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-16' +description: The following query identifies Microsoft Background Intelligent Transfer + Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote + object. In addition, look for `download` or `upload` on the command-line, the switches + are not required to perform a transfer. Capture any files downloaded. Review the + reputation of the IP or domain used. Typically once executed, a follow on command + will be used to execute the dropped file. Note that the network connection or file + modification events related will not spawn or create from `bitsadmin.exe`, but the + artifacts will appear in a parallel process of `svchost.exe` with a command-line + similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel + and child processes to capture any behaviors and artifacts. In some suspicious and + malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` + to list out the jobs during investigation. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +id: d76e8188-8f5a-11ec-ace4-acde48001122 +known_false_positives: Limited false positives, however it may be required to filter + based on parent process name or network connection. +name: Windows Bitsadmin Download File +product: +- Splunk Behavioral Analytics +references: +- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download +- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md +- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bitsadmin.exe" + AND (like (cmd_line, "%transfer%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Ingress Tool Transfer + - BITS Jobs + - DarkSide Ransomware + - Living Off The Land + automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1197 + - T1105 + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 49 + risk_severity: low + security_domain: endpoint +test: + name: Windows Bitsadmin Download File Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log + file_name: bits-windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_bitsadmin_download_file.yml + name: Windows Bitsadmin Download File + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml new file mode 100644 index 0000000000..b1d9df05f7 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -0,0 +1,106 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-16' +description: CertUtil.exe may be used to `encode` and `decode` a file, including PE + and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` + and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded + file that was downloaded. Once decoded, it will be loaded by a parallel process. + Note that there are two additional command switches that may be used - `encodehex` + and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for + further execution. During triage, identify the source of the file being decoded. + Review its contents or execution behavior for further analysis. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +id: b06983f4-8f72-11ec-ab50-acde48001122 +known_false_positives: Typically seen used to `encode` files, but it is possible to + see legitimate use of `decode`. Filter based on parent-child relationship, file + paths, endpoint or user. +name: Windows CertUtil Decode File +product: +- Splunk Behavioral Analytics +references: +- https://attack.mitre.org/techniques/T1140/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil +- https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file + on disk. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%decode%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Deobfuscate-Decode Files or Information + - Living Off The Land + automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/ master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log + impact: 50 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to decode a file + on disk. + mitre_attack_id: + - T1140 + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 40 + risk_severity: low + security_domain: endpoint +test: + name: Windows CertUtil Decode File Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log + file_name: windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_certutil_decode_file.yml + name: Windows CertUtil Decode File + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml new file mode 100644 index 0000000000..02ae17f5a1 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -0,0 +1,101 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-16' +description: Certutil.exe may download a file from a remote destination using `-urlcache`. + This behavior does require a URL to be passed on the command-line. In addition, + `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will + be used. It is not entirely common for `certutil.exe` to contact public IP space. + However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ + During triage, capture any files on disk and review. Review the reputation of the + remote IP or domain in question. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +id: 8cb1ad38-8f6d-11ec-87a3-acde48001122 +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +name: Windows CertUtil URLCache Download +product: +- Splunk Behavioral Analytics +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%urlcache%") AND like (cmd_line, "%split%")) OR (like (cmd_line, + "%urlcache%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Ingress Tool Transfer + - DarkSide Ransomware + - Living Off The Land + automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Command and Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1105 + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 90 + risk_severity: high + security_domain: endpoint +test: + name: Windows CertUtil URLCache Download Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + file_name: T1105-windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_certutil_urlcache_download.yml + name: Windows CertUtil URLCache Download + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml new file mode 100644 index 0000000000..78fbe31f70 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -0,0 +1,102 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-16' +description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. + This behavior does require a URL to be passed on the command-line. In addition, + `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will + be used. It is not entirely common for `certutil.exe` to contact public IP space. + \ During triage, capture any files on disk and review. Review the reputation of + the remote IP or domain in question. Using `-VerifyCtl`, the file will either be + written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +id: 9ac29c40-8f6b-11ec-b19a-acde48001122 +known_false_positives: Limited false positives in most environments, however tune + as needed based on parent-child relationship or network connection. +name: Windows CertUtil VerifyCtl Download +product: +- Splunk Behavioral Analytics +references: +- https://attack.mitre.org/techniques/T1105/ +- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/ +- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl +- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="certutil.exe" + AND (like (cmd_line, "%verifyctl%") AND like (cmd_line, "%split%")) OR (like (cmd_line, + "%verifyctl%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Ingress Tool Transfer + - DarkSide Ransomware + - Living Off The Land + automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Command and Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1105 + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 90 + risk_severity: high + security_domain: endpoint +test: + name: Windows CertUtil VerifyCtl Download Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log + file_name: T1105-windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_certutil_verifyctl_download_.yml + name: Windows CertUtil VerifyCtl Download + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml new file mode 100644 index 0000000000..fd1496d2c7 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -0,0 +1,99 @@ +author: Lou Stella, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-17' +description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. + It has a scripting mode intended for complex scripted backup operations. This feature + also allows for execution of arbitrary unsigned code. This analytic looks for the + usage of the scripting mode flags in executions of DiskShadow. During triage, compare + to known backup behavior in your environment and then review the scripts called + by diskshadow. +how_to_implement: To successfully implement this search you need to be ingesting information + on processes that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +id: aa502688-9037-11ec-842d-acde48001122 +known_false_positives: Administrators using the DiskShadow tool in their infrastructure + as a main backup tool with scripts will cause false positives +name: Windows Diskshadow Proxy Execution +product: +- Splunk Behavioral Analytics +references: +- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="diskshadow.exe" + AND (like (cmd_line, "%-s%") OR like (cmd_line, "%/s%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Living Off The Land + cis20: + - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script. + mitre_attack_id: + - T1218 + nist: + - DE.CM + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: User + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 49 + risk_severity: low + security_domain: endpoint +test: + name: BA Windows Diskshadow Proxy Execution Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log + file_name: windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_diskshadow_proxy_execution.yml + name: BA Windows Diskshadow Proxy Execution + pass_condition: '@count_gt(0)' +type: Anomaly +version: 1 diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml new file mode 100644 index 0000000000..9956dd4fa7 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -0,0 +1,99 @@ +author: Lou Stella, Splunk +datamodel: +- Endpoint_Registry +date: '2022-02-18' +description: The following search identifies Eventvwr bypass by identifying the registry + modification into a specific path that eventvwr.msc looks to (but is not valid) + upon execution. A successful attack will include a suspicious command to be executed + upon eventvwr.msc loading. Upon triage, review the parallel processes that have + executed. Identify any additional registry modifications on the endpoint that may + look suspicious. Remediate as necessary. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Registry` datamodel. +id: 66adff66-90d9-11ec-aba7-acde48001122 +known_false_positives: None known at this time. +name: Windows Eventvwr UAC Bypass +product: +- Splunk Behavioral Analytics +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md +- https://attack.mitre.org/techniques/T1548/002 +- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ +risk_message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$ +search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), + registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), + registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", + null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), + "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), + "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), + "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), + "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", + registry_hive, "registry_value_name", registry_value_name, "registry_key_name", + registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", + registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Defense Evasion Tactics + - IcedID + - Living Off The Land + cis20: + - CIS 14 + confidence: 100 + context: + - Source:Endpoint + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log + impact: 80 + kill_chain_phases: + - Privilege Escalation + message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$ + mitre_attack_id: + - T1548.002 + - T1548 + nist: + - DE.AE + observable: + - name: dest_device_id + role: + - Victim + type: Hostname + - name: dest_user_id + role: + - Victim + type: User + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - event_id + - registry_path + - registry_hive + - registry_value_name + - registry_key_name + - registry_value_type + - registry_value_data + - process_guid + risk_score: 80 + risk_severity: high + security_domain: endpoint +test: + name: Windows Eventvwr UAC Bypass Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log + file_name: windows-sysmon-registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + file: endpoint/ssa___windows_eventvwr_uac_bypass.yml + name: Windows Eventvwr UAC Bypass + pass_condition: '@count_gt(0)' +type: Anomaly +version: 1 diff --git a/dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml new file mode 100644 index 0000000000..b15826348a --- /dev/null +++ b/dist/ssa/srs/ssa___windows_powershell_start-bitstransfer.yml @@ -0,0 +1,103 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-16' +description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar + functionality is present. This technique variation is not as commonly used by adversaries, + but has been abused in the past. Lesser known uses include the ability to set the + `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` + is used, it is highly possible files will be archived. During triage, review parallel + processes and process lineage. Capture any files on disk and review. For the remote + domain or IP, what is the reputation? +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +id: 0bafd086-8f61-11ec-996e-acde48001122 +known_false_positives: Limited false positives. It is possible administrators will + utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent + process or command-line arguments. +name: Windows PowerShell Start-BitsTransfer +product: +- Splunk Behavioral Analytics +references: +- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 +- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%start-bitstransfer%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +tags: + analytic_story: + - BITS Jobs + - Living Off The Land + automated_detection_testing: passed + cis20: [] + confidence: 70 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $dest_user_id$ attempting to download a file. + mitre_attack_id: + - T1197 + - T1105 + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 49 + risk_severity: low + security_domain: endpoint +test: + name: Windows PowerShell Start-BitsTransfer Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log + file_name: T1197_windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_powershell_start_bitstransfer.yml + name: Windows PowerShell Start-BitsTransfer + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml new file mode 100644 index 0000000000..54080ee24b --- /dev/null +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -0,0 +1,101 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-15' +description: The following analytic identifies the Windows Windows Remote Auto Dialer, + rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary + shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review + parent and child process behavior including file and image loads. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +id: 6f42b8ce-1e15-11ec-ad5a-acde48001122 +known_false_positives: False positives will be limited to applications that require + Rasautou.exe to load a DLL from disk. Filter as needed. +name: Windows Rasautou DLL Execution +product: +- Splunk Behavioral Analytics +references: +- https://github.com/mandiant/DueDLLigence +- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1 +- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 +- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to load a DLL in a suspicious manner. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rasautou.exe" + AND (like (cmd_line, "%-d %") AND like (cmd_line, "%-p %")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Living Off The Land + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to load a DLL in a suspicious manner. + mitre_attack_id: + - T1055.001 + - T1218 + - T1055 + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + risk_severity: high + security_domain: endpoint +test: + name: Windows Rasautou DLL Execution Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log + file_name: windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_rasautou_dll_execution.yml + name: Windows Rasautou DLL Execution + pass_condition: '@count_gt(0)' +type: TTP +version: 1 From b8cc27d347910747e0933c99925d18c47b04a3ca Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 12:35:56 -0800 Subject: [PATCH 35/40] tag with hermetic --- detections/endpoint/cmd_carry_out_string_command_parameter.yml | 1 + .../executable_file_written_in_administrative_smb_share.yml | 1 + .../executables_or_script_creation_in_suspicious_path.yml | 1 + .../endpoint/regsvr32_silent_and_install_param_dll_loading.yml | 1 + detections/endpoint/suspicious_process_file_path.yml | 1 + detections/endpoint/windows_disable_memory_crash_dump.yml | 1 + .../windows_file_without_extension_in_critical_folder.yml | 1 + ...windows_modify_show_compress_color_and_info_tip_registry.yml | 1 + .../endpoint/windows_raw_access_to_disk_volume_partition.yml | 1 + .../endpoint/windows_raw_access_to_master_boot_record_drive.yml | 1 + stories/hermeticwiper.yml | 2 +- 11 files changed, 11 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index d58d8970f2..da15eb4ccf 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -33,6 +33,7 @@ tags: - IcedID - Log4Shell CVE-2021-44228 - WhisperGate + - Hermetic Wiper automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 223f9a1c16..9cbc6bb8d5 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Active Directory Lateral Movement - Trickbot + - Hermetic Wiper automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index ee081a33d7..f3b5cf9ca5 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -38,6 +38,7 @@ tags: - XMRig - Remcos - WhisperGate + - Hermetic Wiper automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 8535dac57e..013a7e4816 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Suspicious Regsvr32 Activity - Remcos + - Hermetic Wiper automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 17c24c545f..ce259ece01 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -35,6 +35,7 @@ tags: - XMRig - Remcos - WhisperGate + - Hermetic Wiper automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 5216175c4c..9701eaf13d 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Data Destruction - Ransomware + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index aa1a544d87..43ea51dc14 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Data Destruction + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index ff86c50101..3bd4c393a3 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 5473f738bd..26626f743c 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Data Destruction + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 30f88fdb60..59781686b4 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - WhisperGate + - Hermetic Wiper dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log kill_chain_phases: diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml index 885a354c60..4f7c832a2e 100644 --- a/stories/hermeticwiper.yml +++ b/stories/hermeticwiper.yml @@ -1,5 +1,5 @@ name: Hermetic Wiper -id: +id: b7511c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk From 39fca1d7ac84ba46cbc15e130c7605764b25b6b8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 12:48:39 -0800 Subject: [PATCH 36/40] update desc --- stories/hermeticwiper.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stories/hermeticwiper.yml b/stories/hermeticwiper.yml index 4f7c832a2e..6e026c761b 100644 --- a/stories/hermeticwiper.yml +++ b/stories/hermeticwiper.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-03-02' author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities - that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic - story looks for abuse of Regsvr32, Executables written in administrative SMB Share, Suspcious processes, Disabling of Memory Crash DUmp and more. + that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more. narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction. references: From 28527a48a50a51ad08d992c066a4c84f928099e8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 13:06:08 -0800 Subject: [PATCH 37/40] ssa package --- .../srs/ssa___windows_mshta_child_process.yml | 107 +++++++++++++++++ .../ssa___windows_mshta_command-line_url.yml | 109 +++++++++++++++++ ...a___windows_mshta_inline_hta_execution.yml | 107 +++++++++++++++++ ..._windows_rundll32_inline_hta_execution.yml | 112 ++++++++++++++++++ 4 files changed, 435 insertions(+) create mode 100644 dist/ssa/srs/ssa___windows_mshta_child_process.yml create mode 100644 dist/ssa/srs/ssa___windows_mshta_command-line_url.yml create mode 100644 dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml create mode 100644 dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml new file mode 100644 index 0000000000..bc8fc0c0d9 --- /dev/null +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -0,0 +1,107 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-23' +description: The following analytic identifies child processes spawning from "mshta.exe". + The search will return the first time and last time these command-line arguments + were used for these executions, as well as the target system, the user, parent process + "mshta.exe" and its child process. +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +id: f63f7e9c-9526-11ec-9fc7-acde48001122 +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +name: Windows MSHTA Child Process +product: +- Splunk Behavioral Analytics +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote + destination to download an additional payload. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT + NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR + process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe" + OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe" + OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe" OR process_name="wscript.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + cis20: + - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote + destination to download an additional payload. + mitre_attack_id: + - T1218.005 + - T1218 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + risk_severity: high + security_domain: endpoint +test: + name: Windows MSHTA Child Process Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + file_name: windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_mshta_child_process.yml + name: Windows MSHTA Child Process + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_mshta_command-line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command-line_url.yml new file mode 100644 index 0000000000..60ef667e7a --- /dev/null +++ b/dist/ssa/srs/ssa___windows_mshta_command-line_url.yml @@ -0,0 +1,109 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-23' +description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) + utility is used to make remote http connections. Adversaries may use mshta.exe to + proxy the download and execution of remote .hta files. The analytic identifies command + line arguments of http and https being used. This technique is commonly used by + malicious software to bypass preventative controls. The search will return the first + time and last time these command-line arguments were used for these executions, + as well as the target system, the user, process "rundll32.exe" and its parent process. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +id: 9b35c538-94ef-11ec-9439-acde48001122 +known_false_positives: It is possible legitimate applications may perform this behavior + and will need to be filtered. +name: Windows MSHTA Command-Line URL +product: +- Splunk Behavioral Analytics +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote + destination to download an additional payload. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" + AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + cis20: + - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote + destination to download an additional payload. + mitre_attack_id: + - T1218.005 + - T1218 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + risk_severity: high + security_domain: endpoint +test: + name: Windows MSHTA Command-Line URL Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + file_name: windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_mshta_command_line_url.yml + name: Windows MSHTA Command-Line URL + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml new file mode 100644 index 0000000000..d3c940e30f --- /dev/null +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -0,0 +1,107 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-23' +description: The following analytic identifies "mshta.exe" execution with inline protocol + handlers. "JavaScript", "VBScript", and "About" are the only supported options when + invoking HTA content directly on the command-line. The search will return the first + time and last time these command-line arguments were used for these executions, + as well as the target system, the user, process "mshta.exe" and its parent process. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +id: 24962154-9524-11ec-9333-acde48001122 +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +name: Windows MSHTA Inline HTA Execution +product: +- Splunk Behavioral Analytics +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, indicative + of defense evasion. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="mshta.exe" + AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, + "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Suspicious MSHTA Activity + - Living Off The Land + cis20: + - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ executing with inline HTA, + indicative of defense evasion. + mitre_attack_id: + - T1218.005 + - T1218 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + risk_severity: high + security_domain: endpoint +test: + name: Windows MSHTA Inline HTA Execution Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + file_name: windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_mshta_inline_hta_execution.yml + name: Windows MSHTA Inline HTA Execution + pass_condition: '@count_gt(0)' +type: TTP +version: 1 diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml new file mode 100644 index 0000000000..01067f33bc --- /dev/null +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -0,0 +1,112 @@ +author: Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-23' +description: The following analytic identifies "rundll32.exe" execution with inline + protocol handlers. "JavaScript", "VBScript", and "About" are the only supported + options when invoking HTA content directly on the command-line. This type of behavior + is commonly observed with fileless malware or application whitelisting bypass techniques. + The search will return the first time and last time these command-line arguments + were used for these executions, as well as the target system, the user, process + "rundll32.exe" and its parent process. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +id: 0caa1dd6-94f5-11ec-9786-acde48001122 +known_false_positives: Although unlikely, some legitimate applications may exhibit + this behavior, triggering a false positive. +name: Windows Rundll32 Inline HTA Execution +product: +- Splunk Behavioral Analytics +references: +- https://github.com/redcanaryco/AtomicTestHarnesses +- https://redcanary.com/blog/introducing-atomictestharnesses/ +- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing +risk_message: Suspicious $process_name$ inline HTA execution on $dest_device_id$. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="rundll32.exe" + AND (like (cmd_line, "%vbscript%") OR like (cmd_line, "%javascript%") OR like (cmd_line, + "%about%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Suspicious MSHTA Activity + - NOBELIUM Group + - Living Off The Land + asset_type: Endpoint + automated_detection_testing: passed + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Suspicious $process_name$ inline HTA execution on $dest_device_id$. + mitre_attack_id: + - T1218 + - T1218.005 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + - name: process_name + role: + - Child Process + type: Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 56 + risk_severity: medium + security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon +test: + name: Windows Rundll32 Inline HTA Execution Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log + file_name: windows-security.log + source: WinEventLog:Security + file: endpoint/ssa___windows_rundll32_inline_hta_execution.yml + name: Windows Rundll32 Inline HTA Execution + pass_condition: '@count_gt(0)' +type: TTP +version: 1 From a0373e14a3441ea65fe42150a27081170dffd391 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 2 Mar 2022 14:37:48 -0800 Subject: [PATCH 38/40] add -r --- .github/workflows/build-and-validate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index f379cdd4fe..fea87e24ff 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -460,7 +460,7 @@ jobs: GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_ACCESS_TOKEN }} run: | source venv/bin/activate - python3 -m pip install security_content_automation/requirements.txt + python3 -m pip install -r security_content_automation/requirements.txt python3 security_content_automation/enrich_detections.py - name: Make YAMLs Pretty From 9746970a9729cb3a261b7ca30341a0c77c06eb27 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 3 Mar 2022 09:32:34 -0800 Subject: [PATCH 39/40] update github_token --- .github/workflows/build-and-validate.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index fea87e24ff..415a8a0e64 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -457,10 +457,9 @@ jobs: - name: Enrich detections with TAs env: - GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_ACCESS_TOKEN }} + GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | source venv/bin/activate - python3 -m pip install -r security_content_automation/requirements.txt python3 security_content_automation/enrich_detections.py - name: Make YAMLs Pretty From 2563d62bacd466554dc6e2d1abfdd8628ef49fac Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 3 Mar 2022 09:33:31 -0800 Subject: [PATCH 40/40] error --- .github/workflows/build-and-validate.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index 415a8a0e64..3fac4bde08 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -460,6 +460,7 @@ jobs: GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | source venv/bin/activate + python3 -m pip install -r security_content_automation/requirements.txt python3 security_content_automation/enrich_detections.py - name: Make YAMLs Pretty