admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

generate ssa package

Browse Source
This commit is contained in:
P4T12ICK
2022-02-07 10:24:36 +01:00
parent 651ca6d1b5
commit 968d52d2f3
43 changed files with 3309 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_core/application/adapter/adapter.py
+1 -1
View File
@@ -35,5 +35,5 @@ class Adapter(abc.ABC):
pass
@abc.abstractmethod
def writeObjects(self, objects: list, security_content_folder: str) -> None:
def writeObjects(self, objects: list, output_path: str) -> None:
pass
bin/contentctl_project/contentctl_core/application/factory/ba_factory.py
+1 -1
View File
@@ -47,7 +47,7 @@ class BAFactory():
for file in files:
if 'ssa__' in file:
if type == SecurityContentType.detections:
self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], [])
self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], self.output_dto.tests)
detection = self.input_dto.detection_builder.getObject()
if not detection.deprecated and not detection.experimental:
self.output_dto.detections.append(detection)
bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py
+2
View File
@@ -162,6 +162,8 @@ class ContentChanger:
def change_test_file_format(self, objects : list) -> None:
for obj in objects:
new_obj = dict()
new_obj['name'] = obj['name']
obj['name'] = obj['tests'][0]['name']
new_dict = obj['tests'][0]
new_dict.pop('name')
bin/contentctl_project/contentctl_core/application/use_cases/generate.py
+11 -5
View File
@@ -6,6 +6,7 @@ from dataclasses import dataclass
from contentctl_core.domain.entities.enums.enums import SecurityContentProduct
from contentctl_core.application.adapter.adapter import Adapter
from contentctl_core.application.factory.factory import FactoryInputDto, Factory, FactoryOutputDto
from contentctl_core.application.factory.ba_factory import BAFactoryInputDto, BAFactory, BAFactoryOutputDto
@@ -13,14 +14,16 @@ from contentctl_core.application.factory.factory import FactoryInputDto, Factory
class GenerateInputDto:
output_path: str
factory_input_dto: FactoryInputDto
ba_factory_input_dto: BAFactoryInputDto
adapter : Adapter
product: SecurityContentProduct
class Generate:
def execute(self, input_dto: GenerateInputDto) -> None:
if input_dto.factory_input_dto.product == SecurityContentProduct.ESCU:
if input_dto.product == SecurityContentProduct.ESCU:
factory_output_dto = FactoryOutputDto([],[],[],[],[],[],[],[])
factory = Factory(factory_output_dto)
factory.execute(input_dto.factory_input_dto)
@@ -32,12 +35,15 @@ class Generate:
input_dto.adapter.writeLookups(factory_output_dto.lookups, input_dto.output_path, input_dto.factory_input_dto.input_path)
input_dto.adapter.writeMacros(factory_output_dto.macros, input_dto.output_path)
elif input_dto.factory_input_dto.product == SecurityContentProduct.BA:
elif input_dto.product == SecurityContentProduct.BA:
shutil.rmtree(input_dto.output_path + '/srs/', ignore_errors=True)
shutil.rmtree(input_dto.output_path + '/complex/', ignore_errors=True)
os.makedirs(input_dto.output_path + '/complex/')
os.makedirs(input_dto.output_path + '/srs/')
# skip experimental and deprecated ssa detections
# differentiate between complex and srs by looking for stats|first_time_event|adaptive_threshold
# calculate risk_severity
# remove unused fields
factory_output_dto = BAFactoryOutputDto([],[])
factory = BAFactory(factory_output_dto)
factory.execute(input_dto.ba_factory_input_dto)
input_dto.adapter.writeObjects(factory_output_dto.detections, input_dto.output_path)
bin/contentctl_project/contentctl_core/tests/application/factory/test_ba_factory.py
+4 -1
View File
@@ -23,4 +23,7 @@ def test_factory_BA():
factory = BAFactory(output_dto)
factory.execute(input_dto)
print(output_dto.detections[0])
for detection in output_dto.detections:
if not detection.test:
raise AssertionError("test file missing for ssa detection: " + detection.name)
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_conf_adapter.py
+1 -1
View File
@@ -97,5 +97,5 @@ class ObjToConfAdapter(Adapter):
pass
def writeObjects(self, objects: list, security_content_folder: str) -> None:
def writeObjects(self, objects: list, output_path: str) -> None:
pass
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
+18 -5
View File
@@ -36,19 +36,32 @@ class ObjToYmlAdapter(Adapter):
object.pop('experimental')
YmlWriter.writeYmlFile(file_path, object)
def writeObjects(self, objects: list, security_content_folder: str) -> None:
def writeObjects(self, objects: list, output_path: str) -> None:
for obj in objects:
file_name = "ssa___" + self.convertNameToFileName(obj)
if self.isComplexBARule(obj.search):
file_path = os.path.join(security_content_folder, 'complex', file_name)
file_path = os.path.join(output_path, 'complex', file_name)
else:
file_path = os.path.join(security_content_folder, 'srs', file_name)
file_path = os.path.join(output_path, 'srs', file_name)
# remove unncessary fields
YmlWriter.writeYmlFile(file_path, object)
YmlWriter.writeYmlFile(file_path, obj.dict(
exclude =
{
"tags": {"detections": True , "deployments": True},
"deprecated": True,
"experimental": True,
"deployment": True,
"annotations": True,
"risk": True,
"playbooks": True,
"baselines": True,
"mappings": True,
"test": {"earliest_time": True , "latest_time": True, "baselines": True}
}))
def convertNameToFileName(self, obj: dict):
file_name = obj['name'] \
file_name = obj.name \
.replace(' ', '_') \
.replace('-','_') \
.replace('.','_') \
bin/contentctl_project/main/contentctl.py
+25 -7
View File
@@ -7,7 +7,8 @@ sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..')
from contentctl_core.application.use_cases.content_changer import ContentChanger, ContentChangerInputDto
from contentctl_core.application.use_cases.generate import GenerateInputDto, Generate
from contentctl_core.application.use_cases.validate import ValidateInputDto, Validate
from contentctl_core.application.factory.factory import Factory, FactoryInputDto, FactoryOutputDto
from contentctl_core.application.factory.factory import FactoryInputDto
from contentctl_core.application.factory.ba_factory import BAFactoryInputDto
from contentctl_core.application.factory.object_factory import ObjectFactoryInputDto
from contentctl_infrastructure.builder.security_content_object_builder import SecurityContentObjectBuilder
from contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
@@ -93,16 +94,33 @@ def generate(args) -> None:
SecurityContentStoryBuilder(),
SecurityContentBaselineBuilder(),
SecurityContentInvestigationBuilder(),
SecurityContentDirector(),
SecurityContentProduct[args.product]
SecurityContentDirector()
)
generate_input_dto = GenerateInputDto(
os.path.abspath(args.output),
factory_input_dto,
ObjToConfAdapter()
ba_factory_input_dto = BAFactoryInputDto(
os.path.abspath(args.path),
SecurityContentBasicBuilder(),
SecurityContentDetectionBuilder(),
SecurityContentDirector()
)
if args.product == "ESCU":
generate_input_dto = GenerateInputDto(
os.path.abspath(args.output),
factory_input_dto,
ba_factory_input_dto,
ObjToConfAdapter(),
SecurityContentProduct.ESCU
)
else:
generate_input_dto = GenerateInputDto(
os.path.abspath(args.output),
factory_input_dto,
ba_factory_input_dto,
ObjToYmlAdapter(),
SecurityContentProduct.BA
)
generate = Generate()
generate.execute(generate_input_dto)
dist/ssa/complex/ssa___detect_kerberoasting.yml
Vendored
+92
View File
@@ -0,0 +1,92 @@
name: Detect Kerberoasting
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
version: 2
date: '2020-10-21'
author: Xiao Lin, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search detects a potential kerberoasting attack via service principal
name requests
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id,
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();'
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
generate false positives
references:
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
tags:
name: Detect Kerberoasting
analytic_story:
- Credential Dumping
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
- CIS 16
confidence: 20
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset: null
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Kerberoasting malware is potentially applying stolen credentials. Operation
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
command $cmd_line$
mitre_attack_id:
- T1558.003
- T1558
nist:
- DE.CM
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
- name: cmd_line
type: Process
role:
- Other
product:
- Splunk Behavioral Analytics
required_fields:
- service_name
- _time
- event_code
- ticket_encryption_type
- service_id
- ticket_options
risk_score: 14
security_domain: endpoint
risk_severity: low
test:
name: Detect Kerberoasting
file: endpoint/ssa___detect_kerberoasting.yml
pass_condition: '@count_eq(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___excessive_number_of_office_files_copied.yml
Vendored
+74
View File
@@ -0,0 +1,74 @@
name: Excessive Number of Office Files Copied
id: 3c6594a9-8df6-45a1-9357-d73b62083c63
version: 1
date: '2021-12-07'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel:
- Endpoint_Filesystem
description: This detection detects a high amount of office file copied. This can
be an indicator for a malicious insider.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
| where "Endpoint_Filesystem" IN(_datamodels) | where action="created" | where like(file_name,
"%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") | stats count(file_name)
AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) | where count > 20
| eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
known_false_positives: user may copy a lot of office fies from one folder to another
references: []
tags:
name: Excessive Number of Office Files Copied
analytic_story: []
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 80
context:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
impact: 90
kill_chain_phases:
- Exploitation
message: High number of files copied
mitre_attack_id:
- T1048.003
nist: null
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- action
- process
- file_name
- file_path
risk_score: 72
security_domain: endpoint
risk_severity: medium
test:
name: Excessive Number of Office Files Copied
file: endpoint/ssa___excessive_number_of_office_files_copied.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
source: xmlwineventlog
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___first_time_seen_command_line_argument.yml
Vendored
+99
View File
@@ -0,0 +1,99 @@
name: First time seen command line argument
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
version: 4
date: '2021-11-30'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: This search looks for command-line arguments that use a `/c` parameter
to execute a command that has not previously been seen. This is an implementation
on SPL2 of the rule `First time seen command line argument` by @bpatel. 'The following
analytic identifies first time seen command-line arguments on a single endpoint.
The analytic looks for arguments instantiated by `cmd.exe /c` and the associated
command-line. Adversaries automate or spawn multiple processes using this method,
this analytic may assist with identifying the first time it's been found on this
endpoint.'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
"GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
\/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Legitimate programs use command-line arguments to execute.
Verify the command-line arguments to check what command/program is being executed.
Filtering will be needed.
references: []
tags:
name: First time seen command line argument
analytic_story:
- Unusual Processes
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 3
- CIS 8
confidence: 60
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset: null
impact: 50
kill_chain_phases:
- Command and Control
- Actions on Objectives
message: A process $process_name$ ha been identified in the environment with a command-line
$cmd_line$ not previously seen before on host $dest_device_id$
mitre_attack_id:
- T1059
- T1202
nist:
- PR.PT
- DE.CM
- PR.IP
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
- cmd_line
risk_score: 30
security_domain: endpoint
risk_severity: low
test:
name: First time seen command line argument
file: endpoint/ssa___first_time_seen_cmd_line.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_arguments/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___high_file_deletion_frequency.yml
Vendored
+86
View File
@@ -0,0 +1,86 @@
name: High File Deletion Frequency
id: b6200efd-13bd-4336-920a-057b25bbcfaf
version: 1
date: '2021-12-07'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel:
- Endpoint_Filesystem
description: This detection detects a high amount of file deletions in a short time
for specific file types. This can be an indicator for a malicious insider.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
| where "Endpoint_Filesystem" IN(_datamodels) | where action="deleted" | where like(file_name,
"%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") OR like(file_name,
"%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") OR like(file_name,
"%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") OR like(file_name,
"%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") OR like(file_name,
"%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") OR like(file_name,
"%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") OR like(file_name,
"%.js") | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp,
10m) | where count > 20 | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
known_false_positives: user may delete bunch of pictures or files in a folder.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
name: High File Deletion Frequency
analytic_story:
- Clop Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 80
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
impact: 90
kill_chain_phases:
- Exploitation
message: High frequency file deletion activity detected on host $Computer$
mitre_attack_id:
- T1485
nist: null
observable:
- name: user
type: User
role:
- Victim
- name: Computer
type: Endpoint
role:
- Victim
- name: deleted_files
type: File Name
role:
- Target
product:
- Splunk Behavioral Analytics
required_fields:
- action
- process
- file_name
- file_path
risk_score: 72
security_domain: endpoint
risk_severity: medium
test:
name: High File Deletion Frequency
file: endpoint/ssa___high_file_deletion_frequency.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
source: xmlwineventlog
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
Vendored
+105
View File
@@ -0,0 +1,105 @@
name: More than usual number of LOLBAS applications in short time period
id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
version: 2
date: '2020-08-25'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: Attacker activity may compromise executing several LOLBAS applications
in conjunction to accomplish their objectives. We are looking for more than usual
LOLBAS applications over a window of time, by building profiles per machine.
search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe"
OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe"
OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe"
OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe"
OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe"
OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe"
OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe"
OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe"
OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe"
OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe"
OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe"
OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe"
OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe"
OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe"
OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe"
OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe"
OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR
process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe"
OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe"
OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe"
OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by
device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
applications in a short period of time. This might trigger false positives at the
beginning when it hasn''t collected yet enough data to construct the baseline.
'
references:
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
tags:
name: More than usual number of LOLBAS applications in short time period
analytic_story:
- Unusual Processes
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset: null
impact: 50
kill_chain_phases:
- Exploitation
message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
period of time in host $dest_device_id$
mitre_attack_id:
- T1059
- T1053
nist:
- PR.PT
- DE.CM
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Other
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- _time
- process_name
risk_score: 25
security_domain: endpoint
risk_severity: low
test:
name: More than usual number of LOLBAS applications in short time period
file: endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: T1059.all.labeled.lolbas-test.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
Vendored
+110
View File
@@ -0,0 +1,110 @@
name: Potential Pass the Token or Hash Observed at the Destination Device
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
version: 3
date: '2021-11-30'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Authentication
description: This detection identifies potential Pass the Token or Pass the Hash credential
stealing. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by a detination device.
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string",
null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null),
signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)),
authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND dest_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
"long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id",
event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time",
startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time",
endNTLMTime])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from endpoint devices,
i.e., destinations of interest. Please make sure that event ID 4624 is being logged.
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
references:
- https://attack.mitre.org/techniques/T1550/002/
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
tags:
name: Potential Pass the Token or Hash Observed at the Destination Device
analytic_story:
- Active Directory Lateral Movement
asset_type: Windows
automated_detection_testing: null
cis20:
- CIS 16
- CIS 20
confidence: 90
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
- Stage:Lateral Movement
dataset: null
impact: 80
kill_chain_phases:
- Exploitation
message: Potential lateral movement and credential stealing via Pass the Token or
Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the destination device $dest_device_id$
mitre_attack_id:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Other
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- signature_id
- dest_user
- dest_user_id
- dest_device_id
- authentication_method
risk_score: 72
security_domain: endpoint
risk_severity: medium
test:
name: Potential Pass the Token or Hash Observed at the Destination Device
file: endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_dest_dataset.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
Vendored
+111
View File
@@ -0,0 +1,111 @@
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
version: 2
date: '2021-11-05'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Authentication
description: This detection identifies potential Pass the Token or Pass the Hash credential
stealing. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by an event-collecting device (i.e., a specific domain controller or an endpoint
destination).
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string",
null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string",
null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string",
null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
AND dest_user_id != null AND origin_device_id != null
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos,
"total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest
- at least from domain controllers. Please make sure that event ID 4624 is being
logged.
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
references:
- https://attack.mitre.org/techniques/T1550/002/
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
tags:
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
analytic_story:
- Active Directory Lateral Movement
asset_type: Windows
automated_detection_testing: null
cis20:
- CIS 16
- CIS 20
confidence: 80
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
- Stage:Lateral Movement
dataset: null
impact: 80
kill_chain_phases:
- Exploitation
message: Potential lateral movement and credential stealing via Pass the Token or
Pass the Hash techniques. Operation is performed via credentials of the account
$dest_user_id$ and observed by the logging device $origin_device_id$
mitre_attack_id:
- T1550
- T1550.002
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: origin_device_id
type: Hostname
role:
- Other
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- signature_id
- dest_user
- dest_user_id
- origin_device_id
- authentication_method
risk_score: 64
security_domain: endpoint
risk_severity: medium
test:
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
file: endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_DC_dataset.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___rare_parent_child_process_relationship.yml
Vendored
+115
View File
@@ -0,0 +1,115 @@
name: Rare Parent-Child Process Relationship
id: cf090c78-bcc6-11eb-8529-0242ac130003
version: 2
date: '2021-11-30'
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This analytic leverages the Splunk
Streaming ML DSP plugin to find rare parent/child relationships. The list of application
has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
window=604800000L | where label AND input > mean | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
cmd_line]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: Some custom tools used by administrators could be used rarely
to launch remotely applications. This might trigger false positives at the beginning
when it has not collected yet enough data to construct the baseline.
references:
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
tags:
name: Rare Parent-Child Process Relationship
analytic_story:
- Unusual Processes
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
confidence: 50
context:
- Source:Endpoint
dataset: null
impact: 50
kill_chain_phases:
- Exploitation
message: Rare Parent-Child Process Relationship
mitre_attack_id:
- T1203
- T1059
- T1053
- T1072
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- process
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
- cmd_line
risk_score: 25
security_domain: endpoint
risk_severity: low
test:
name: Rare Parent-Child Process Relationship
file: endpoint/ssa___rare_parent_process_relationship_lolbas.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sec-events.out
data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sec-events.out
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/complex/ssa___unusually_long_command_line.yml
Vendored
+87
View File
@@ -0,0 +1,87 @@
name: Unusually Long Command Line
id: 58f43aba-1775-445e-b19c-be2b87d83ae3
version: 1
date: '2020-10-06'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: Command lines that are extremely long may be indicative of malicious
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
to help identify command lines with lengths that are unusual for a given user. This
detection is inspired on Unusually Long Command Line authored by Rico Valdez.
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
lines.
known_false_positives: This detection may flag suspiciously long command lines when
there is not sufficient evidence (samples) for a given process that this detection
is tracking; or when there is high variability in the length of the command line
for the tracked process. Also, some legitimate applications may use long command
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
Attackers may use this technique to obfuscate their payloads.
references: []
tags:
name: Unusually Long Command Line
analytic_story:
- Unusual Processes
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
confidence: 40
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset: null
impact: 30
kill_chain_phases:
- Actions on Objectives
message: A process $process_name$ with a long commandline $cmd_line$ executed in
host $dest_device_id$
mitre_attack_id: null
nist:
- PR.PT
- DE.CM
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
risk_score: 12
security_domain: endpoint
risk_severity: low
test:
name: Unusually Long Command Line
file: endpoint/ssa___unusually_long_command_line.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
Vendored
+95
View File
@@ -0,0 +1,95 @@
name: Anomalous usage of Archive Tools
id: 63614a58-10e2-4c6c-ae81-ea1113681439
version: 1
date: '2021-11-22'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: The following detection identifies the usage of archive tools from the
command line.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
"string", null)), process=lower(ucast(map_get(input_event, "process"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), parent_process=ucast(map_get(input_event, "parent_process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%")
OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name,
"%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name",
parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: False positives can be ligitmate usage of archive tools from
the command line.
references:
- https://attack.mitre.org/techniques/T1560/001/
tags:
name: Anomalous usage of Archive Tools
analytic_story:
- Cobalt Strike
- NOBELIUM Group
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 60
context:
- Source:Endpoint
- Stage:Collection
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
of 7zip.
mitre_attack_id:
- T1560.001
- T1560
nist: null
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
risk_score: 42
security_domain: endpoint
risk_severity: low
test:
name: Anomalous usage of Archive Tools
file: endpoint/ssa___anomalous_usage_of_archive_tools.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___attempt_to_delete_services.yml
Vendored
+104
View File
@@ -0,0 +1,104 @@
name: Attempt To Delete Services
id: a0c8c292-d01a-11eb-aa18-acde48001122
version: 3
date: '2021-11-24'
author: Teoderick Contreras, splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to delete a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then delete it.
Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
tags:
name: Attempt To Delete Services
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
- CIS 13
confidence: 60
context:
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
mitre_attack_id:
- T1489
- T1543
- T1543.003
nist:
- PR.DS
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 36
security_domain: endpoint
risk_severity: low
test:
name: Attempt To Delete Services
file: endpoint/ssa___attempt_to_delete_services.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: sc_del.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___attempt_to_disable_services.yml
Vendored
+103
View File
@@ -0,0 +1,103 @@
name: Attempt To Disable Services
id: afb31de4-d023-11eb-98d5-acde48001122
version: 3
date: '2021-11-24'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to disable a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then disable
it. Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
"_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%")
AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
tags:
name: Attempt To Disable Services
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 9
- CIS 8
confidence: 60
context:
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 36
security_domain: endpoint
risk_severity: low
test:
name: Attempt To Disable Services
file: endpoint/ssa___attempt_to_disable_services.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: sc_disable.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Vendored
+93
View File
@@ -0,0 +1,93 @@
name: Attempted Credential Dump From Registry via Reg exe
id: 14038953-e5f2-4daf-acff-5452062baf03
version: 2
date: '2021-11-29'
author: Jose Hernandez, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies the use of `reg.exe` attempting to
export Windows registry keys that contain hashed credentials. Adversaries will utilize
this technique to capture and perform offline password cracking.
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe"
OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true
AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line,
/(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line,
/(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time
= timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events(); '
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified.
references:
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
tags:
name: Attempted Credential Dump From Registry via Reg exe
analytic_story:
- Credential Dumping
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Endpoint
- Stage:Credential Access
dataset: null
impact: 70
kill_chain_phases:
- Actions on Objectives
message: An attempt to save registry keys storing credentials has been performed
on $dest_device_id$ by $dest_user_id$ via process $process_name$.
mitre_attack_id:
- T1003
- T1003.002
nist:
- DE.CM
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _time
- dest_device_id
- dest_user_id
- process
- cmd_line
risk_score: 63
security_domain: endpoint
risk_severity: medium
test:
name: Attempted Credential Dump From Registry via Reg exe
file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml
Vendored
+95
View File
@@ -0,0 +1,95 @@
name: BCDEdit Failure Recovery Modification
id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe"
AND (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
tags:
name: BCDEdit Failure Recovery Modification
analytic_story:
- Ryuk Ransomware
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
confidence: 80
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
impact: 100
kill_chain_phases:
- Actions on Objectives
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability
to recover the endpoint.
mitre_attack_id:
- T1490
nist:
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
security_domain: endpoint
risk_severity: high
test:
name: BCDEdit Failure Recovery Modification
file: endpoint/ssa___bcdedit_failure_recovery_modification.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___delete_a_net_user.yml
Vendored
+108
View File
@@ -0,0 +1,108 @@
name: Delete A Net User
id: 8776d79c-d26e-11eb-9a56-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
legitimate purposes, however this behavior has been used in the wild to impair some
user or deleting adversaries tracks created during its lateral movement additional
systems. During triage, review parallel processes for additional behavior. Identify
any other user accounts created before or after.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
name: Delete A Net User
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 4
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user
account.
mitre_attack_id:
- T1531
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 49
security_domain: endpoint
risk_severity: low
test:
name: Delete A Net User
file: endpoint/ssa___delete_a_net_user.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: net_user_del.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
- file_name: security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml
Vendored
+90
View File
@@ -0,0 +1,90 @@
name: Deny Permission using Cacls Utility
id: b76eae28-cd25-11eb-9c92-acde48001122
version: 3
date: '2021-11-29'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the deny permission on a file or directory. Adversaries
perform this behavior to prevent responders from reviewing or gaining access to
adversary files on disk.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: System administrators may use cacls utilities but this is not
a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
name: Deny Permission using Cacls Utility
analytic_story:
- XMRig
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 14
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
impact: 50
kill_chain_phases:
- Exploitation
message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
nist:
- PR.AC
- PR.IP
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
security_domain: endpoint
risk_severity: low
test:
name: Deny Permission using Cacls Utility
file: endpoint/ssa___deny_permission_using_cacls_utility.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: all_icalc.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml
Vendored
+84
View File
@@ -0,0 +1,84 @@
name: Detect Dump LSASS Memory using comsvcs
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
version: 2
date: '2021-11-29'
author: Jose Hernandez, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies credential dumping using comsvcs.dll
with `regsvr32.exe`. This technique is common with adversaries who would like to
dump the memory of lsass.exe and perform offline password cracking.
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
known_false_positives: False positives should be limited, filter as needed.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
tags:
name: Detect Dump LSASS Memory using comsvcs
analytic_story:
- Credential Dumping
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
- CIS 16
confidence: 100
context:
- Source:AD
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$
by user $dest_device_user$.
mitre_attack_id:
- T1003.003
- T1003
nist:
- DE.CM
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- _tenant
- _time
- dest_device_id
- process
risk_score: 70
security_domain: endpoint
risk_severity: medium
test:
name: Detect Dump LSASS Memory using comsvcs
file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
Vendored
+101
View File
@@ -0,0 +1,101 @@
name: Detect Prohibited Applications Spawning cmd exe
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
version: 2
date: '2020-11-10'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: The following analytic identifies parent processes, browsers, Windows
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
many applications spawn cmd.exe natively or built into macros. Much of this will
need to be tuned to further enhance the risk.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
"string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
| where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
| where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
"parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
how_to_implement: In order to successfully implement this analytic, you will need
endpoint process data from a EDR product or Sysmon. This search has been modified
to process raw sysmon data from attack_range's nxlogs on DSP.
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface.
references:
- https://attack.mitre.org/techniques/T1059/
tags:
name: Detect Prohibited Applications Spawning cmd exe
analytic_story:
- Suspicious Command-Line Executions
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset: null
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
that warrants investigating.
mitre_attack_id:
- T1059
nist:
- PR.PT
- DE.CM
observable:
- name: dest_user_id
type: User
role:
- Actor
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
- cmd_line
risk_score: 35
security_domain: endpoint
risk_severity: low
test:
name: Detect Prohibited Applications Spawning cmd exe
file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml
Vendored
+106
View File
@@ -0,0 +1,106 @@
name: Detect RClone Command-Line Usage
id: e8b74268-5454-11ec-a799-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This analytic identifies commonly used command-line arguments used by
`rclone.exe` to initiate a file transfer. Some arguments were negated as they are
specific to the configuration used by adversaries. In particular, an adversary may
list the files or directories of the remote file share using `ls` or `lsd`, which
is not indicative of malicious behavior. During triage, at this stage of a ransomware
event, exfiltration is about to occur or has already. Isolate the endpoint and continue
investigating by review file modifications and parallel processes.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe"
AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line,
"%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line,
"%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line,
"%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives should be limited as this is restricted to
the Rclone process name. Filter or tune the analytic as needed.
references:
- https://redcanary.com/blog/rclone-mega-extortion/
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
tags:
name: Detect RClone Command-Line Usage
analytic_story:
- DarkSide Ransomware
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 70
context:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
impact: 50
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a
remote cloud service to move files or folders.
mitre_attack_id:
- T1020
nist: null
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
security_domain: endpoint
risk_severity: low
test:
name: Detect RClone Command-Line Usage
file: endpoint/ssa___detect_rclone_command_line_usage.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___disable_net_user_account.yml
Vendored
+102
View File
@@ -0,0 +1,102 @@
name: Disable Net User Account
id: ba858b08-d26c-11eb-af9b-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This analytic will identify a suspicious command-line that disables a
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
may used by the adversaries to interrupt availability of accounts and continue the
impact against the organization.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%")
AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
used.
known_false_positives: System administrators or automated scripts may disable an account
but not a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
name: Disable Net User Account
analytic_story:
- XMRig
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 4
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
impact: 70
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
mitre_attack_id:
- T1489
- T1078
nist:
- PR.AC
- PR.IP
observable:
- name: user
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 49
security_domain: endpoint
risk_severity: low
test:
name: Disable Net User Account
file: endpoint/ssa___disable_net_user_account.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: net_user_dis.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
Vendored
+103
View File
@@ -0,0 +1,103 @@
name: DNS Exfiltration Using Nslookup App
id: 2452e632-9e0d-11eb-34ba-acde48001122
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search is to detect potential DNS exfiltration using nslookup application.
This technique are seen in couple of malware and APT group to exfiltrated collected
data in a infected machine or infected network. This detection is looking for unique
use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
commonly used by attacker and also the retry parameter which is designed to query
C2 DNS multiple tries.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe"
AND (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line,
"%-q=%") OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) | eval
start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: It is possible for some legitimate administrative utilities
to use similar cmd_line parameters. Filter as needed.
references:
- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
- https://www.varonis.com/blog/dns-tunneling/
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
tags:
name: DNS Exfiltration Using Nslookup App
analytic_story:
- Suspicious DNS Traffic
- Dynamic DNS
- Command and Control
- Data Exfiltration
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 80
context:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
impact: 90
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related
to DNS exfiltration.
mitre_attack_id:
- T1048
nist: null
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 72
security_domain: endpoint
risk_severity: medium
test:
name: DNS Exfiltration Using Nslookup App
file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___fsutil_zeroing_file.yml
Vendored
+96
View File
@@ -0,0 +1,96 @@
name: Fsutil Zeroing File
id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search is to detect a suspicious fsutil process to zeroing a target
file. This technique was seen in lockbit ransomware where it tries to zero out its
malware path as part of its defense evasion after encrypting the compromised host.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe"
AND (like (cmd_line, "%setzerodata%")) | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
tags:
name: Fsutil Zeroing File
analytic_story:
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 90
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset: []
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file
deletion.
mitre_attack_id:
- T1070
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 54
security_domain: endpoint
risk_severity: medium
test:
name: Fsutil Zeroing File
file: endpoint/ssa___fsutil_zeroing_file.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml
Vendored
+90
View File
@@ -0,0 +1,90 @@
name: Grant Permission Using Cacls Utility
id: c6da561a-cd29-11eb-ae65-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
or `xcacls.exe` placing the grant permission on a file or directory. Adversaries
perform this behavior to allow components of their files to run, however it allows
responders to review or gaining access to adversary files on disk.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: System administrators may use cacls utilities but this is not
a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
name: Grant Permission Using Cacls Utility
analytic_story:
- XMRig
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 14
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
impact: 50
kill_chain_phases:
- Exploitation
message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
user a permission to a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
nist:
- PR.AC
- PR.IP
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
security_domain: endpoint
risk_severity: low
test:
name: Grant Permission Using Cacls Utility
file: endpoint/ssa___grant_permission_using_cacls_utility.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: all_icalc.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml
Vendored
+93
View File
@@ -0,0 +1,93 @@
name: Modify ACLs Permission Of Files Or Folders
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
version: 2
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: This analytic identifies suspicious modification of ACL permission to
a files or folder to make it available to everyone or to a specific user. This technique
may be used by the adversary to evade ACLs or protected files access. This changes
is commonly configured by the file or directory owner with appropriate permission.
This behavior raises suspicion if this command is seen on an endpoint utilized by
an account with no permission to do so.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line,
/(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe"
OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
known_false_positives: System administrators may use this windows utility. filter
is needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
name: Modify ACLs Permission Of Files Or Folders
analytic_story:
- XMRig
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
- CIS 13
confidence: 70
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
impact: 50
kill_chain_phases:
- Exploitation
message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
nist:
- PR.DS
- PR.IP
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
security_domain: endpoint
risk_severity: low
test:
name: Modify ACLs Permission Of Files Or Folders
file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: all_icalc.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___resize_shadowstorage_volume.yml
Vendored
+102
View File
@@ -0,0 +1,102 @@
name: Resize Shadowstorage Volume
id: dbc30554-d27e-11eb-9e5e-acde48001122
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies the resizing of shadowstorage using
vssadmin.exe to avoid the shadow volumes being made again. This technique is typically
found used by adversaries during a ransomware event and a precursor to deleting
the shadowstorage.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%")
AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: System administrators may resize the shadowstorage for valid
purposes. Filter as needed.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
tags:
name: Resize Shadowstorage Volume
analytic_story:
- Clop Ransomware
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 10
- CIS 13
confidence: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow
copy to perform offline password cracking.
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 64
security_domain: endpoint
risk_severity: medium
test:
name: Resize Shadowstorage Volume
file: endpoint/ssa___resize_shadowstorage_volume.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___sdelete_application_execution.yml
Vendored
+110
View File
@@ -0,0 +1,110 @@
name: Sdelete Application Execution
id: fcc52b9a-4616-11ec-8454-acde48001122
version: 1
date: '2021-11-15'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: This analytic will detect the execution of sdelete.exe attempting to
delete potentially important files that may related to adversary or insider threats
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
to securely delete files on disk. This tool is commonly used to clear tracks and
artifact on the targeted host.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
"string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
(like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
%") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
"%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
"%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
"%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
"%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
"%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line,
"%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
"%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "process_path", process_path, "parent_process_name", parent_process_name,
"parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives should be limited, filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
tags:
name: Sdelete Application Execution
analytic_story:
- Information Sabotage
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 70
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
impact: 60
kill_chain_phases:
- Exploitation
message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
to permanently delete files by $dest_user_id$.
mitre_attack_id:
- T1485
- T1070.004
- T1070
nist: null
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest
- user
- parent_process_name
- parent_process
- process_name
- process
- process_id
- process_path
- cmd_line
risk_score: 42
security_domain: endpoint
risk_severity: low
test:
name: Sdelete Application Execution
file: endpoint/ssa___sdelete_application_execution.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
Vendored
+289
View File
@@ -0,0 +1,289 @@
name: System Process Running from Unexpected Location
id: 28179107-099a-464a-94d3-08301e6c055f
version: 3
date: '2020-08-25'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: An attacker tries might try to use different version of a system command
without overriding original, or they might try to avoid some detection running the
process from a different folder. This detection checks that a list of system processes
run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
"dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
$cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe"
OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe"
OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe"
OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe"
OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe"
OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe"
OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe"
OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR
process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR
process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe"
OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR
process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe"
OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe"
OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR
process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe"
OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe"
OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe"
OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe"
OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe"
OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe"
OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe"
OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe"
OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe"
OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR
process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe"
OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe"
OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe"
OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe"
OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe"
OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe"
OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe"
OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe"
OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe"
OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe"
OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe";
$cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe"
OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe"
OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe"
OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe"
OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe"
OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR
process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe"
OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR
process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe"
OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe"
OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR
process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe"
OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe"
OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe"
OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe"
OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe"
OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe"
OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe"
OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe"
OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe"
OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe"
OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe"
OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe"
OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe"
OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe"
OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR
process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR
process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe"
OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe"
OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe"
OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe"
OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe"
OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe"
OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe"
OR process_name="windowsanytimeupgraderesults.exe";
$cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR
process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe"
OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe"
OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe"
OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe"
OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe"
OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe"
OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe"
OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe"
OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe"
OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe"
OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe"
OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe"
OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe"
OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe"
OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe"
OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe"
OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe"
OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe"
OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe"
OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe"
OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe"
OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe"
OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe"
OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe"
OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe"
OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe"
OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe"
OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe"
OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe"
OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe"
OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe"
OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe"
OR process_name="easinvoker.exe" OR process_name="efsui.exe";
$cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe"
OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe"
OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe"
OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe"
OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe"
OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe"
OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe"
OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe"
OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe"
OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe"
OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe"
OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe"
OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe"
OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe"
OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe"
OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe"
OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe"
OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe"
OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe"
OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe"
OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe"
OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe"
OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe"
OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe"
OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe"
OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe"
OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe"
OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe"
OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe"
OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe"
OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe"
OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe"
OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe";
$cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe"
OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe"
OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe"
OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe"
OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe"
OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe"
OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe"
OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe"
OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe"
OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe"
OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe"
OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe"
OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe"
OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe"
OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe"
OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe"
OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe"
OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe"
OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe"
OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe"
OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe"
OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe"
OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe"
OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe"
OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe"
OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe"
OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe"
OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe"
OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe"
OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe"
OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe"
OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe"
OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe"
OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe";
$cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe"
OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe"
OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe"
OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe"
OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe"
OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe"
OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe"
OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe"
OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe"
OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe"
OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe"
OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe"
OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe"
OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe"
OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe"
OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe"
OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe"
OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe"
OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe"
OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
| from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: None
references: []
tags:
name: System Process Running from Unexpected Location
analytic_story:
- Windows Defense Evasion Tactics
- Masquerading - Rename System Utilities
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
confidence: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
folder path in host $dest_device_id$
mitre_attack_id:
- T1036
nist:
- PR.PT
- DE.CM
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- dest_device_id
- process_name
- _time
- dest_user_id
- process_path
risk_score: 56
security_domain: endpoint
risk_severity: medium
test:
name: System Process Running from Unexpected Location
file: endpoint/ssa___system_process_running_unexpected_location.yml
pass_condition: '@count_eq(1)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
Vendored
+99
View File
@@ -0,0 +1,99 @@
name: WBAdmin Delete System Backups
id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
Tool) that delete backup files. This is typically used by ransomware to prevent
recovery.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe"
AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
"%systemstatebackup%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
- https://thedfirreport.com/2020/10/08/ryuks-return/
- https://attack.mitre.org/techniques/T1490/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
tags:
name: WBAdmin Delete System Backups
analytic_story:
- Ryuk Ransomware
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
confidence: 50
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset: []
impact: 30
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system
backups.
mitre_attack_id:
- T1490
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 15
security_domain: endpoint
risk_severity: low
test:
name: WBAdmin Delete System Backups
file: endpoint/ssa___wbadmin_delete_system_backups.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml
Vendored
+95
View File
@@ -0,0 +1,95 @@
name: WevtUtil Usage To Clear Logs
id: 5438113c-cdd9-11eb-93b8-acde48001122
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup,
powershell, sysmon, or system event logs.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
/(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
/(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
/(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: The wevtutil.exe application is a legitimate Windows event
log utility. Administrators may use it to manage Windows event logs.
references:
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
tags:
name: WevtUtil Usage To Clear Logs
analytic_story:
- Windows Log Manipulation
- Ransomware
- Clop Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
- CIS 13
confidence: 90
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
impact: 70
kill_chain_phases:
- Exploitation
message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 63
security_domain: endpoint
risk_severity: medium
test:
name: WevtUtil Usage To Clear Logs
file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: clear_evt.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml
Vendored
+91
View File
@@ -0,0 +1,91 @@
name: Wevtutil Usage To Disable Logs
id: a4bdc944-cdd9-11eb-ac97-acde48001122
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search is to detect execution of wevtutil.exe to disable logs. This
technique was seen in several ransomware to disable the event logs to evade alerts
and detections in compromised host.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%")
AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
"process_path", process_path]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: network operator may disable audit event logs for debugging
purposes.
references:
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
tags:
name: Wevtutil Usage To Disable Logs
analytic_story:
- Windows Log Manipulation
- Ransomware
asset_type: Endpoint
automated_detection_testing: null
cis20:
- CIS 8
- CIS 13
confidence: 90
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
impact: 70
kill_chain_phases:
- Exploitation
message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
event logs in host $dest_device_id$
mitre_attack_id:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
observable:
- name: dest_device_id
type: Hostname
role:
- Victim
- name: dest_user_id
type: User
role:
- Victim
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
risk_score: 63
security_domain: endpoint
risk_severity: medium
test:
name: Wevtutil Usage To Disable Logs
file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: disable_evt.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
Vendored
+114
View File
@@ -0,0 +1,114 @@
name: Windows Curl Upload to Remote Destination
id: cc8d046a-543b-11ec-b864-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: 'The following analytic identifies the use of Windows Curl.exe uploading
a file to a remote destination. \
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
\
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
web application, and it is, for example, how most common HTML forms on the web work.
\
HTTP multipart formposts are done with `-F`, but this appears to not be compatible
with the Windows version of Curl. Will update if identified adversary tradecraft.
\
Adversaries may use one of the three methods based on the remote destination and
what they are attempting to upload (zip vs txt). During triage, review parallel
processes for further behavior. In addition, identify if the upload was successful
in network logs. If a file was uploaded, isolate the endpoint and review.'
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe"
AND (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line,
"%-d %") OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives may be limited to source control applications
and may be required to be filtered out.
references:
- https://everything.curl.dev/usingcurl/uploads
- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
- https://twitter.com/d1r4c/status/1279042657508081664?s=20
tags:
name: Windows Curl Upload to Remote Destination
analytic_story:
- Ingress Tool Transfer
asset_type: Endpoint
automated_detection_testing: null
cis20: null
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote
destination.
mitre_attack_id:
- T1105
nist: null
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
security_domain: endpoint
risk_severity: high
test:
name: Windows Curl Upload to Remote Destination
file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
source: WinEventLog:Security
sourcetype: null
update_timestamp: null
tests/endpoint/ssa___attempt_to_delete_services.test.yml
+1 -1
View File
@@ -1,4 +1,4 @@
name: Attempt To delete Services
name: Attempt To Delete Services
file: endpoint/ssa___attempt_to_delete_services.yml
pass_condition: '@count_gt(0)'
description: Test for usage of sc.exe to delete a service
tests/endpoint/ssa___detect_kerberoasting.test.yml
+1 -1
View File
@@ -1,4 +1,4 @@
name: Detect kerberoasting
name: Detect Kerberoasting
file: endpoint/ssa___detect_kerberoasting.yml
pass_condition: '@count_eq(0)'
description: Test detection of kerberoasting
tests/endpoint/ssa___fsutil_zeroing_file.test.yml
+1 -1
View File
@@ -1,4 +1,4 @@
name: FSUtil Zeroing File
name: Fsutil Zeroing File
file: endpoint/ssa___fsutil_zeroing_file.yml
pass_condition: '@count_gt(0)'
description: Test detection of FSUtil Zeroing File
tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml
+1 -1
View File
@@ -1,4 +1,4 @@
name: Rare Parent/Child Process Relationship with LOLBAS
name: Rare Parent-Child Process Relationship
file: endpoint/ssa___rare_parent_process_relationship_lolbas.yml
pass_condition: '@count_gt(0)'
description: Test detection looking for LOLBAS processes spawned by other processes