diff --git a/bin/contentctl_project/contentctl_core/application/adapter/adapter.py b/bin/contentctl_project/contentctl_core/application/adapter/adapter.py index 04988d3574..e3e0510751 100644 --- a/bin/contentctl_project/contentctl_core/application/adapter/adapter.py +++ b/bin/contentctl_project/contentctl_core/application/adapter/adapter.py @@ -35,5 +35,5 @@ class Adapter(abc.ABC): pass @abc.abstractmethod - def writeObjects(self, objects: list, security_content_folder: str) -> None: + def writeObjects(self, objects: list, output_path: str) -> None: pass \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py b/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py index 93e86466da..2731e36769 100644 --- a/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py +++ b/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py @@ -47,7 +47,7 @@ class BAFactory(): for file in files: if 'ssa__' in file: if type == SecurityContentType.detections: - self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], []) + self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], self.output_dto.tests) detection = self.input_dto.detection_builder.getObject() if not detection.deprecated and not detection.experimental: self.output_dto.detections.append(detection) diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py b/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py index 0daf0b825d..cd52c3d41b 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py @@ -162,6 +162,8 @@ class ContentChanger: def change_test_file_format(self, objects : list) -> None: for obj in objects: + new_obj = dict() + new_obj['name'] = obj['name'] obj['name'] = obj['tests'][0]['name'] new_dict = obj['tests'][0] new_dict.pop('name') diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/generate.py b/bin/contentctl_project/contentctl_core/application/use_cases/generate.py index 8fd1e8955c..b4c2498cf0 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/generate.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/generate.py @@ -6,6 +6,7 @@ from dataclasses import dataclass from contentctl_core.domain.entities.enums.enums import SecurityContentProduct from contentctl_core.application.adapter.adapter import Adapter from contentctl_core.application.factory.factory import FactoryInputDto, Factory, FactoryOutputDto +from contentctl_core.application.factory.ba_factory import BAFactoryInputDto, BAFactory, BAFactoryOutputDto @@ -13,14 +14,16 @@ from contentctl_core.application.factory.factory import FactoryInputDto, Factory class GenerateInputDto: output_path: str factory_input_dto: FactoryInputDto + ba_factory_input_dto: BAFactoryInputDto adapter : Adapter + product: SecurityContentProduct class Generate: def execute(self, input_dto: GenerateInputDto) -> None: - if input_dto.factory_input_dto.product == SecurityContentProduct.ESCU: + if input_dto.product == SecurityContentProduct.ESCU: factory_output_dto = FactoryOutputDto([],[],[],[],[],[],[],[]) factory = Factory(factory_output_dto) factory.execute(input_dto.factory_input_dto) @@ -32,12 +35,15 @@ class Generate: input_dto.adapter.writeLookups(factory_output_dto.lookups, input_dto.output_path, input_dto.factory_input_dto.input_path) input_dto.adapter.writeMacros(factory_output_dto.macros, input_dto.output_path) - elif input_dto.factory_input_dto.product == SecurityContentProduct.BA: + elif input_dto.product == SecurityContentProduct.BA: shutil.rmtree(input_dto.output_path + '/srs/', ignore_errors=True) shutil.rmtree(input_dto.output_path + '/complex/', ignore_errors=True) os.makedirs(input_dto.output_path + '/complex/') os.makedirs(input_dto.output_path + '/srs/') - # skip experimental and deprecated ssa detections - # differentiate between complex and srs by looking for stats|first_time_event|adaptive_threshold - # calculate risk_severity + # remove unused fields + + factory_output_dto = BAFactoryOutputDto([],[]) + factory = BAFactory(factory_output_dto) + factory.execute(input_dto.ba_factory_input_dto) + input_dto.adapter.writeObjects(factory_output_dto.detections, input_dto.output_path) diff --git a/bin/contentctl_project/contentctl_core/tests/application/factory/test_ba_factory.py b/bin/contentctl_project/contentctl_core/tests/application/factory/test_ba_factory.py index 227cb7feed..a4a2b7cc79 100644 --- a/bin/contentctl_project/contentctl_core/tests/application/factory/test_ba_factory.py +++ b/bin/contentctl_project/contentctl_core/tests/application/factory/test_ba_factory.py @@ -23,4 +23,7 @@ def test_factory_BA(): factory = BAFactory(output_dto) factory.execute(input_dto) - print(output_dto.detections[0]) \ No newline at end of file + + for detection in output_dto.detections: + if not detection.test: + raise AssertionError("test file missing for ssa detection: " + detection.name) \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_conf_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_conf_adapter.py index 37ecdc168b..2c0975deda 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_conf_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_conf_adapter.py @@ -97,5 +97,5 @@ class ObjToConfAdapter(Adapter): pass - def writeObjects(self, objects: list, security_content_folder: str) -> None: + def writeObjects(self, objects: list, output_path: str) -> None: pass \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index d1ec8e26b7..38a9885209 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -36,19 +36,32 @@ class ObjToYmlAdapter(Adapter): object.pop('experimental') YmlWriter.writeYmlFile(file_path, object) - def writeObjects(self, objects: list, security_content_folder: str) -> None: + def writeObjects(self, objects: list, output_path: str) -> None: for obj in objects: file_name = "ssa___" + self.convertNameToFileName(obj) if self.isComplexBARule(obj.search): - file_path = os.path.join(security_content_folder, 'complex', file_name) + file_path = os.path.join(output_path, 'complex', file_name) else: - file_path = os.path.join(security_content_folder, 'srs', file_name) + file_path = os.path.join(output_path, 'srs', file_name) # remove unncessary fields - YmlWriter.writeYmlFile(file_path, object) + YmlWriter.writeYmlFile(file_path, obj.dict( + exclude = + { + "tags": {"detections": True , "deployments": True}, + "deprecated": True, + "experimental": True, + "deployment": True, + "annotations": True, + "risk": True, + "playbooks": True, + "baselines": True, + "mappings": True, + "test": {"earliest_time": True , "latest_time": True, "baselines": True} + })) def convertNameToFileName(self, obj: dict): - file_name = obj['name'] \ + file_name = obj.name \ .replace(' ', '_') \ .replace('-','_') \ .replace('.','_') \ diff --git a/bin/contentctl_project/main/contentctl.py b/bin/contentctl_project/main/contentctl.py index 432adc27b6..e8df31b510 100644 --- a/bin/contentctl_project/main/contentctl.py +++ b/bin/contentctl_project/main/contentctl.py @@ -7,7 +7,8 @@ sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..') from contentctl_core.application.use_cases.content_changer import ContentChanger, ContentChangerInputDto from contentctl_core.application.use_cases.generate import GenerateInputDto, Generate from contentctl_core.application.use_cases.validate import ValidateInputDto, Validate -from contentctl_core.application.factory.factory import Factory, FactoryInputDto, FactoryOutputDto +from contentctl_core.application.factory.factory import FactoryInputDto +from contentctl_core.application.factory.ba_factory import BAFactoryInputDto from contentctl_core.application.factory.object_factory import ObjectFactoryInputDto from contentctl_infrastructure.builder.security_content_object_builder import SecurityContentObjectBuilder from contentctl_infrastructure.builder.security_content_director import SecurityContentDirector @@ -93,16 +94,33 @@ def generate(args) -> None: SecurityContentStoryBuilder(), SecurityContentBaselineBuilder(), SecurityContentInvestigationBuilder(), - SecurityContentDirector(), - SecurityContentProduct[args.product] + SecurityContentDirector() ) - generate_input_dto = GenerateInputDto( - os.path.abspath(args.output), - factory_input_dto, - ObjToConfAdapter() + ba_factory_input_dto = BAFactoryInputDto( + os.path.abspath(args.path), + SecurityContentBasicBuilder(), + SecurityContentDetectionBuilder(), + SecurityContentDirector() ) + if args.product == "ESCU": + generate_input_dto = GenerateInputDto( + os.path.abspath(args.output), + factory_input_dto, + ba_factory_input_dto, + ObjToConfAdapter(), + SecurityContentProduct.ESCU + ) + else: + generate_input_dto = GenerateInputDto( + os.path.abspath(args.output), + factory_input_dto, + ba_factory_input_dto, + ObjToYmlAdapter(), + SecurityContentProduct.BA + ) + generate = Generate() generate.execute(generate_input_dto) diff --git a/dist/ssa/complex/ssa___detect_kerberoasting.yml b/dist/ssa/complex/ssa___detect_kerberoasting.yml new file mode 100644 index 0000000000..f2e7f15883 --- /dev/null +++ b/dist/ssa/complex/ssa___detect_kerberoasting.yml @@ -0,0 +1,92 @@ +name: Detect Kerberoasting +id: dabdd6d7-3e10-42be-8711-4e124f7a3850 +version: 2 +date: '2020-10-21' +author: Xiao Lin, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search detects a potential kerberoasting attack via service principal + name requests +search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), + EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, + "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), + ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, + "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" + AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event + input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] + | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID + | eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id, + "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, + "TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();' +how_to_implement: The test data is converted from Windows Security Event logs generated + from Attach Range simulation and used in SPL search and extended to SPL2 +known_false_positives: Older systems that support kerberos RC4 by default NetApp may + generate false positives +references: +- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss +tags: + name: Detect Kerberoasting + analytic_story: + - Credential Dumping + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + - CIS 16 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: null + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Kerberoasting malware is potentially applying stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1558.003 + - T1558 + nist: + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: Process + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - service_name + - _time + - event_code + - ticket_encryption_type + - service_id + - ticket_options + risk_score: 14 + security_domain: endpoint + risk_severity: low +test: + name: Detect Kerberoasting + file: endpoint/ssa___detect_kerberoasting.yml + pass_condition: '@count_eq(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___excessive_number_of_office_files_copied.yml b/dist/ssa/complex/ssa___excessive_number_of_office_files_copied.yml new file mode 100644 index 0000000000..d3631cfa00 --- /dev/null +++ b/dist/ssa/complex/ssa___excessive_number_of_office_files_copied.yml @@ -0,0 +1,74 @@ +name: Excessive Number of Office Files Copied +id: 3c6594a9-8df6-45a1-9357-d73b62083c63 +version: 1 +date: '2021-12-07' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: +- Endpoint_Filesystem +description: This detection detects a high amount of office file copied. This can + be an indicator for a malicious insider. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string", + null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event, + "file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + | where "Endpoint_Filesystem" IN(_datamodels) | where action="created" | where like(file_name, + "%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") | stats count(file_name) + AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) | where count > 20 + | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, + dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesytem` node. +known_false_positives: user may copy a lot of office fies from one folder to another +references: [] +tags: + name: Excessive Number of Office Files Copied + analytic_story: [] + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 80 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: High number of files copied + mitre_attack_id: + - T1048.003 + nist: null + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - action + - process + - file_name + - file_path + risk_score: 72 + security_domain: endpoint + risk_severity: medium +test: + name: Excessive Number of Office Files Copied + file: endpoint/ssa___excessive_number_of_office_files_copied.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log + source: xmlwineventlog + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___first_time_seen_command_line_argument.yml b/dist/ssa/complex/ssa___first_time_seen_command_line_argument.yml new file mode 100644 index 0000000000..a84de20d09 --- /dev/null +++ b/dist/ssa/complex/ssa___first_time_seen_command_line_argument.yml @@ -0,0 +1,99 @@ +name: First time seen command line argument +id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23 +version: 4 +date: '2021-11-30' +author: Ignacio Bermudez Corrales, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: This search looks for command-line arguments that use a `/c` parameter + to execute a command that has not previously been seen. This is an implementation + on SPL2 of the rule `First time seen command line argument` by @bpatel. 'The following + analytic identifies first time seen command-line arguments on a single endpoint. + The analytic looks for arguments instantiated by `cmd.exe /c` and the associated + command-line. Adversaries automate or spawn multiple processes using this method, + this analytic may assist with identifying the first time it's been found on this + endpoint.' +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), + "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), + cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, + "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, + "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" + */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), + /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, + /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) | + where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* + \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, + dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm + | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Legitimate programs use command-line arguments to execute. + Verify the command-line arguments to check what command/program is being executed. + Filtering will be needed. +references: [] +tags: + name: First time seen command line argument + analytic_story: + - Unusual Processes + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 3 + - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: null + impact: 50 + kill_chain_phases: + - Command and Control + - Actions on Objectives + message: A process $process_name$ ha been identified in the environment with a command-line + $cmd_line$ not previously seen before on host $dest_device_id$ + mitre_attack_id: + - T1059 + - T1202 + nist: + - PR.PT + - DE.CM + - PR.IP + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + - cmd_line + risk_score: 30 + security_domain: endpoint + risk_severity: low +test: + name: First time seen command line argument + file: endpoint/ssa___first_time_seen_cmd_line.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_arguments/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___high_file_deletion_frequency.yml b/dist/ssa/complex/ssa___high_file_deletion_frequency.yml new file mode 100644 index 0000000000..5590066a71 --- /dev/null +++ b/dist/ssa/complex/ssa___high_file_deletion_frequency.yml @@ -0,0 +1,86 @@ +name: High File Deletion Frequency +id: b6200efd-13bd-4336-920a-057b25bbcfaf +version: 1 +date: '2021-12-07' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: +- Endpoint_Filesystem +description: This detection detects a high amount of file deletions in a short time + for specific file types. This can be an indicator for a malicious insider. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string", + null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event, + "file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + | where "Endpoint_Filesystem" IN(_datamodels) | where action="deleted" | where like(file_name, + "%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") OR like(file_name, + "%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") OR like(file_name, + "%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") OR like(file_name, + "%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") OR like(file_name, + "%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") OR like(file_name, + "%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") OR like(file_name, + "%.js") | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp, + 10m) | where count > 20 | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, + dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesytem` node. +known_false_positives: user may delete bunch of pictures or files in a folder. +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +tags: + name: High File Deletion Frequency + analytic_story: + - Clop Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: High frequency file deletion activity detected on host $Computer$ + mitre_attack_id: + - T1485 + nist: null + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Endpoint + role: + - Victim + - name: deleted_files + type: File Name + role: + - Target + product: + - Splunk Behavioral Analytics + required_fields: + - action + - process + - file_name + - file_path + risk_score: 72 + security_domain: endpoint + risk_severity: medium +test: + name: High File Deletion Frequency + file: endpoint/ssa___high_file_deletion_frequency.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log + source: xmlwineventlog + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/complex/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml new file mode 100644 index 0000000000..82741005e6 --- /dev/null +++ b/dist/ssa/complex/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml @@ -0,0 +1,105 @@ +name: More than usual number of LOLBAS applications in short time period +id: 59c0dd70-169c-4900-9a1f-bfcf13302f93 +version: 2 +date: '2020-08-25' +author: Ignacio Bermudez Corrales, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: Attacker activity may compromise executing several LOLBAS applications + in conjunction to accomplish their objectives. We are looking for more than usual + LOLBAS applications over a window of time, by building profiles per machine. +search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" + OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" + OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" + OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" + OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" + OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" + OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" + OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" + OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" + OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" + OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" + OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" + OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" + OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" + OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" + OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" + OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" + OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" + OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" + OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" + OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR + process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" + OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" + OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" + OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" + OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by + device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end + as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" + window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, + end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", + lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS + applications in a short period of time. This might trigger false positives at the + beginning when it hasn''t collected yet enough data to construct the baseline. + + ' +references: +- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +tags: + name: More than usual number of LOLBAS applications in short time period + analytic_story: + - Unusual Processes + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: null + impact: 50 + kill_chain_phases: + - Exploitation + message: A system process $process_name$ with commandline $cmd_line$ spawn iin short + period of time in host $dest_device_id$ + mitre_attack_id: + - T1059 + - T1053 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - _time + - process_name + risk_score: 25 + security_domain: endpoint + risk_severity: low +test: + name: More than usual number of LOLBAS applications in short time period + file: endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: T1059.all.labeled.lolbas-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml new file mode 100644 index 0000000000..4754425ab4 --- /dev/null +++ b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml @@ -0,0 +1,110 @@ +name: Potential Pass the Token or Hash Observed at the Destination Device +id: 82e76b80-5cdb-4899-9b43-85dbe777b36d +version: 3 +date: '2021-11-30' +author: Stanislav Miskovic, Splunk +type: TTP +datamodel: +- Authentication +description: This detection identifies potential Pass the Token or Pass the Hash credential + stealing. We detect the main side effect of these attacks, which is a transition + from the dominant Kerberos logins to rare NTLM logins for a given user, as reported + by a detination device. +search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", + null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null), + signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), + authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND dest_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, + "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id", + event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", + startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time", + endNTLMTime]) + + | into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from endpoint devices, + i.e., destinations of interest. Please make sure that event ID 4624 is being logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for + benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ +tags: + name: Potential Pass the Token or Hash Observed at the Destination Device + analytic_story: + - Active Directory Lateral Movement + asset_type: Windows + automated_detection_testing: null + cis20: + - CIS 16 + - CIS 20 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + dataset: null + impact: 80 + kill_chain_phases: + - Exploitation + message: Potential lateral movement and credential stealing via Pass the Token or + Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the destination device $dest_device_id$ + mitre_attack_id: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - dest_device_id + - authentication_method + risk_score: 72 + security_domain: endpoint + risk_severity: medium +test: + name: Potential Pass the Token or Hash Observed at the Destination Device + file: endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_dest_dataset.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml new file mode 100644 index 0000000000..65623efed7 --- /dev/null +++ b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml @@ -0,0 +1,111 @@ +name: Potential Pass the Token or Hash Observed by an Event Collecting Device +id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 +version: 2 +date: '2021-11-05' +author: Stanislav Miskovic, Splunk +type: TTP +datamodel: +- Authentication +description: This detection identifies potential Pass the Token or Pass the Hash credential + stealing. We detect the main side effect of these attacks, which is a transition + from the dominant Kerberos logins to rare NTLM logins for a given user, as reported + by an event-collecting device (i.e., a specific domain controller or an endpoint + destination). +search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels) + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), + "string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", + null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string", + null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", + null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), + "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") + AND dest_user_id != null AND origin_device_id != null + + | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method + == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null) + + | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as + startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as + endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) + + | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - + startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + + | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, + origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos, + "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", + endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime]) + + | into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from devices of interest + - at least from domain controllers. Please make sure that event ID 4624 is being + logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for + benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ +tags: + name: Potential Pass the Token or Hash Observed by an Event Collecting Device + analytic_story: + - Active Directory Lateral Movement + asset_type: Windows + automated_detection_testing: null + cis20: + - CIS 16 + - CIS 20 + confidence: 80 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + dataset: null + impact: 80 + kill_chain_phases: + - Exploitation + message: Potential lateral movement and credential stealing via Pass the Token or + Pass the Hash techniques. Operation is performed via credentials of the account + $dest_user_id$ and observed by the logging device $origin_device_id$ + mitre_attack_id: + - T1550 + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: origin_device_id + type: Hostname + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - origin_device_id + - authentication_method + risk_score: 64 + security_domain: endpoint + risk_severity: medium +test: + name: Potential Pass the Token or Hash Observed by an Event Collecting Device + file: endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_DC_dataset.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___rare_parent_child_process_relationship.yml b/dist/ssa/complex/ssa___rare_parent_child_process_relationship.yml new file mode 100644 index 0000000000..df6359424e --- /dev/null +++ b/dist/ssa/complex/ssa___rare_parent_child_process_relationship.yml @@ -0,0 +1,115 @@ +name: Rare Parent-Child Process Relationship +id: cf090c78-bcc6-11eb-8529-0242ac130003 +version: 2 +date: '2021-11-30' +author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: An attacker may use LOLBAS tools spawned from vulnerable applications + not typically used by system administrators. This analytic leverages the Splunk + Streaming ML DSP plugin to find rare parent/child relationships. The list of application + has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event, + "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, + "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, + "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, + timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" + target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" + OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" + OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" + OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" + OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" + OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" + OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" + OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" + OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" + OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" + OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" + OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" + OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" + OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" + OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" + OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" + OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" + OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" + OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" + OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" + OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" + OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR + process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" + OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" + OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" + OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") + | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001 + window=604800000L | where label AND input > mean | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = + create_map(["process_name", process_name, "parent_process_name", parent_process_name, + "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line", + cmd_line]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: Some custom tools used by administrators could be used rarely + to launch remotely applications. This might trigger false positives at the beginning + when it has not collected yet enough data to construct the baseline. +references: +- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +tags: + name: Rare Parent-Child Process Relationship + analytic_story: + - Unusual Processes + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + confidence: 50 + context: + - Source:Endpoint + dataset: null + impact: 50 + kill_chain_phases: + - Exploitation + message: Rare Parent-Child Process Relationship + mitre_attack_id: + - T1203 + - T1059 + - T1053 + - T1072 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - process + - process_name + - parent_process_name + - _time + - dest_device_id + - dest_user_id + - cmd_line + risk_score: 25 + security_domain: endpoint + risk_severity: low +test: + name: Rare Parent-Child Process Relationship + file: endpoint/ssa___rare_parent_process_relationship_lolbas.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sec-events.out + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sec-events.out + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/complex/ssa___unusually_long_command_line.yml b/dist/ssa/complex/ssa___unusually_long_command_line.yml new file mode 100644 index 0000000000..771b3ee0c9 --- /dev/null +++ b/dist/ssa/complex/ssa___unusually_long_command_line.yml @@ -0,0 +1,87 @@ +name: Unusually Long Command Line +id: 58f43aba-1775-445e-b19c-be2b87d83ae3 +version: 1 +date: '2020-10-06' +author: Ignacio Bermudez Corrales, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: Command lines that are extremely long may be indicative of malicious + activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin + to help identify command lines with lengths that are unusual for a given user. This + detection is inspired on Unusually Long Command Line authored by Rico Valdez. +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval + cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, + /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, + ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, + input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 + | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", + "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", + event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting sysmon endpoint data that monitors command + lines. +known_false_positives: This detection may flag suspiciously long command lines when + there is not sufficient evidence (samples) for a given process that this detection + is tracking; or when there is high variability in the length of the command line + for the tracked process. Also, some legitimate applications may use long command + lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. + Attackers may use this technique to obfuscate their payloads. +references: [] +tags: + name: Unusually Long Command Line + analytic_story: + - Unusual Processes + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + confidence: 40 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: null + impact: 30 + kill_chain_phases: + - Actions on Objectives + message: A process $process_name$ with a long commandline $cmd_line$ executed in + host $dest_device_id$ + mitre_attack_id: null + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 12 + security_domain: endpoint + risk_severity: low +test: + name: Unusually Long Command Line + file: endpoint/ssa___unusually_long_command_line.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml new file mode 100644 index 0000000000..bdb049118c --- /dev/null +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -0,0 +1,95 @@ +name: Anomalous usage of Archive Tools +id: 63614a58-10e2-4c6c-ae81-ea1113681439 +version: 1 +date: '2021-11-22' +author: Patrick Bareiss, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: The following detection identifies the usage of archive tools from the + command line. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), + "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), parent_process=ucast(map_get(input_event, "parent_process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name + IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%") + OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name, + "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", + parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives can be ligitmate usage of archive tools from + the command line. +references: +- https://attack.mitre.org/techniques/T1560/001/ +tags: + name: Anomalous usage of Archive Tools + analytic_story: + - Cobalt Strike + - NOBELIUM Group + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 60 + context: + - Source:Endpoint + - Stage:Collection + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading + of 7zip. + mitre_attack_id: + - T1560.001 + - T1560 + nist: null + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + risk_score: 42 + security_domain: endpoint + risk_severity: low +test: + name: Anomalous usage of Archive Tools + file: endpoint/ssa___anomalous_usage_of_archive_tools.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml new file mode 100644 index 0000000000..03d97f14d4 --- /dev/null +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -0,0 +1,104 @@ +name: Attempt To Delete Services +id: a0c8c292-d01a-11eb-aa18-acde48001122 +version: 3 +date: '2021-11-24' +author: Teoderick Contreras, splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies Windows Service Control, `sc.exe`, + attempting to delete a service. This is typically identified in parallel with other + instances of service enumeration of attempts to stop a service and then delete it. + Adversaries utilize this technique to terminate security services or other related + services to continue there objective and evade detections. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete + services. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md +tags: + name: Attempt To Delete Services + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + - CIS 13 + confidence: 60 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. + mitre_attack_id: + - T1489 + - T1543 + - T1543.003 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 36 + security_domain: endpoint + risk_severity: low +test: + name: Attempt To Delete Services + file: endpoint/ssa___attempt_to_delete_services.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: sc_del.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml new file mode 100644 index 0000000000..7319480a95 --- /dev/null +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -0,0 +1,103 @@ +name: Attempt To Disable Services +id: afb31de4-d023-11eb-98d5-acde48001122 +version: 3 +date: '2021-11-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies Windows Service Control, `sc.exe`, + attempting to disable a service. This is typically identified in parallel with other + instances of service enumeration of attempts to stop a service and then disable + it. Adversaries utilize this technique to terminate security services or other related + services to continue there objective and evade detections. +search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event, + "_datamodels"), "collection", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") + AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete + services. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service +tags: + name: Attempt To Disable Services + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 9 + - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. + mitre_attack_id: + - T1489 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 36 + security_domain: endpoint + risk_severity: low +test: + name: Attempt To Disable Services + file: endpoint/ssa___attempt_to_disable_services.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: sc_disable.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml new file mode 100644 index 0000000000..a5c0b80e84 --- /dev/null +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -0,0 +1,93 @@ +name: Attempted Credential Dump From Registry via Reg exe +id: 14038953-e5f2-4daf-acff-5452062baf03 +version: 2 +date: '2021-11-29' +author: Jose Hernandez, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies the use of `reg.exe` attempting to + export Windows registry keys that contain hashed credentials. Adversaries will utilize + this technique to capture and perform offline password cracking. +search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, + "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), + "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" + OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true + AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, + /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time + = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) + | into write_ssa_detected_events(); ' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: None identified. +references: +- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets +tags: + name: Attempted Credential Dump From Registry via Reg exe + analytic_story: + - Credential Dumping + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Credential Access + dataset: null + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: An attempt to save registry keys storing credentials has been performed + on $dest_device_id$ by $dest_user_id$ via process $process_name$. + mitre_attack_id: + - T1003 + - T1003.002 + nist: + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + - cmd_line + risk_score: 63 + security_domain: endpoint + risk_severity: medium +test: + name: Attempted Credential Dump From Registry via Reg exe + file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml new file mode 100644 index 0000000000..6dfc72128b --- /dev/null +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -0,0 +1,95 @@ +name: BCDEdit Failure Recovery Modification +id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search looks for flags passed to bcdedit.exe modifications to the + built-in Windows error recovery boot configurations. This is typically used by ransomware + to prevent recovery. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" + AND (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Administrators may modify the boot configuration. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair +tags: + name: BCDEdit Failure Recovery Modification + analytic_story: + - Ryuk Ransomware + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability + to recover the endpoint. + mitre_attack_id: + - T1490 + nist: + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + security_domain: endpoint + risk_severity: high +test: + name: BCDEdit Failure Recovery Modification + file: endpoint/ssa___bcdedit_failure_recovery_modification.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml new file mode 100644 index 0000000000..14a1a86c7f --- /dev/null +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -0,0 +1,108 @@ +name: Delete A Net User +id: 8776d79c-d26e-11eb-9a56-acde48001122 +version: 3 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: This analytic will detect a suspicious net.exe/net1.exe command-line + to delete a user on a system. This technique may be use by an administrator for + legitimate purposes, however this behavior has been used in the wild to impair some + user or deleting adversaries tracks created during its lateral movement additional + systems. During triage, review parallel processes for additional behavior. Identify + any other user accounts created before or after. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" + OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + name: Delete A Net User + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 4 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user + account. + mitre_attack_id: + - T1531 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 49 + security_domain: endpoint + risk_severity: low +test: + name: Delete A Net User + file: endpoint/ssa___delete_a_net_user.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: net_user_del.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..a0d5b8735c --- /dev/null +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -0,0 +1,90 @@ +name: Deny Permission using Cacls Utility +id: b76eae28-cd25-11eb-9c92-acde48001122 +version: 3 +date: '2021-11-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` + or `xcacls.exe` placing the deny permission on a file or directory. Adversaries + perform this behavior to prevent responders from reviewing or gaining access to + adversary files on disk. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: System administrators may use cacls utilities but this is not + a common practice. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + name: Deny Permission using Cacls Utility + analytic_story: + - XMRig + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 14 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A cacls process $process_name$ with commandline $cmd_line$ try to deny + a permission of a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + security_domain: endpoint + risk_severity: low +test: + name: Deny Permission using Cacls Utility + file: endpoint/ssa___deny_permission_using_cacls_utility.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: all_icalc.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml new file mode 100644 index 0000000000..cfc5ba8761 --- /dev/null +++ b/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -0,0 +1,84 @@ +name: Detect Dump LSASS Memory using comsvcs +id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e +version: 2 +date: '2021-11-29' +author: Jose Hernandez, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies credential dumping using comsvcs.dll + with `regsvr32.exe`. This technique is common with adversaries who would like to + dump the memory of lsass.exe and perform offline password cracking. +search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event, + "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), + "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, + "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, + /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = + timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, + "process_name", process_name, "process", process]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including Windows command line logging. You can see how we test this with [Event + Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) + on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). +known_false_positives: False positives should be limited, filter as needed. +references: +- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll +tags: + name: Detect Dump LSASS Memory using comsvcs + analytic_story: + - Credential Dumping + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + - CIS 16 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ + by user $dest_device_user$. + mitre_attack_id: + - T1003.003 + - T1003 + nist: + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _tenant + - _time + - dest_device_id + - process + risk_score: 70 + security_domain: endpoint + risk_severity: medium +test: + name: Detect Dump LSASS Memory using comsvcs + file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml new file mode 100644 index 0000000000..ef1b294028 --- /dev/null +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -0,0 +1,101 @@ +name: Detect Prohibited Applications Spawning cmd exe +id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 +version: 2 +date: '2020-11-10' +author: Ignacio Bermudez Corrales, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: The following analytic identifies parent processes, browsers, Windows + terminal applications, Office Products and Java spawning cmd.exe. By its very nature, + many applications spawn cmd.exe natively or built into macros. Much of this will + need to be tuned to further enhance the risk. +search: '| from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) + | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), + parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", + null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event, + "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), + "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null) + | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" + | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" + OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" + OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe" + OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe" + AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%")))) + OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line + IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%")))) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, + dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, + "parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();' +how_to_implement: In order to successfully implement this analytic, you will need + endpoint process data from a EDR product or Sysmon. This search has been modified + to process raw sysmon data from attack_range's nxlogs on DSP. +known_false_positives: There are circumstances where an application may legitimately + execute and interact with the Windows command-line interface. +references: +- https://attack.mitre.org/techniques/T1059/ +tags: + name: Detect Prohibited Applications Spawning cmd exe + analytic_story: + - Suspicious Command-Line Executions + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: null + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event + that warrants investigating. + mitre_attack_id: + - T1059 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - parent_process_name + - _time + - dest_device_id + - dest_user_id + - cmd_line + risk_score: 35 + security_domain: endpoint + risk_severity: low +test: + name: Detect Prohibited Applications Spawning cmd exe + file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml new file mode 100644 index 0000000000..5bf2f21909 --- /dev/null +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -0,0 +1,106 @@ +name: Detect RClone Command-Line Usage +id: e8b74268-5454-11ec-a799-acde48001122 +version: 1 +date: '2021-12-03' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This analytic identifies commonly used command-line arguments used by + `rclone.exe` to initiate a file transfer. Some arguments were negated as they are + specific to the configuration used by adversaries. In particular, an adversary may + list the files or directories of the remote file share using `ls` or `lsd`, which + is not indicative of malicious behavior. During triage, at this stage of a ransomware + event, exfiltration is about to occur or has already. Isolate the endpoint and continue + investigating by review file modifications and parallel processes. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" + AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%") + OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, + "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, + "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line, + "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) + | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: False positives should be limited as this is restricted to + the Rclone process name. Filter or tune the analytic as needed. +references: +- https://redcanary.com/blog/rclone-mega-extortion/ +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ +tags: + name: Detect RClone Command-Line Usage + analytic_story: + - DarkSide Ransomware + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 70 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log + impact: 50 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a + remote cloud service to move files or folders. + mitre_attack_id: + - T1020 + nist: null + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + security_domain: endpoint + risk_severity: low +test: + name: Detect RClone Command-Line Usage + file: endpoint/ssa___detect_rclone_command_line_usage.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml new file mode 100644 index 0000000000..8222f63e37 --- /dev/null +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -0,0 +1,102 @@ +name: Disable Net User Account +id: ba858b08-d26c-11eb-af9b-acde48001122 +version: 3 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This analytic will identify a suspicious command-line that disables a + user account using the native `net.exe` or `net1.exe` utility to Windows. This technique + may used by the adversaries to interrupt availability of accounts and continue the + impact against the organization. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%") + AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be + used. +known_false_positives: System administrators or automated scripts may disable an account + but not a common practice. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + name: Disable Net User Account + analytic_story: + - XMRig + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 4 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. + mitre_attack_id: + - T1489 + - T1078 + nist: + - PR.AC + - PR.IP + observable: + - name: user + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 49 + security_domain: endpoint + risk_severity: low +test: + name: Disable Net User Account + file: endpoint/ssa___disable_net_user_account.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: net_user_dis.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml new file mode 100644 index 0000000000..9ffb8980de --- /dev/null +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -0,0 +1,103 @@ +name: DNS Exfiltration Using Nslookup App +id: 2452e632-9e0d-11eb-34ba-acde48001122 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search is to detect potential DNS exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are + commonly used by attacker and also the retry parameter which is designed to query + C2 DNS multiple tries. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" + AND (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, + "%-q=%") OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) | eval + start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: It is possible for some legitimate administrative utilities + to use similar cmd_line parameters. Filter as needed. +references: +- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html +- https://www.varonis.com/blog/dns-tunneling/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +tags: + name: DNS Exfiltration Using Nslookup App + analytic_story: + - Suspicious DNS Traffic + - Dynamic DNS + - Command and Control + - Data Exfiltration + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 80 + context: + - Source:Endpoint + - Stage:Exfiltration + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related + to DNS exfiltration. + mitre_attack_id: + - T1048 + nist: null + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 72 + security_domain: endpoint + risk_severity: medium +test: + name: DNS Exfiltration Using Nslookup App + file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml new file mode 100644 index 0000000000..833f850d36 --- /dev/null +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -0,0 +1,96 @@ +name: Fsutil Zeroing File +id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search is to detect a suspicious fsutil process to zeroing a target + file. This technique was seen in lockbit ransomware where it tries to zero out its + malware path as part of its defense evasion after encrypting the compromised host. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" + AND (like (cmd_line, "%setzerodata%")) | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", + cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +references: +- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file +tags: + name: Fsutil Zeroing File + analytic_story: + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: [] + impact: 60 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file + deletion. + mitre_attack_id: + - T1070 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 54 + security_domain: endpoint + risk_severity: medium +test: + name: Fsutil Zeroing File + file: endpoint/ssa___fsutil_zeroing_file.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml new file mode 100644 index 0000000000..c603961d05 --- /dev/null +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -0,0 +1,90 @@ +name: Grant Permission Using Cacls Utility +id: c6da561a-cd29-11eb-ae65-acde48001122 +version: 3 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` + or `xcacls.exe` placing the grant permission on a file or directory. Adversaries + perform this behavior to allow components of their files to run, however it allows + responders to review or gaining access to adversary files on disk. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true + AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: System administrators may use cacls utilities but this is not + a common practice. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + name: Grant Permission Using Cacls Utility + analytic_story: + - XMRig + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 14 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A cacls process $process_name$ with commandline $cmd_line$ try to grant + user a permission to a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + security_domain: endpoint + risk_severity: low +test: + name: Grant Permission Using Cacls Utility + file: endpoint/ssa___grant_permission_using_cacls_utility.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: all_icalc.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml new file mode 100644 index 0000000000..9f1f7b4afb --- /dev/null +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -0,0 +1,93 @@ +name: Modify ACLs Permission Of Files Or Folders +id: 9ae9a48a-cdbe-11eb-875a-acde48001122 +version: 2 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: This analytic identifies suspicious modification of ACL permission to + a files or folder to make it available to everyone or to a specific user. This technique + may be used by the adversary to evade ACLs or protected files access. This changes + is commonly configured by the file or directory owner with appropriate permission. + This behavior raises suspicion if this command is seen on an endpoint utilized by + an account with no permission to do so. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", + null), process_name=ucast(map_get(input_event, "process_name"), "string", null), + process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), + "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, + /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" + OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. +known_false_positives: System administrators may use this windows utility. filter + is needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + name: Modify ACLs Permission Of Files Or Folders + analytic_story: + - XMRig + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + - CIS 13 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A cacls process $process_name$ with commandline $cmd_line$ try to modify + a permission of a file or directory in host $dest_device_id$ + mitre_attack_id: + - T1222 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + security_domain: endpoint + risk_severity: low +test: + name: Modify ACLs Permission Of Files Or Folders + file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: all_icalc.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml new file mode 100644 index 0000000000..9225d8777a --- /dev/null +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -0,0 +1,102 @@ +name: Resize Shadowstorage Volume +id: dbc30554-d27e-11eb-9e5e-acde48001122 +version: 3 +date: '2021-11-30' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The following analytic identifies the resizing of shadowstorage using + vssadmin.exe to avoid the shadow volumes being made again. This technique is typically + found used by adversaries during a ransomware event and a precursor to deleting + the shadowstorage. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") + AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), + "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, + "parent_process_name", parent_process_name, "process_path", process_path]) | into + write_ssa_detected_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: System administrators may resize the shadowstorage for valid + purposes. Filter as needed. +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +tags: + name: Resize Shadowstorage Volume + analytic_story: + - Clop Ransomware + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 10 + - CIS 13 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow + copy to perform offline password cracking. + mitre_attack_id: + - T1489 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 64 + security_domain: endpoint + risk_severity: medium +test: + name: Resize Shadowstorage Volume + file: endpoint/ssa___resize_shadowstorage_volume.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml new file mode 100644 index 0000000000..f589da08ea --- /dev/null +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -0,0 +1,110 @@ +name: Sdelete Application Execution +id: fcc52b9a-4616-11ec-8454-acde48001122 +version: 1 +date: '2021-11-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: This analytic will detect the execution of sdelete.exe attempting to + delete potentially important files that may related to adversary or insider threats + to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant + to securely delete files on disk. This tool is commonly used to clear tracks and + artifact on the targeted host. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), + "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), + parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line + IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND + (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") + OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s + %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line, + "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line, + "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line, + "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line, + "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line, + "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line, + "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, + "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "process_path", process_path, "parent_process_name", parent_process_name, + "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md +tags: + name: Sdelete Application Execution + analytic_story: + - Information Sabotage + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log + impact: 60 + kill_chain_phases: + - Exploitation + message: Sdelete process $process_name$ executed on $dest_device_id$ attempting + to permanently delete files by $dest_user_id$. + mitre_attack_id: + - T1485 + - T1070.004 + - T1070 + nist: null + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest + - user + - parent_process_name + - parent_process + - process_name + - process + - process_id + - process_path + - cmd_line + risk_score: 42 + security_domain: endpoint + risk_severity: low +test: + name: Sdelete Application Execution + file: endpoint/ssa___sdelete_application_execution.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml new file mode 100644 index 0000000000..7bd1147514 --- /dev/null +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -0,0 +1,289 @@ +name: System Process Running from Unexpected Location +id: 28179107-099a-464a-94d3-08301e6c055f +version: 3 +date: '2020-08-25' +author: Ignacio Bermudez Corrales, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: An attacker tries might try to use different version of a system command + without overriding original, or they might try to avoid some detection running the + process from a different folder. This detection checks that a list of system processes + run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes + has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv + and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml +search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, + "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), + "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", + null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", + null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); + + $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" + OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" + OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" + OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" + OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" + OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" + OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" + OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" + OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" + OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR + process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR + process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" + OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR + process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" + OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" + OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR + process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" + OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" + OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" + OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" + OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" + OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" + OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" + OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" + OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" + OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR + process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" + OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" + OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" + OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" + OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" + OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" + OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" + OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" + OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" + OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" + OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe"; + + $cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe" + OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" + OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" + OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" + OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" + OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR + process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" + OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR + process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" + OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" + OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" + OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" + OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" + OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" + OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR + process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe" + OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" + OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" + OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" + OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" + OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" + OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" + OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" + OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" + OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" + OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" + OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" + OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" + OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" + OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR + process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR + process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" + OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" + OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" + OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" + OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" + OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" + OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" + OR process_name="windowsanytimeupgraderesults.exe"; + + $cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR + process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" + OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" + OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" + OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" + OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" + OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" + OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" + OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" + OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" + OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" + OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" + OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" + OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" + OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" + OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" + OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" + OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" + OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" + OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" + OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" + OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" + OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" + OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" + OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" + OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" + OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" + OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" + OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" + OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" + OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" + OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" + OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" + OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" + OR process_name="easinvoker.exe" OR process_name="efsui.exe"; + + $cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" + OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" + OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" + OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" + OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" + OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" + OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" + OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" + OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" + OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" + OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" + OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" + OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" + OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" + OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" + OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" + OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" + OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" + OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" + OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" + OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" + OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" + OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" + OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" + OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" + OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" + OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" + OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" + OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" + OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" + OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" + OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" + OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" + OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe"; + + $cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe" + OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" + OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" + OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" + OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" + OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" + OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" + OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" + OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" + OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" + OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" + OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" + OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" + OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" + OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" + OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" + OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" + OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" + OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" + OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" + OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" + OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" + OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" + OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" + OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" + OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" + OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" + OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" + OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" + OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" + OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" + OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" + OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" + OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe"; + + $cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe" + OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" + OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" + OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" + OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" + OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" + OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" + OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" + OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" + OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" + OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" + OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" + OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" + OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" + OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" + OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" + OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" + OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" + OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" + OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; + + | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | + union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false + AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, + end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", + event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +known_false_positives: None +references: [] +tags: + name: System Process Running from Unexpected Location + analytic_story: + - Windows Defense Evasion Tactics + - Masquerading - Rename System Utilities + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default + folder path in host $dest_device_id$ + mitre_attack_id: + - T1036 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - _time + - dest_user_id + - process_path + risk_score: 56 + security_domain: endpoint + risk_severity: medium +test: + name: System Process Running from Unexpected Location + file: endpoint/ssa___system_process_running_unexpected_location.yml + pass_condition: '@count_eq(1)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml new file mode 100644 index 0000000000..4fc7442b67 --- /dev/null +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -0,0 +1,99 @@ +name: WBAdmin Delete System Backups +id: 71efbf52-4dbb-4c00-a520-306aa546cbb7 +version: 1 +date: '2021-12-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator + Tool) that delete backup files. This is typically used by ransomware to prevent + recovery. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" + AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, + "%systemstatebackup%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: Administrators may modify the boot configuration. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md +- https://thedfirreport.com/2020/10/08/ryuks-return/ +- https://attack.mitre.org/techniques/T1490/ +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin +tags: + name: WBAdmin Delete System Backups + analytic_story: + - Ryuk Ransomware + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: [] + impact: 30 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system + backups. + mitre_attack_id: + - T1490 + nist: + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 15 + security_domain: endpoint + risk_severity: low +test: + name: WBAdmin Delete System Backups + file: endpoint/ssa___wbadmin_delete_system_backups.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml new file mode 100644 index 0000000000..8bd6428428 --- /dev/null +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -0,0 +1,95 @@ +name: WevtUtil Usage To Clear Logs +id: 5438113c-cdd9-11eb-93b8-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: The wevtutil.exe application is the windows event log utility. This searches + for wevtutil.exe with parameters for clearing the application, security, setup, + powershell, sysmon, or system event logs. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, + /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, + /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, + /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: The wevtutil.exe application is a legitimate Windows event + log utility. Administrators may use it to manage Windows event logs. +references: +- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html +tags: + name: WevtUtil Usage To Clear Logs + analytic_story: + - Windows Log Manipulation + - Ransomware + - Clop Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + - CIS 13 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + impact: 70 + kill_chain_phases: + - Exploitation + message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear + event logs in host $dest_device_id$ + mitre_attack_id: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 63 + security_domain: endpoint + risk_severity: medium +test: + name: WevtUtil Usage To Clear Logs + file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: clear_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..89f759bc33 --- /dev/null +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,91 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") + AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + name: Wevtutil Usage To Disable Logs + analytic_story: + - Windows Log Manipulation + - Ransomware + asset_type: Endpoint + automated_detection_testing: null + cis20: + - CIS 8 + - CIS 13 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + impact: 70 + kill_chain_phases: + - Exploitation + message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable + event logs in host $dest_device_id$ + mitre_attack_id: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 63 + security_domain: endpoint + risk_severity: medium +test: + name: Wevtutil Usage To Disable Logs + file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: disable_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml new file mode 100644 index 0000000000..37282fc6ce --- /dev/null +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -0,0 +1,114 @@ +name: Windows Curl Upload to Remote Destination +id: cc8d046a-543b-11ec-b864-acde48001122 +version: 1 +date: '2021-12-03' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint_Processes +description: 'The following analytic identifies the use of Windows Curl.exe uploading + a file to a remote destination. \ + + `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. + \ + + `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving + web application, and it is, for example, how most common HTML forms on the web work. + \ + + HTTP multipart formposts are done with `-F`, but this appears to not be compatible + with the Windows version of Curl. Will update if identified adversary tradecraft. + \ + + Adversaries may use one of the three methods based on the remote destination and + what they are attempting to upload (zip vs txt). During triage, review parallel + processes for further behavior. In addition, identify if the upload was successful + in network logs. If a file was uploaded, isolate the endpoint and review.' +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + + | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" + AND (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, + "%-d %") OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %")) + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, + "process_name", process_name, "parent_process_name", parent_process_name, "process_path", + process_path]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint_Processess` datamodel. +known_false_positives: False positives may be limited to source control applications + and may be required to be filtered out. +references: +- https://everything.curl.dev/usingcurl/uploads +- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 +- https://twitter.com/d1r4c/status/1279042657508081664?s=20 +tags: + name: Windows Curl Upload to Remote Destination + analytic_story: + - Ingress Tool Transfer + asset_type: Endpoint + automated_detection_testing: null + cis20: null + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote + destination. + mitre_attack_id: + - T1105 + nist: null + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 80 + security_domain: endpoint + risk_severity: high +test: + name: Windows Curl Upload to Remote Destination + file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log + source: WinEventLog:Security + sourcetype: null + update_timestamp: null diff --git a/tests/endpoint/ssa___attempt_to_delete_services.test.yml b/tests/endpoint/ssa___attempt_to_delete_services.test.yml index 96ec0024d0..7c3c283d27 100644 --- a/tests/endpoint/ssa___attempt_to_delete_services.test.yml +++ b/tests/endpoint/ssa___attempt_to_delete_services.test.yml @@ -1,4 +1,4 @@ -name: Attempt To delete Services +name: Attempt To Delete Services file: endpoint/ssa___attempt_to_delete_services.yml pass_condition: '@count_gt(0)' description: Test for usage of sc.exe to delete a service diff --git a/tests/endpoint/ssa___detect_kerberoasting.test.yml b/tests/endpoint/ssa___detect_kerberoasting.test.yml index 63c34dd75b..f9e752977a 100644 --- a/tests/endpoint/ssa___detect_kerberoasting.test.yml +++ b/tests/endpoint/ssa___detect_kerberoasting.test.yml @@ -1,4 +1,4 @@ -name: Detect kerberoasting +name: Detect Kerberoasting file: endpoint/ssa___detect_kerberoasting.yml pass_condition: '@count_eq(0)' description: Test detection of kerberoasting diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml index b0278b9646..4ce6f23a52 100644 --- a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml +++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml @@ -1,4 +1,4 @@ -name: FSUtil Zeroing File +name: Fsutil Zeroing File file: endpoint/ssa___fsutil_zeroing_file.yml pass_condition: '@count_gt(0)' description: Test detection of FSUtil Zeroing File diff --git a/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml b/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml index 9a6b5f0f68..2dcb16340e 100644 --- a/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml +++ b/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml @@ -1,4 +1,4 @@ -name: Rare Parent/Child Process Relationship with LOLBAS +name: Rare Parent-Child Process Relationship file: endpoint/ssa___rare_parent_process_relationship_lolbas.yml pass_condition: '@count_gt(0)' description: Test detection looking for LOLBAS processes spawned by other processes