Branch was auto-updated.

detections/experimental/endpoint/detect_exchange_web_shell.yml

@@ -0,0 +1,41 @@
+name: Detect Exchange Web Shell
+id: 44465d80-810b-11eb-aa30-acde48001122
+version: 1
+date: '2021-03-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. 
+  Upon triage, the suspicious .aspx file will have a randomized name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
+  by _time span=1h Filesystem.process_id Filesystem.file_name
+  Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
+  | rename process_id as aspx_pid | join aspx_pid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes where Processes.process_name=w3wp.exe  by _time
+  span=1h Processes.parent_process_id Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
+  | rename parent_process_id as aspx_pid | fields _time aspx_pid process_id dest process_name
+  process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | table firstTime, lastTime, aspx_pid, process_id, user, dest, file_name, file_path,
+  process_name, process, process_path, file_hash | `detect_exchange_web_shell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. 
+known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
+references:
+- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
+tags:
+  analytic_story:
+  - HAFNIUM Group
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1505.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+