From 90a385e9414dc58478d235e6f3ff070f27a988c9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 10 Mar 2021 06:23:54 -0700
Subject: [PATCH 1/2] Create detect_exchange_webshell.yml

---
 .../endpoint/detect_exchange_webshell.yml     | 41 +++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 detections/experimental/endpoint/detect_exchange_webshell.yml

diff --git a/detections/experimental/endpoint/detect_exchange_webshell.yml b/detections/experimental/endpoint/detect_exchange_webshell.yml
new file mode 100644
index 0000000000..c7ef6343d6
--- /dev/null
+++ b/detections/experimental/endpoint/detect_exchange_webshell.yml
@@ -0,0 +1,41 @@
+name: Detect Exchange Webshell
+id: 44465d80-810b-11eb-aa30-acde48001122
+version: 1
+date: '2021-03-09'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. 
+  Upon triage, the suspicious .aspx file will have a randomized name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
+  by _time span=1h Filesystem.process_id Filesystem.file_name
+  Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
+  | rename process_id as aspx_pid | join aspx_pid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes where Processes.process_name=w3wp.exe  by _time
+  span=1h Processes.parent_process_id Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
+  | rename parent_process_id as aspx_pid | fields _time aspx_pid process_id dest process_name
+  process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | table firstTime, lastTime, aspx_pid, process_id, user, dest, file_name, file_path,
+  process_name, process, process_path, file_hash | `detect_exchange_webshell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. 
+known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
+references:
+- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
+tags:
+  analytic_story:
+  - HAFNIUM Group
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1505.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  
\ No newline at end of file

From 851a46ed41b477e6bd23e040fe6bb28934989554 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 10 Mar 2021 06:43:26 -0700
Subject: [PATCH 2/2] Updated name

---
 ...ct_exchange_webshell.yml => detect_exchange_web_shell.yml} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename detections/experimental/endpoint/{detect_exchange_webshell.yml => detect_exchange_web_shell.yml} (97%)

diff --git a/detections/experimental/endpoint/detect_exchange_webshell.yml b/detections/experimental/endpoint/detect_exchange_web_shell.yml
similarity index 97%
rename from detections/experimental/endpoint/detect_exchange_webshell.yml
rename to detections/experimental/endpoint/detect_exchange_web_shell.yml
index c7ef6343d6..5d4f30f523 100644
--- a/detections/experimental/endpoint/detect_exchange_webshell.yml
+++ b/detections/experimental/endpoint/detect_exchange_web_shell.yml
@@ -1,4 +1,4 @@
-name: Detect Exchange Webshell
+name: Detect Exchange Web Shell
 id: 44465d80-810b-11eb-aa30-acde48001122
 version: 1
 date: '2021-03-09'
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | rename parent_process_id as aspx_pid | fields _time aspx_pid process_id dest process_name
   process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | table firstTime, lastTime, aspx_pid, process_id, user, dest, file_name, file_path,
-  process_name, process, process_path, file_hash | `detect_exchange_webshell_filter`'
+  process_name, process, process_path, file_hash | `detect_exchange_web_shell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.