asyncrat-onenote-chain

detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml

@@ -0,0 +1,89 @@
+name: Windows Spearphishing Attachment Onenote Spawn Mshta
+id: 35aeb0e7-7de5-444a-ac45-24d6788796ec
+version: 1
+date: '2023-01-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following detection identifies the latest behavior utilized by different
+  malware families (including TA551, AsyncRat, Redline and DCRAT). This detection identifies onenote
+  Office Product spawning `mshta.exe`. In malicious instances, the command-line of
+  `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination.
+  In addition, Threat Research has released a detections identifying suspicious use
+  of `mshta.exe`. In this instance, we narrow our detection down to the Office suite
+  as a parent process. During triage, review all file modifications. Capture and analyze
+  any artifacts on disk. The Office Product, or `mshta.exe` will have reached out
+  to a remote destination, capture and block the IPs or domain. Review additional
+  parallel processes for further activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("onenote.exe", "onenotem.exe") `process_mshta`
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: No false positives known. Filter as needed.
+references:
+- https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: office parent process $parent_process_name$ will execute a suspicious child
+    process $process_name$ with process id $process_id$ in host $dest$
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

stories/asyncrat.yml

@@ -0,0 +1,24 @@
+name: AsyncRAT
+id: d7053072-7dd2-4874-8314-bfcbc99978a4
+version: 1
+date: '2023-01-24'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the AsyncRAT malware including mshta application child process, bat loader execution, persistence and many more.
+  AsyncRAT is an open source remote administration tool released last 2019. It's designed to remotely control computers via an encrypted 
+  connection, with view screen, keylogger, chat communication, persistence, defense evasion (e.g. Windows defender), DOS attack and many more.
+narrative: although this project contains legal disclaimer, Adversaries or threat actors are popularly used in some attacks. This malware recently 
+  came across a Fully undetected batch script loader that downloads and loads the AsyncRAT from its C2 server. 
+  The batch script is obfuscated and will load a powershell loader that will decode and decrypt (AES256) the actual AsyncRAT malware.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader
+tags:
+  analytic_story: AsyncRAT
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.test.yml

@@ -0,0 +1,13 @@
+name: Windows Spearphishing Attachment Onenote Spawn Mshta Unit Test
+tests:
+- name: Windows Spearphishing Attachment Onenote Spawn Mshta
+  file: endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true