diff --git a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml new file mode 100644 index 0000000000..4b49fdab52 --- /dev/null +++ b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml @@ -0,0 +1,89 @@ +name: Windows Spearphishing Attachment Onenote Spawn Mshta +id: 35aeb0e7-7de5-444a-ac45-24d6788796ec +version: 1 +date: '2023-01-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following detection identifies the latest behavior utilized by different + malware families (including TA551, AsyncRat, Redline and DCRAT). This detection identifies onenote + Office Product spawning `mshta.exe`. In malicious instances, the command-line of + `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. + In addition, Threat Research has released a detections identifying suspicious use + of `mshta.exe`. In this instance, we narrow our detection down to the Office suite + as a parent process. During triage, review all file modifications. Capture and analyze + any artifacts on disk. The Office Product, or `mshta.exe` will have reached out + to a remote destination, capture and block the IPs or domain. Review additional + parallel processes for further activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("onenote.exe", "onenotem.exe") `process_mshta` + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: No false positives known. Filter as needed. +references: +- https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - Spearphishing Attachments + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Recon + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: office parent process $parent_process_name$ will execute a suspicious child + process $process_name$ with process id $process_id$ in host $dest$ + mitre_attack_id: + - T1566.001 + - T1566 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 81 + security_domain: endpoint diff --git a/stories/asyncrat.yml b/stories/asyncrat.yml new file mode 100644 index 0000000000..a0bf397cea --- /dev/null +++ b/stories/asyncrat.yml @@ -0,0 +1,24 @@ +name: AsyncRAT +id: d7053072-7dd2-4874-8314-bfcbc99978a4 +version: 1 +date: '2023-01-24' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the AsyncRAT malware including mshta application child process, bat loader execution, persistence and many more. + AsyncRAT is an open source remote administration tool released last 2019. It's designed to remotely control computers via an encrypted + connection, with view screen, keylogger, chat communication, persistence, defense evasion (e.g. Windows defender), DOS attack and many more. +narrative: although this project contains legal disclaimer, Adversaries or threat actors are popularly used in some attacks. This malware recently + came across a Fully undetected batch script loader that downloads and loads the AsyncRAT from its C2 server. + The batch script is obfuscated and will load a powershell loader that will decode and decrypt (AES256) the actual AsyncRAT malware. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader +tags: + analytic_story: AsyncRAT + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.test.yml b/tests/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.test.yml new file mode 100644 index 0000000000..72a901abc1 --- /dev/null +++ b/tests/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.test.yml @@ -0,0 +1,13 @@ +name: Windows Spearphishing Attachment Onenote Spawn Mshta Unit Test +tests: +- name: Windows Spearphishing Attachment Onenote Spawn Mshta + file: endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true