admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into linux_syscall_auditd_update

Browse Source
This commit is contained in:
Bhavin Patel
2025-04-25 08:54:50 -07:00
committed by GitHub
parent f7e069c0f8 be0e06c743
commit 9ac544fb8e
139 changed files with 4901 additions and 4525 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/delete_shadowcopy_with_powershell.yml
+1 -1
View File
@@ -70,6 +70,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml
+16 -33
View File
@@ -1,7 +1,7 @@
name: Detect Outlook exe writing a zip file
id: a51bfe1a-94f0-4822-b1e4-16ae10145893
version: 11
date: '2025-02-10'
version: 12
date: '2025-04-22'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
@@ -14,38 +14,21 @@ description: The following analytic identifies the execution of `outlook.exe` wr
the security of the affected system and network.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe
by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest
Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename
process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id
type=inner[| tstats `security_content_summariesonly` count values(Filesystem.file_path)
as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem
where (Filesystem.file_path=*.zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users*
OR Filesystem.file_path=*Local\\Temp*) by Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name
Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid
Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)`
| table action dest original_file_name parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path process process_exec process_guid
process_hash process_id process_integrity_level process_name process_path user user_id
vendor_product file_access_time file_create_time file_hash file_modify_time file_name
file_path file_acl file_size firstTime lastTime | stats values(action) as action
values(parent_process) as parent_process values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(file_access_time) as file_access_time values(file_create_time)
as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time
values(file_name) as file_name values(file_path) as file_path values(file_acl) as
file_acl values(file_size) as file_size by process_guid | where isnotnull(process)
AND isnotnull(file_name) | `detect_outlook_exe_writing_a_zip_file_filter`'
OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash
Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | rename process_id as malicious_id| fields
malicious_id outlook_id dest file_path file_name file_hash count file_id] | table
firstTime lastTime user malicious_id outlook_id process_name parent_process_name
file_name file_path | where file_name != "" | `detect_outlook_exe_writing_a_zip_file_filter`'
how_to_implement: You must be ingesting data that records filesystem and process activity
from your hosts to populate the Endpoint data model. This is typically populated
via endpoint detection-and-response product, such as Carbon Black, or endpoint data
detections/endpoint/detect_psexec_with_accepteula_flag.yml
-3
View File
@@ -75,19 +75,16 @@ tags:
analytic_story:
- DHS Report TA18-074A
- Active Directory Lateral Movement
- BlackByte Ransomware
- HAFNIUM Group
- Rhysida Ransomware
- Medusa Ransomware
- DarkSide Ransomware
- SamSam Ransomware
- DarkGate Malware
- CISA AA22-320A
- Sandworm Tools
- IcedID
- BlackByte Ransomware
- DarkGate Malware
- Rhysida Ransomware
- Cactus Ransomware
- Volt Typhoon
- Seashell Blizzard
detections/endpoint/disable_registry_tool.yml
+40 -36
View File
@@ -1,11 +1,12 @@
name: Disable Registry Tool
id: cd2cf33c-9201-11eb-a10a-acde48001122
version: 11
date: '2025-02-10'
version: 12
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry
description:
The following analytic detects modifications to the Windows registry
aimed at disabling the Registry Editor (regedit). It leverages data from the Endpoint.Registry
data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
with a value of "0x00000001". This activity is significant because malware, such
@@ -14,8 +15,9 @@ description: The following analytic detects modifications to the Windows registr
could hinder incident response efforts and allow the attacker to maintain control
over the compromised system.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -23,51 +25,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`|
where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `disable_registry_tool_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Disabled Registry Tools on $dest$
risk_objects:
- field: dest
type: system
score: 40
- field: dest
type: system
score: 40
threat_objects: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1562.001
- T1112
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/disable_security_logs_using_minint_registry.yml
+42 -38
View File
@@ -1,11 +1,12 @@
name: Disable Security Logs Using MiniNt Registry
id: 39ebdc68-25b9-11ec-aec7-acde48001122
version: 10
date: '2024-12-08'
version: 11
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a suspicious registry modification aimed
description:
The following analytic detects a suspicious registry modification aimed
at disabling security audit logs by adding a specific registry entry. It leverages
data from the Endpoint.Registry data model, focusing on changes to the "Control\\MiniNt"
registry path. This activity is significant because it can prevent Windows from
@@ -14,61 +15,64 @@ description: The following analytic detects a suspicious registry modification a
undetected, making it difficult to trace their actions and compromising the integrity
of security audits.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*")
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Unknown.
references:
- https://twitter.com/0gtweet/status/1182516740955226112
- https://twitter.com/0gtweet/status/1182516740955226112
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Modified/added/deleted registry entry $registry_path$ on $dest$
risk_objects:
- field: dest
type: system
score: 80
- field: user
type: user
score: 80
- field: dest
type: system
score: 80
- field: user
type: user
score: 80
threat_objects: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- CISA AA23-347A
- Windows Registry Abuse
- Windows Defense Evasion Tactics
- CISA AA23-347A
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/disable_show_hidden_files.yml
+47 -43
View File
@@ -1,11 +1,12 @@
name: Disable Show Hidden Files
id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
version: 11
date: '2025-02-10'
version: 12
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry
description:
The following analytic detects modifications to the Windows registry
that disable the display of hidden files. It leverages data from the Endpoint.Registry
data model, specifically monitoring changes to registry paths associated with hidden
file settings. This activity is significant because malware, such as worms and trojan
@@ -13,8 +14,9 @@ description: The following analytic detects modifications to the Windows registr
behavior could allow an attacker to conceal malicious files on the system, making
it harder for security tools and analysts to identify and remove the threat.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
@@ -24,58 +26,60 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Disabled 'Show Hidden Files' on $dest$
risk_objects:
- field: dest
type: system
score: 40
- field: dest
type: system
score: 40
threat_objects: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- Azorult
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- Azorult
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1562.001
- T1564.001
- T1112
- T1562.001
- T1564.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
source: WinEventLog:Security
sourcetype: WinEventLog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
source: WinEventLog:System
sourcetype: WinEventLog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
source: WinEventLog:Security
sourcetype: WinEventLog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
source: WinEventLog:System
sourcetype: WinEventLog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/disable_windows_app_hotkeys.yml
+39 -35
View File
@@ -1,11 +1,12 @@
name: Disable Windows App Hotkeys
id: 1490f224-ad8b-11eb-8c4f-acde48001122
version: 10
date: '2025-02-10'
version: 11
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a suspicious registry modification aimed
description:
The following analytic detects a suspicious registry modification aimed
at disabling Windows hotkeys for native applications. It leverages data from the
Endpoint.Registry data model, focusing on specific registry paths and values indicative
of this behavior. This activity is significant as it can impair an analyst's ability
@@ -13,8 +14,9 @@ description: The following analytic detects a suspicious registry modification a
response efforts. If confirmed malicious, this technique can allow an attacker to
maintain persistence and evade detection, complicating the remediation process.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows
NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data=
"HotKey Disabled" AND Registry.registry_value_name = "Debugger") by Registry.action
@@ -23,50 +25,52 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Disabled 'Windows App Hotkeys' on $dest$
risk_objects:
- field: dest
type: system
score: 40
- field: dest
type: system
score: 40
threat_objects: []
tags:
analytic_story:
- XMRig
- Windows Registry Abuse
- XMRig
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1562.001
- T1112
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/disabling_cmd_application.yml
+43 -39
View File
@@ -1,11 +1,12 @@
name: Disabling CMD Application
id: ff86077c-9212-11eb-a1e6-acde48001122
version: 11
date: '2025-02-10'
version: 12
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to the registry that disable
description:
The following analytic detects modifications to the registry that disable
the CMD prompt application. It leverages data from the Endpoint.Registry data model,
specifically looking for changes to the "DisableCMD" registry value. This activity
is significant because disabling CMD can hinder an analyst's ability to investigate
@@ -14,8 +15,9 @@ description: The following analytic detects modifications to the registry that d
for directory and file traversal, complicating incident response and allowing the
attacker to maintain persistence.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -23,54 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `disabling_cmd_application_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The Windows command prompt was disabled on $dest$ by $user$.
risk_objects:
- field: user
type: user
score: 25
- field: dest
type: system
score: 25
- field: user
type: user
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1562.001
- T1112
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/disabling_controlpanel.yml
+42 -38
View File
@@ -1,11 +1,12 @@
name: Disabling ControlPanel
id: 6ae0148e-9215-11eb-a94a-acde48001122
version: 11
date: '2025-02-10'
version: 12
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects registry modifications that disable the
description:
The following analytic detects registry modifications that disable the
Control Panel on Windows systems. It leverages data from the Endpoint.Registry data
model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
with a value of "0x00000001". This activity is significant as it is commonly used
@@ -14,8 +15,9 @@ description: The following analytic detects registry modifications that disable
this could allow attackers to maintain control over the infected machine and prevent
remediation efforts.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -23,53 +25,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`|
where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `disabling_controlpanel_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The Windows Control Panel was disabled on $dest$ by $user$.
risk_objects:
- field: user
type: user
score: 25
- field: dest
type: system
score: 25
- field: user
type: user
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1562.001
- T1112
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test (XML)
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test (XML)
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/disabling_norun_windows_app.yml
+45 -40
View File
@@ -1,11 +1,12 @@
name: Disabling NoRun Windows App
id: de81bc46-9213-11eb-adc9-acde48001122
version: 11
date: '2025-02-10'
version: 12
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the Windows registry
description:
The following analytic detects the modification of the Windows registry
to disable the Run application in the Start menu. It leverages data from the Endpoint.Registry
data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
with a value of "0x00000001". This activity is significant because the Run application
@@ -13,8 +14,9 @@ description: The following analytic detects the modification of the Windows regi
malicious, this action could hinder system cleaning efforts and make it more difficult
to run essential tools, thereby aiding malware persistence.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -22,55 +24,58 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`|
where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `disabling_norun_windows_app_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
- https://blog.malwarebytes.com/detections/pum-optional-norun/
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
- https://blog.malwarebytes.com/detections/pum-optional-norun/
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The Windows registry was modified to disable run application in window
message:
The Windows registry was modified to disable run application in window
start menu on $dest$ by $user$.
risk_objects:
- field: user
type: user
score: 25
- field: dest
type: system
score: 25
- field: user
type: user
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1562.001
- T1112
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+10 -31
View File
@@ -15,37 +15,16 @@ description: The following analytic detects instances of DLLHost.exe running wit
network's security.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=dllhost.exe Processes.action!="blocked" by Processes.action
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `dllhost_with_no_command_line_arguments_with_network_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe
Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)"
| rename dest as src | join host process_id [| tstats `security_content_summariesonly`
count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port)
as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port
!= 0 by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `dllhost_with_no_command_line_arguments_with_network_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/download_files_using_telegram.yml
+42 -36
View File
@@ -1,11 +1,12 @@
name: Download Files Using Telegram
id: 58194e28-ae5e-11eb-8912-acde48001122
version: 6
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious file downloads by the Telegram
description:
The following analytic detects suspicious file downloads by the Telegram
application on a Windows system. It leverages Sysmon EventCode 15 to identify instances
where Telegram.exe creates files with a Zone.Identifier, indicating a download.
This activity is significant as it may indicate an adversary using Telegram to download
@@ -13,59 +14,64 @@ description: The following analytic detects suspicious file downloads by the Tel
malicious, this behavior could lead to network mapping, lateral movement, and potential
compromise of additional systems within the network.
data_source:
- Sysmon EventID 15
search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
- Sysmon EventID 15
search:
'`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
| stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash
file_name file_path process_exec process_guid process_id process_name process_path
signature signature_id user_id vendor_product Contents Image | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the process name and TargetFilename from your endpoints or Events that
monitor filestream events which is happened when process download something. (EventCode
15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon
TA.
known_false_positives: normal download of file in telegram app. (if it was a common
known_false_positives:
normal download of file in telegram app. (if it was a common
app in network)
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Suspicious files were downloaded with the Telegram application on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Phemedrone Stealer
- Crypto Stealer
- Snake Keylogger
- XMRig
- Phemedrone Stealer
- Crypto Stealer
- Snake Keylogger
- XMRig
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1105
- T1105
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+43 -39
View File
@@ -1,11 +1,12 @@
name: Enable WDigest UseLogonCredential Registry
id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
version: 10
date: '2024-12-08'
version: 11
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a suspicious registry modification that
description:
The following analytic detects a suspicious registry modification that
enables the plain text credential feature in Windows by setting the "UseLogonCredential"
value to 1 in the WDigest registry path. This detection leverages data from the
Endpoint.Registry data model, focusing on specific registry paths and values. This
@@ -14,8 +15,9 @@ description: The following analytic detects a suspicious registry modification t
If confirmed malicious, this could allow an attacker to obtain sensitive credentials,
leading to further compromise and lateral movement within the network.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001)
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -23,54 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: wdigest registry $registry_path$ was modified on $dest$
risk_objects:
- field: user
type: user
score: 80
- field: dest
type: system
score: 80
- field: user
type: user
score: 80
- field: dest
type: system
score: 80
threat_objects: []
tags:
analytic_story:
- Credential Dumping
- Windows Registry Abuse
- CISA AA22-320A
- Credential Dumping
- Windows Registry Abuse
- CISA AA22-320A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1003
- T1112
- T1003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/enumerate_users_local_group_using_telegram.yml
+44 -39
View File
@@ -1,11 +1,12 @@
name: Enumerate Users Local Group Using Telegram
id: fcd74532-ae54-11eb-a5ab-acde48001122
version: 8
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a Telegram process enumerating all network
description:
The following analytic detects a Telegram process enumerating all network
users in a local group. It leverages EventCode 4798, which is generated when a process
enumerates a user's security-enabled local groups on a computer or device. This
activity is significant as it may indicate an attempt to gather information on user
@@ -13,60 +14,64 @@ description: The following analytic detects a Telegram process enumerating all n
this behavior could allow an attacker to map out user accounts, potentially leading
to privilege escalation or lateral movement within the network.
data_source:
- Windows Event Log Security 4798
search: '`wineventlog_security` EventCode=4798 CallerProcessName = "*\\telegram.exe"
- Windows Event Log Security 4798
search:
'`wineventlog_security` EventCode=4798 CallerProcessName = "*\\telegram.exe"
| stats count min(_time) as firstTime max(_time) as lastTime by user Computer EventCode
CallerProcessName ProcessID SubjectUserSid SubjectDomainName SubjectLogonId |
rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `enumerate_users_local_group_using_telegram_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and
filter known instances of process like logonUI used in your environment.
known_false_positives: unknown
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The Telegram application has been identified enumerating local groups on
message:
The Telegram application has been identified enumerating local groups on
$dest$ by $user$.
risk_objects:
- field: user
type: user
score: 80
- field: dest
type: system
score: 80
- field: user
type: user
score: 80
- field: dest
type: system
score: 80
threat_objects: []
tags:
analytic_story:
- XMRig
- Compromised Windows Host
- XMRig
- Compromised Windows Host
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1087
- T1087
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/endpoint/excessive_number_of_taskhost_processes.yml
+45 -38
View File
@@ -1,11 +1,12 @@
name: Excessive number of taskhost processes
id: f443dac2-c7cf-11eb-ab51-acde48001122
version: 7
date: '2024-11-13'
version: 8
date: '2025-04-25'
author: Michael Hart
status: production
type: Anomaly
description: The following analytic identifies an excessive number of taskhost.exe
description:
The following analytic identifies an excessive number of taskhost.exe
and taskhostex.exe processes running within a short time frame. It leverages data
from Endpoint Detection and Response (EDR) agents, focusing on process names and
their counts. This behavior is significant as it is commonly associated with post-exploitation
@@ -14,10 +15,11 @@ description: The following analytic identifies an excessive number of taskhost.e
activity could indicate an ongoing attack, allowing attackers to execute code, escalate
privileges, or move laterally within the network.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` values(Processes.action) as action
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` values(Processes.action) as action
values(Processes.original_file_name) as original_file_name values(Processes.parent_process)
as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid)
as parent_process_guid values(Processes.parent_process_id) as parent_process_id
@@ -41,9 +43,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.action) as a
values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level)
as process_integrity_level values(user) as user values(process_path) as process_path
values(user_id) as user_id values(vendor_product) as vendor_product values(process_name)
as process_name by _time, dest, firstTime, lastTime | `security_content_ctime(firstTime)`
as process_name by _time, dest, firstTime, lastTime | where taskhost_count >
10 or taskhostex_count > 10 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -52,46 +56,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: Administrators, administrative actions or certain applications
known_false_positives:
Administrators, administrative actions or certain applications
may run many instances of taskhost and taskhostex concurrently. Filter as needed.
references:
- https://attack.mitre.org/software/S0250/
- https://attack.mitre.org/software/S0250/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: An excessive amount of taskhost.exe and taskhostex.exe was executed on
message:
An excessive amount of taskhost.exe and taskhostex.exe was executed on
$dest$ indicative of suspicious behavior.
risk_objects:
- field: dest
type: system
score: 56
- field: dest
type: system
score: 56
threat_objects: []
tags:
analytic_story:
- Meterpreter
- Meterpreter
asset_type: Endpoint
mitre_attack_id:
- T1059
- T1059
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
-4
View File
@@ -106,10 +106,6 @@ tags:
- WhisperGate
- WinDealer RAT
- XMRig
- MoonPeak
- Industroyer2
- Amadey
- IcedID
- Earth Alux
asset_type: Endpoint
mitre_attack_id:
detections/endpoint/fodhelper_uac_bypass.yml
+53 -48
View File
@@ -1,11 +1,12 @@
name: FodHelper UAC Bypass
id: 909f8fd8-7ac8-11eb-a1f3-acde48001122
version: 9
date: '2025-02-10'
version: 10
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of fodhelper.exe, which
description:
The following analytic detects the execution of fodhelper.exe, which
is known to exploit a User Account Control (UAC) bypass by leveraging specific registry
keys. The detection method uses Endpoint Detection and Response (EDR) telemetry
to identify when fodhelper.exe spawns a child process and accesses the registry
@@ -14,10 +15,11 @@ description: The following analytic detects the execution of fodhelper.exe, whic
with elevated privileges, leading to unauthorized system changes and potential full
system compromise.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
@@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `fodhelper_uac_bypass_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -37,55 +40,57 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: Limited to no false positives are expected.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1
- https://attack.mitre.org/techniques/T1548/002/
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1
- https://attack.mitre.org/techniques/T1548/002/
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Suspicious registry keys added by process fodhelper.exe with a parent_process
message:
Suspicious registry keys added by process fodhelper.exe with a parent_process
of $parent_process_name$ that has been executed on $dest$ by $user$.
risk_objects:
- field: user
type: user
score: 81
- field: dest
type: system
score: 81
- field: user
type: user
score: 81
- field: dest
type: system
score: 81
threat_objects:
- field: parent_process_name
type: parent_process_name
- field: parent_process_name
type: parent_process_name
tags:
analytic_story:
- IcedID
- ValleyRAT
- Compromised Windows Host
- Windows Defense Evasion Tactics
- IcedID
- ValleyRAT
- Compromised Windows Host
- Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1548.002
- T1112
- T1548.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/getwmiobject_user_account_with_powershell.yml
+25 -20
View File
@@ -1,11 +1,12 @@
name: GetWmiObject User Account with PowerShell
id: b44f6ac6-0429-11ec-87e9-acde48001122
version: 7
date: '2025-04-17'
date: '2025-04-22'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `powershell.exe` with
description:
The following analytic detects the execution of `powershell.exe` with
command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount`
parameter to query local user accounts. It leverages data from Endpoint Detection
and Response (EDR) agents, focusing on process names and command-line executions.
@@ -14,10 +15,11 @@ description: The following analytic detects the execution of `powershell.exe` wi
malicious, this behavior could lead to further reconnaissance, privilege escalation,
or lateral movement within the network.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
(Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*) by
Processes.action Processes.dest Processes.original_file_name Processes.parent_process
@@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `getwmiobject_user_account_with_powershell_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -36,25 +39,27 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this PowerShell commandlet
known_false_positives:
Administrators or power users may use this PowerShell commandlet
for troubleshooting.
references:
- https://attack.mitre.org/techniques/T1087/001/
- https://attack.mitre.org/techniques/T1087/001/
tags:
analytic_story:
- Winter Vivern
- Active Directory Discovery
- Winter Vivern
- Active Directory Discovery
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1087.001
- T1087.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+20 -33
View File
@@ -1,7 +1,7 @@
name: GPUpdate with no Command Line Arguments with Network
id: 2c853856-a140-11eb-a5b5-acde48001122
version: 9
date: '2024-12-10'
version: 10
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -16,37 +16,24 @@ description: The following analytic detects the execution of gpupdate.exe withou
leading to system compromise.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=gpupdate.exe by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where
All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `gpupdate_with_no_command_line_arguments_with_network_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=gpupdate.exe
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"|
join process_id [| tstats `security_content_summariesonly` count values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip
values(All_Traffic.direction) as direction values(All_Traffic.dvc) as dvc values(All_Traffic.protocol) as protocol
values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src) as src values(All_Traffic.src_ip) as src_ip
values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport FROM datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port
| `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest
parent_process_name process_name process_path process process_id dest_port C2 app dest_ip direction dvc protocol
protocol_version src src_ip src_port transport |
`gpupdate_with_no_command_line_arguments_with_network_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/java_writing_jsp_file.yml
+14 -28
View File
@@ -1,7 +1,7 @@
name: Java Writing JSP File
id: eb65619c-4f8d-4383-a975-d352765d344b
version: 7
date: '2024-11-13'
version: 8
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -14,38 +14,24 @@ description: The following analytic detects the Java process writing a .jsp file
the affected system, posing a severe security risk.
data_source:
- Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name
IN ("java","java.exe", "javaw.exe") by Processes.action Processes.dest Processes.original_file_name
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.jsp*"
by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name="*.jsp*" by _time Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` |
table action dest original_file_name parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path process process_exec process_guid
process_hash process_id process_integrity_level process_name process_path user user_id
vendor_product file_access_time file_create_time file_hash file_modify_time file_name
file_path file_acl file_size firstTime lastTime | stats values(action) as action
values(dest) as dest values(original_file_name) as original_file_name values(parent_process)
as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid)
as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name)
as parent_process_name values(parent_process_path) as parent_process_path values(process)
as process values(process_exec) as process_exec values(process_hash) as process_hash
values(process_id) as process_id values(process_integrity_level) as process_integrity_level
values(process_name) as process_name values(process_path) as process_path values(user)
as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time)
as file_access_time values(file_create_time) as file_create_time values(file_hash)
as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name
values(file_path) as file_path values(file_acl) as file_acl values(file_size) as
file_size by process_guid | where isnotnull(process) AND isnotnull(file_name) |
`java_writing_jsp_file_filter`'
Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
as lastTime by dest process_name process_guid file_name file_path file_create_time
user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `java_writing_jsp_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
detections/endpoint/lolbas_with_network_traffic.yml
+44 -38
View File
@@ -1,11 +1,12 @@
name: LOLBAS With Network Traffic
id: 2820f032-19eb-497e-8642-25b04a880359
version: 8
date: '2025-04-17'
date: '2025-04-22'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies the use of Living Off the Land Binaries
description:
The following analytic identifies the use of Living Off the Land Binaries
and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic
data model to detect when native Windows binaries, often abused by adversaries,
initiate network connections. This activity is significant as LOLBAS are frequently
@@ -14,8 +15,9 @@ description: The following analytic identifies the use of Living Off the Land Bi
to execute arbitrary code, escalate privileges, or maintain persistence within the
environment, posing a severe threat to organizational security.
data_source:
- Sysmon EventID 3
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 3
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Network_Traffic.All_Traffic where (All_Traffic.app IN
("*Regsvcs.exe", "*\\Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe",
"*Xwizard.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe",
@@ -34,56 +36,60 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
| `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| rex field=app ".*\\\(?<process_name>.*)$" | `lolbas_with_network_traffic_filter`'
how_to_implement: To successfully implement this detection you must ingest events
how_to_implement:
To successfully implement this detection you must ingest events
into the Network traffic data model that contain the source, destination, and communicating
process in the app field. Relevant processes must also be ingested in the Endpoint
data model with matching process_id field. Sysmon EID1 and EID3 are good examples
of this type this data type.
known_false_positives: Legitimate usage of internal automation or scripting, especially
known_false_positives:
Legitimate usage of internal automation or scripting, especially
powershell.exe or pwsh.exe, internal to internal or logon scripts. It may be necessary
to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1")
references:
- https://lolbas-project.github.io/#
- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
- https://lolbas-project.github.io/#
- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
drilldown_searches:
- name: View the detection results for - "$src$"
search: '%original_detection_search% | search src = "$src$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$src$"
search: '%original_detection_search% | search src = "$src$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The LOLBAS $process_name$ on device $src$ was seen communicating with $dest$.
risk_objects:
- field: src
type: system
score: 25
- field: src
type: system
score: 25
threat_objects:
- field: dest_ip
type: ip_address
- field: dest_ip
type: ip_address
tags:
analytic_story:
- Living Off The Land
- Living Off The Land
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1105
- T1567
- T1218
- T1105
- T1567
- T1218
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/malicious_inprocserver32_modification.yml
+46 -40
View File
@@ -1,11 +1,12 @@
name: Malicious InProcServer32 Modification
id: 127c8d08-25ff-11ec-9223-acde48001122
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects a process modifying the registry with
description:
The following analytic detects a process modifying the registry with
a known malicious CLSID under InProcServer32. It leverages data from Endpoint Detection
and Response (EDR) agents, focusing on registry modifications within the HKLM or
HKCU Software Classes CLSID paths. This activity is significant as it may indicate
@@ -13,16 +14,18 @@ description: The following analytic detects a process modifying the registry wit
malicious, this could allow an attacker to persist in the environment, execute arbitrary
code, or escalate privileges, posing a severe threat to system integrity and security.
data_source:
- Sysmon EventID 12
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
- Sysmon EventID 12
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path="*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)"
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `malicious_inprocserver32_modification_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -31,52 +34,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: False positives should be limited, filter as needed. In our
known_false_positives:
False positives should be limited, filter as needed. In our
test case, Remcos used regsvr32.exe to modify the registry. It may be required,
dependent upon the EDR tool producing registry events, to remove (Default) from
the command-line.
references:
- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
- https://tria.ge/210929-ap75vsddan
- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
- https://tria.ge/210929-ap75vsddan
- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A process identified on endpoint $dest$ modifying the registry with a known
message:
A process identified on endpoint $dest$ modifying the registry with a known
malicious clsid under InProcServer32.
risk_objects:
- field: dest
type: system
score: 80
- field: dest
type: system
score: 80
threat_objects: []
tags:
analytic_story:
- Suspicious Regsvr32 Activity
- Remcos
- Suspicious Regsvr32 Activity
- Remcos
asset_type: Endpoint
mitre_attack_id:
- T1218.010
- T1112
- T1218.010
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/mmc_lolbas_execution_process_spawn.yml
+45 -39
View File
@@ -1,11 +1,12 @@
name: Mmc LOLBAS Execution Process Spawn
id: f6601940-4c74-11ec-b9b7-3e22fbd008af
version: 7
date: '2025-04-17'
date: '2025-04-22'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution
description:
The following analytic identifies `mmc.exe` spawning a LOLBAS execution
process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing
on process creation events where `mmc.exe` is the parent process. This activity
is significant because adversaries can abuse the DCOM protocol and MMC20 COM object
@@ -14,10 +15,11 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu
allowing attackers to execute code remotely, potentially leading to further compromise
and persistence within the environment.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe)
(Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
"Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
@@ -37,7 +39,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `mmc_lolbas_execution_process_spawn_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -46,49 +49,52 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: Legitimate applications may trigger this behavior, filter as
known_false_positives:
Legitimate applications may trigger this behavior, filter as
needed.
references:
- https://attack.mitre.org/techniques/T1021/003/
- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
- https://lolbas-project.github.io/
- https://attack.mitre.org/techniques/T1021/003/
- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
- https://lolbas-project.github.io/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Mmc.exe spawned a LOLBAS process on $dest$.
risk_objects:
- field: dest
type: system
score: 54
- field: dest
type: system
score: 54
threat_objects: []
tags:
analytic_story:
- Active Directory Lateral Movement
- Living Off The Land
- Active Directory Lateral Movement
- Living Off The Land
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1021.003
- T1218.014
- T1021.003
- T1218.014
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/msi_module_loaded_by_non_system_binary.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: MSI Module Loaded by Non-System Binary
id: ccb98a66-5851-11ec-b91c-acde48001122
version: 7
date: '2025-02-10'
version: 8
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: Hunting
@@ -38,7 +38,7 @@ tags:
cve:
- CVE-2021-41379
mitre_attack_id:
- T1574.002
- T1574.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/msmpeng_application_dll_side_loading.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Msmpeng Application DLL Side Loading
id: 8bb3f280-dd9b-11eb-84d5-acde48001122
version: 8
date: '2025-02-10'
version: 9
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Sanjay Govind
status: production
type: TTP
@@ -57,7 +57,7 @@ tags:
- Revil Ransomware
asset_type: Endpoint
mitre_attack_id:
- T1574.002
- T1574.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
+14 -29
View File
@@ -1,7 +1,7 @@
name: Outbound Network Connection from Java Using Default Ports
id: d2c14d28-5c47-11ec-9892-acde48001122
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Mauricio Velazco, Lou Stella, Splunk
status: production
type: TTP
@@ -15,39 +15,24 @@ description: "The following analytic detects outbound network connections from J
\ further compromise of the affected server."
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR
Processes.process_name=javaw.exe) by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where
(All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port
= 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `outbound_network_connection_from_java_using_default_ports_filter`'
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port
= 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC]
| table _time dest parent_process_name process_name process_path process dest_port
| `outbound_network_connection_from_java_using_default_ports_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/potential_telegram_api_request_via_commandline.yml
+47 -41
View File
@@ -1,11 +1,12 @@
name: Potential Telegram API Request Via CommandLine
id: d6b0d627-d0bf-46b1-936f-c48284767d21
version: 3
date: '2025-04-17'
date: '2025-04-22'
author: Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa
status: production
type: Anomaly
description: The following analytic detects the presence of "api.telegram.org" in
description:
The following analytic detects the presence of "api.telegram.org" in
the CommandLine of a process. It leverages data from Endpoint Detection and Response
(EDR) agents, focusing on process execution logs that include command-line details.
This activity can be significant as the telegram API has been used as an exfiltration
@@ -13,10 +14,11 @@ description: The following analytic detects the presence of "api.telegram.org" i
or malware to exfiltrate data or receive additional C2 instruction, potentially
leading to further compromise and persistence within the network.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process= "*api.telegram.org*"
NOT Processes.process IN ("*-osint -url*", "* --single-argument*") by Processes.action
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
@@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `potential_telegram_api_request_via_commandline_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -35,52 +38,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: False positive may stem from application or users requesting
known_false_positives:
False positive may stem from application or users requesting
the API directly via CommandLine for testing purposes. Investigate the matches and
apply the necessary filters.
references:
- https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior
- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior
- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content
- https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content
- https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior
- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior
- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content
- https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Process $process_name$ with command line $process$ in $dest$
risk_objects:
- field: dest
type: system
score: 30
- field: dest
type: system
score: 30
threat_objects:
- field: process_name
type: process_name
- field: process_name
type: process_name
tags:
analytic_story:
- XMRig
- XMRig
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1102.002
- T1041
- T1102.002
- T1041
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/powershell_4104_hunting.yml
+44 -43
View File
@@ -1,11 +1,12 @@
name: PowerShell 4104 Hunting
id: d6f2b006-0041-11ec-8885-acde48001122
version: 15
date: '2025-04-17'
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies suspicious PowerShell execution using
description:
The following analytic identifies suspicious PowerShell execution using
Script Block Logging (EventCode 4104). It leverages specific patterns and keywords
within the ScriptBlockText field to detect potentially malicious activities. This
detection is significant for SOC analysts as PowerShell is commonly used by attackers
@@ -14,8 +15,9 @@ description: The following analytic identifies suspicious PowerShell execution u
execute arbitrary commands, exfiltrate data, or maintain long-term access to the
compromised system, posing a severe threat to the organization's security.
data_source:
- Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"),
- Powershell Script Block Logging 4104
search:
'`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"),
"4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) |
eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0)
@@ -43,53 +45,52 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i
compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal,
reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | rename Computer
as dest, UserID as user | `powershell_4104_hunting_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
how_to_implement:
The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Limited false positives. May filter as needed.
references:
- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
- https://www.mandiant.com/resources/greater-visibilityt
- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
- https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
- https://www.mandiant.com/resources/greater-visibilityt
- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
- https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
tags:
analytic_story:
- Braodo Stealer
- Cactus Ransomware
- China-Nexus Threat Activity
- CISA AA23-347A
- CISA AA24-241A
- Cleo File Transfer Software
- DarkGate Malware
- Data Destruction
- Flax Typhoon
- Hermetic Wiper
- Lumma Stealer
- Malicious PowerShell
- Medusa Ransomware
- Rhysida Ransomware
- Salt Typhoon
- SystemBC
- PHP-CGI RCE Attack on Japanese Organizations
- Rhysida Ransomware
- Salt Typhoon
- SystemBC
- Braodo Stealer
- Cactus Ransomware
- China-Nexus Threat Activity
- CISA AA23-347A
- CISA AA24-241A
- Cleo File Transfer Software
- DarkGate Malware
- Data Destruction
- Flax Typhoon
- Hermetic Wiper
- Lumma Stealer
- Malicious PowerShell
- Medusa Ransomware
- Rhysida Ransomware
- Salt Typhoon
- SystemBC
- PHP-CGI RCE Attack on Japanese Organizations
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1059.001
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
detections/endpoint/powershell_creating_thread_mutex.yml
+47 -41
View File
@@ -1,11 +1,12 @@
name: Powershell Creating Thread Mutex
id: 637557ec-ca08-11eb-bd0a-acde48001122
version: 9
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of PowerShell scripts using
description:
The following analytic detects the execution of PowerShell scripts using
the `mutex` function via EventCode 4104. This detection leverages PowerShell Script
Block Logging to identify scripts that create thread mutexes, a technique often
used in obfuscated scripts to ensure only one instance runs on a compromised machine.
@@ -14,61 +15,66 @@ description: The following analytic detects the execution of PowerShell scripts
control over a process, potentially leading to further exploitation or persistence
within the environment.
data_source:
- Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | fillnull
- Powershell Script Block Logging 4104
search:
'`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | fillnull
| stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id
user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
how_to_implement:
To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell developer may used this function in their script
known_false_positives:
powershell developer may used this function in their script
for instance checking too.
references:
- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user_id$"
search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user_id$"
search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A suspicious powershell script contains Thread Mutex on host $dest$
risk_objects:
- field: dest
type: system
score: 40
- field: user_id
type: user
score: 40
- field: dest
type: system
score: 40
- field: user_id
type: user
score: 40
threat_objects: []
tags:
analytic_story:
- Malicious PowerShell
- Malicious PowerShell
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1027.005
- T1059.001
- T1027.005
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
detections/endpoint/remcos_client_registry_install_entry.yml
+41 -36
View File
@@ -1,11 +1,12 @@
name: Remcos client registry install entry
id: f2a1615a-1d63-11ec-97d2-acde48001122
version: 7
date: '2024-11-13'
version: 8
date: '2025-04-22'
author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the presence of a registry key associated
description:
The following analytic detects the presence of a registry key associated
with the Remcos RAT agent on a host. It leverages data from the Endpoint.Processes
and Endpoint.Registry data models in Splunk, focusing on instances where the "license"
key is found in the "Software\Remcos" path. This behavior is significant as it indicates
@@ -14,16 +15,18 @@ description: The following analytic detects the presence of a registry key assoc
over the system, steal sensitive information, or use the compromised host for further
attacks. Immediate investigation and remediation are required.
data_source:
- Sysmon EventID 12
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
- Sysmon EventID 12
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.action Registry.dest
Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|`remcos_client_registry_install_entry_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -34,44 +37,46 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://attack.mitre.org/software/S0332/
- https://attack.mitre.org/software/S0332/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry entry $registry_path$ with registry keyname $registry_key_name$
message:
A registry entry $registry_path$ with registry keyname $registry_key_name$
related to Remcos RAT in host $dest$
risk_objects:
- field: dest
type: system
score: 90
- field: dest
type: system
score: 90
threat_objects: []
tags:
analytic_story:
- Remcos
- Windows Registry Abuse
- Remcos
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/revil_registry_entry.yml
+46 -41
View File
@@ -1,11 +1,12 @@
name: Revil Registry Entry
id: e3d3f57a-c381-11eb-9e35-acde48001122
version: 7
date: '2024-11-13'
version: 8
date: '2025-04-22'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies suspicious modifications in the registry
description:
The following analytic identifies suspicious modifications in the registry
entry, specifically targeting paths used by malware like REVIL. It detects changes
in registry paths such as `SOFTWARE\\WOW6432Node\\Facebook_Assistant` and `SOFTWARE\\WOW6432Node\\BlackLivesMatter`.
This detection leverages data from Endpoint Detection and Response (EDR) agents,
@@ -15,9 +16,10 @@ description: The following analytic identifies suspicious modifications in the r
attackers to maintain persistence, encrypt files, and store critical ransomware-related
information on compromised hosts.
data_source:
- Sysmon EventID 12
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
- Sysmon EventID 12
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `revil_registry_entry_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -36,49 +39,51 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry entry $registry_path$ with registry value $registry_value_name$
message:
A registry entry $registry_path$ with registry value $registry_value_name$
and $registry_value_name$ related to revil ransomware in host $dest$
risk_objects:
- field: dest
type: system
score: 60
- field: user
type: user
score: 60
- field: dest
type: system
score: 60
- field: user
type: user
score: 60
threat_objects: []
tags:
analytic_story:
- Ransomware
- Revil Ransomware
- Windows Registry Abuse
- Ransomware
- Revil Ransomware
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/rundll32_shimcache_flush.yml
+44 -40
View File
@@ -1,11 +1,12 @@
name: Rundll32 Shimcache Flush
id: a913718a-25b6-11ec-96d3-acde48001122
version: 6
date: '2024-12-10'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a suspicious rundll32
description:
The following analytic detects the execution of a suspicious rundll32
command line used to clear the shim cache. It leverages data from Endpoint Detection
and Response (EDR) agents, focusing on process execution logs and command-line arguments.
This activity is significant because clearing the shim cache is an anti-forensic
@@ -13,10 +14,11 @@ description: The following analytic detects the execution of a suspicious rundll
malicious, this action could hinder incident response efforts, allowing an attacker
to cover their tracks and maintain persistence on the compromised machine.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process
= "*apphelp.dll,ShimFlushCache*" by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
@@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -36,47 +39,48 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://blueteamops.medium.com/shimcache-flush-89daff28d15e
- https://blueteamops.medium.com/shimcache-flush-89daff28d15e
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: rundll32 process execute $process$ to clear shim cache on $dest$
risk_objects:
- field: dest
type: system
score: 80
- field: user
type: user
score: 80
- field: dest
type: system
score: 80
- field: user
type: user
score: 80
threat_objects: []
tags:
analytic_story:
- Unusual Processes
- Living Off The Land
- Compromised Windows Host
- Unusual Processes
- Living Off The Land
- Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+18 -31
View File
@@ -15,37 +15,24 @@ description: The following analytic detects the execution of rundll32.exe withou
of the system.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_rundll32` AND Processes.action!="blocked" by Processes.action Processes.dest
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `rundll32_with_no_command_line_arguments_with_network_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Processes where `process_rundll32` AND Processes.action!="blocked"
by host _time span=1h Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(?i)(rundll32\.exe.{0,4}$)" | rename dest as src | join host process_id
[| tstats `security_content_summariesonly` count
FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host
All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`]
| `rundll32_with_no_command_line_arguments_with_network_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+17 -31
View File
@@ -15,37 +15,23 @@ description: The following analytic detects instances of searchprotocolhost.exe
and control, potentially leading to data exfiltration or further system compromise.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=searchprotocolhost.exe by Processes.action Processes.dest
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `searchprotocolhost_with_no_command_line_with_network_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats
`security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name
process_name process_path process process_id dest_port C2 | `searchprotocolhost_with_no_command_line_with_network_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/spoolsv_writing_a_dll.yml
+16 -34
View File
@@ -1,7 +1,7 @@
name: Spoolsv Writing a DLL
id: d5bf5cf2-da71-11eb-92c2-acde48001122
version: 9
date: '2025-03-27'
version: 10
date: '2025-04-22'
author: Mauricio Velazco, Michael Haag, Splunk
status: production
type: TTP
@@ -16,38 +16,20 @@ description: The following analytic detects `spoolsv.exe` writing a `.dll` file,
data_source:
- Sysmon EventID 1 AND Sysmon EventID 11
- Windows Event Log Security 4688 AND Sysmon EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll"
by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` |
table action dest original_file_name parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path process process_exec process_guid
process_hash process_id process_integrity_level process_name process_path user user_id
vendor_product file_access_time file_create_time file_hash file_modify_time file_name
file_path file_acl file_size firstTime lastTime | stats values(action) as action
values(dest) as dest values(original_file_name) as original_file_name values(parent_process)
as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid)
as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name)
as parent_process_name values(parent_process_path) as parent_process_path values(process)
as process values(process_exec) as process_exec values(process_hash) as process_hash
values(process_id) as process_id values(process_integrity_level) as process_integrity_level
values(process_name) as process_name values(process_path) as process_path values(user)
as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time)
as file_access_time values(file_create_time) as file_create_time values(file_hash)
as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name
values(file_path) as file_path values(file_acl) as file_acl values(file_size) as
file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name)
| `spoolsv_writing_a_dll_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=spoolsv.exe by _time Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [|
tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*"
Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.process_guid Filesystem.file_create_time
Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
fields _time dest file_create_time file_name file_path process_name process_path
process_guid process] | dedup file_create_time | table dest file_create_time, file_name,
file_path, process_name process_guid | `spoolsv_writing_a_dll_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
detections/endpoint/suspicious_copy_on_system32.yml
+49 -44
View File
@@ -1,11 +1,12 @@
name: Suspicious Copy on System32
id: ce633e56-25b2-11ec-9e76-acde48001122
version: 9
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious file copy operations from the
description:
The following analytic detects suspicious file copy operations from the
System32 or SysWow64 directories, often indicative of malicious activity. It leverages
data from Endpoint Detection and Response (EDR) agents, focusing on processes initiated
by command-line tools like cmd.exe or PowerShell. This behavior is significant as
@@ -14,10 +15,11 @@ description: The following analytic detects suspicious file copy operations from
arbitrary code, potentially leading to system compromise or further lateral movement
within the network.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*")
@@ -30,7 +32,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
| eval splitted_commandline=split(process," ") | eval first_cmdline=lower(mvindex(splitted_commandline,0))
| where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%")
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`suspicious_copy_on_system32_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -41,52 +44,54 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: every user may do this event but very un-ussual.
references:
- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Execution of copy exe to copy file from $process$ on $dest$
risk_objects:
- field: dest
type: system
score: 63
- field: user
type: user
score: 63
- field: dest
type: system
score: 63
- field: user
type: user
score: 63
threat_objects: []
tags:
analytic_story:
- Qakbot
- Sandworm Tools
- IcedID
- Volt Typhoon
- AsyncRAT
- Unusual Processes
- Compromised Windows Host
- Qakbot
- Sandworm Tools
- IcedID
- Volt Typhoon
- AsyncRAT
- Unusual Processes
- Compromised Windows Host
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1036.003
- T1036.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+17 -35
View File
@@ -1,7 +1,7 @@
name: Suspicious Image Creation In Appdata Folder
id: f6f904c4-1ac0-11ec-806b-acde48001122
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -15,39 +15,21 @@ description: The following analytic detects the creation of image files in the A
compromising sensitive information and user privacy.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe
Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path="*\\appdata\\Roaming\\*"
by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` |
table action dest original_file_name parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path process process_exec process_guid
process_hash process_id process_integrity_level process_name process_path user user_id
vendor_product file_access_time file_create_time file_hash file_modify_time file_name
file_path file_acl file_size firstTime lastTime | stats values(action) as action
values(dest) as dest values(original_file_name) as original_file_name values(parent_process)
as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid)
as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name)
as parent_process_name values(parent_process_path) as parent_process_path values(process)
as process values(process_exec) as process_exec values(process_hash) as process_hash
values(process_id) as process_id values(process_integrity_level) as process_integrity_level
values(process_name) as process_name values(process_path) as process_path values(user)
as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time)
as file_access_time values(file_create_time) as file_create_time values(file_hash)
as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name
values(file_path) as file_path values(file_acl) as file_acl values(file_size) as
file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name)
| `suspicious_image_creation_in_appdata_folder_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
by _time span=1h Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path=
"*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time
Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid | fields _time dest file_create_time file_name
file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
detections/endpoint/suspicious_process_executed_from_container_file.yml
+50 -45
View File
@@ -1,11 +1,12 @@
name: Suspicious Process Executed From Container File
id: d8120352-3b62-411c-8cb6-7b47584dd5e8
version: 6
date: '2025-04-17'
date: '2025-04-22'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies a suspicious process executed from
description:
The following analytic identifies a suspicious process executed from
within common container/archive file types such as ZIP, ISO, IMG, and others. It
leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
names and command-line executions. This activity is significant as it is a common
@@ -13,10 +14,11 @@ description: The following analytic identifies a suspicious process executed fro
malicious, this behavior could allow attackers to execute arbitrary code, escalate
privileges, or persist within the environment, posing a significant security risk.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count values(Processes.process_name)
as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*")
AND Processes.action="allowed" by Processes.action Processes.dest Processes.original_file_name
@@ -28,7 +30,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
| regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$"
| rex field=process "(?i).+\\\\(?<file_name>[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?<process_name>.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"|
`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -39,53 +42,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: Various business process or userland applications and behavior.
references:
- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
- https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/
- https://attack.mitre.org/techniques/T1204/002/
- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
- https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/
- https://attack.mitre.org/techniques/T1204/002/
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A suspicious process $process_name$ was launched from $file_name$ on $dest$.
risk_objects:
- field: dest
type: system
score: 16
- field: user
type: user
score: 16
- field: dest
type: system
score: 16
- field: user
type: user
score: 16
threat_objects:
- field: file_name
type: file_name
- field: file_name
type: file_name
tags:
analytic_story:
- Unusual Processes
- Amadey
- Remcos
- Snake Keylogger
- Unusual Processes
- Amadey
- Remcos
- Snake Keylogger
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1204.002
- T1036.008
- T1204.002
- T1036.008
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/suspicious_reg_exe_process.yml
+52 -46
View File
@@ -1,11 +1,12 @@
name: Suspicious Reg exe Process
id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
version: 10
date: '2024-11-13'
version: 11
date: '2025-04-22'
author: David Dorsey, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances of reg.exe being launched
description:
The following analytic identifies instances of reg.exe being launched
from a command prompt (cmd.exe) that was not initiated by the user, as indicated
by a parent process other than explorer.exe. This detection leverages data from
Endpoint Detection and Response (EDR) agents, focusing on process and parent process
@@ -15,10 +16,11 @@ description: The following analytic identifies instances of reg.exe being launch
to modify critical system settings, potentially leading to privilege escalation
or persistent access.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name
!= explorer.exe Processes.process_name =cmd.exe by Processes.action Processes.dest
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
@@ -32,7 +34,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | rename parent_process_id as process_id |dedup
process_id| table process_id dest] | `suspicious_reg_exe_process_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -41,56 +44,59 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: It's possible for system administrators to write scripts that
known_false_positives:
It's possible for system administrators to write scripts that
exhibit this behavior. If this is the case, the search will need to be modified
to filter them out.
references:
- https://car.mitre.org/wiki/CAR-2013-03-001/
- https://car.mitre.org/wiki/CAR-2013-03-001/
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: An instance of $parent_process_name$ spawning $process_name$ was identified
message:
An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to add a registry entry.
risk_objects:
- field: user
type: user
score: 35
- field: dest
type: system
score: 35
- field: user
type: user
score: 35
- field: dest
type: system
score: 35
threat_objects:
- field: parent_process_name
type: parent_process_name
- field: process_name
type: process_name
- field: parent_process_name
type: parent_process_name
- field: process_name
type: process_name
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Disabling Security Tools
- DHS Report TA18-074A
- Windows Defense Evasion Tactics
- Disabling Security Tools
- DHS Report TA18-074A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
+16 -34
View File
@@ -1,7 +1,7 @@
name: Suspicious WAV file in Appdata Folder
id: 5be109e6-1ac5-11ec-b421-acde48001122
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -16,39 +16,21 @@ description: The following analytic detects the creation of .wav files in the Ap
data_source:
- Sysmon EventID 1 AND Sysmon EventID 11
- Windows Event Log Security 4688 AND Sysmon EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe
Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
by _time span=1h Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count
min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*"
by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` |
table action dest original_file_name parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path process process_exec process_guid
process_hash process_id process_integrity_level process_name process_path user user_id
vendor_product file_access_time file_create_time file_hash file_modify_time file_name
file_path file_acl file_size firstTime lastTime | stats values(action) as action
values(dest) as dest values(original_file_name) as original_file_name values(parent_process)
as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid)
as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name)
as parent_process_name values(parent_process_path) as parent_process_path values(process)
as process values(process_exec) as process_exec values(process_hash) as process_hash
values(process_id) as process_id values(process_integrity_level) as process_integrity_level
values(process_name) as process_name values(process_path) as process_path values(user)
as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time)
as file_access_time values(file_create_time) as file_create_time values(file_hash)
as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name
values(file_path) as file_path values(file_acl) as file_acl values(file_size) as
file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name)
| `suspicious_wav_file_in_appdata_folder_filter`'
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid | fields file_name file_path process_name process_path
process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, file_name, file_path and command-line
executions from your endpoints. If you are using Sysmon, you must have at least
detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
+11 -29
View File
@@ -1,7 +1,7 @@
name: Suspicious writes to windows Recycle Bin
id: b5541828-8ffd-4070-9d95-b3da4de924cb
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Rico Valdez, Splunk
status: production
type: TTP
@@ -15,38 +15,20 @@ description: The following analytic detects when a process other than explorer.e
tools.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name)
as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*"
by Filesystem.process_name Filesystem.process_id Filesystem.dest | `drop_dm_object_name("Filesystem")`
| join process_id [| tstats `security_content_summariesonly` values(Processes.user)
as user values(Processes.process_name) as process_name values(Processes.parent_process_name)
as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name
!= "explorer.exe" by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path
= "*$Recycle.Bin*" by Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name
Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid
Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)`
| table action dest original_file_name parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path process process_exec process_guid
process_hash process_id process_integrity_level process_name process_path user user_id
vendor_product file_access_time file_create_time file_hash file_modify_time file_name
file_path file_acl file_size firstTime lastTime | stats values(action) as action
values(dest) as dest values(original_file_name) as original_file_name values(parent_process)
as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid)
as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name)
as parent_process_name values(parent_process_path) as parent_process_path values(process)
as process values(process_exec) as process_exec values(process_hash) as process_hash
values(process_id) as process_id values(process_integrity_level) as process_integrity_level
values(process_name) as process_name values(process_path) as process_path values(user)
as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time)
as file_access_time values(file_create_time) as file_create_time values(file_hash)
as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name
values(file_path) as file_path values(file_acl) as file_acl values(file_size) as
file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name)
| `suspicious_writes_to_windows_recycle_bin_filter`'
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")`
| table user process_name process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on filesystem and process logs responsible for the changes from your endpoints into
the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes.
detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
+14 -29
View File
@@ -1,7 +1,7 @@
name: Unknown Process Using The Kerberos Protocol
id: c91a0852-9fbb-11ec-af44-acde48001122
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Mauricio Velazco, Splunk
status: production
type: TTP
@@ -15,37 +15,22 @@ description: The following analytic identifies a non-lsass.exe process making an
access or lateral movement within the network.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name!=lsass.exe by Processes.action Processes.dest Processes.original_file_name
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name!=lsass.exe by _time Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where
All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `unknown_process_using_the_kerberos_protocol_filter`'
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| join process_id dest [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)` | rename src as dest ] | table _time dest
parent_process_name process_name process_path process process_id dest_port | `unknown_process_using_the_kerberos_protocol_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/windows_adfind_exe.yml
+57 -51
View File
@@ -1,11 +1,12 @@
name: Windows AdFind Exe
id: bd3b0187-189b-46c0-be45-f52da2bae67f
version: 8
date: '2024-11-13'
version: 9
date: '2025-04-24'
author: Jose Hernandez, Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of `adfind.exe` with
description:
The following analytic identifies the execution of `adfind.exe` with
specific command-line arguments related to Active Directory queries. It leverages
data from Endpoint Detection and Response (EDR) agents, focusing on process names,
command-line arguments, and parent processes. This activity is significant because
@@ -14,10 +15,11 @@ description: The following analytic identifies the execution of `adfind.exe` wit
allow attackers to map the AD environment, facilitating further attacks such as
privilege escalation or lateral movement.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *"
OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*-gcb
*" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*"))
@@ -27,8 +29,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_adfind_exe_filter`| `windows_adfind_exe_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
| `windows_adfind_exe_filter`'
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -37,61 +40,64 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: ADfind is a command-line tool for AD administration and management
known_false_positives:
ADfind is a command-line tool for AD administration and management
that is seen to be leveraged by various adversaries. Filter out legitimate administrator
usage using the filter macro.
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
- https://www.joeware.net/freetools/tools/adfind/index.htm
- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
- https://www.joeware.net/freetools/tools/adfind/index.htm
- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Windows AdFind Exe detected with command-line arguments associated with
message:
Windows AdFind Exe detected with command-line arguments associated with
Active Directory queries on machine - [dest]
risk_objects:
- field: user
type: user
score: 25
- field: user
type: user
score: 25
threat_objects: []
tags:
analytic_story:
- Domain Trust Discovery
- IcedID
- NOBELIUM Group
- Graceful Wipe Out Attack
- BlackSuit Ransomware
- Domain Trust Discovery
- IcedID
- NOBELIUM Group
- Graceful Wipe Out Attack
- BlackSuit Ransomware
asset_type: Endpoint
atomic_guid:
- 736b4f53-f400-4c22-855d-1a6b5a551600
- b95fd967-4e62-4109-b48d-265edfd28c3a
- e1ec8d20-509a-4b9a-b820-06c9b2da8eb7
- 5e2938fb-f919-47b6-8b29-2f6a1f718e99
- abf00f6c-9983-4d9a-afbc-6b1c6c6448e1
- 51a98f96-0269-4e09-a10f-e307779a8b05
- 736b4f53-f400-4c22-855d-1a6b5a551600
- b95fd967-4e62-4109-b48d-265edfd28c3a
- e1ec8d20-509a-4b9a-b820-06c9b2da8eb7
- 5e2938fb-f919-47b6-8b29-2f6a1f718e99
- abf00f6c-9983-4d9a-afbc-6b1c6c6448e1
- 51a98f96-0269-4e09-a10f-e307779a8b05
mitre_attack_id:
- T1018
- T1018
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml
+60 -53
View File
@@ -1,11 +1,12 @@
name: Windows Cmdline Tool Execution From Non-Shell Process
id: 2afa393f-b88d-41b7-9793-623c93a2dfde
version: 5
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`,
description:
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`,
or similar tools are executed by a non-standard shell parent process, excluding
CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response
(EDR) telemetry to monitor process creation events. Such behavior is significant
@@ -14,10 +15,11 @@ description: The following analytic identifies instances where `ipconfig.exe`, `
allow attackers to gather critical host information, aiding in further exploitation
or lateral movement within the network.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe",
"systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe",
"whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe",
@@ -29,7 +31,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_cmdline_tool_execution_from_non_shell_process_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -38,64 +41,68 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: A network operator or systems administrator may utilize an
known_false_positives:
A network operator or systems administrator may utilize an
automated host discovery application that may generate false positives. Filter as
needed.
references:
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A non-standard parent process $parent_process_name$ spawned child process
message:
A non-standard parent process $parent_process_name$ spawned child process
$process_name$ to execute command-line tool on $dest$.
risk_objects:
- field: dest
type: system
score: 56
- field: user
type: user
score: 56
- field: dest
type: system
score: 56
- field: user
type: user
score: 56
threat_objects:
- field: parent_process_name
type: parent_process_name
- field: process_name
type: process_name
- field: parent_process_name
type: parent_process_name
- field: process_name
type: process_name
tags:
analytic_story:
- CISA AA22-277A
- Gozi Malware
- CISA AA23-347A
- Qakbot
- Medusa Ransomware
- DarkGate Malware
- Rhysida Ransomware
- Volt Typhoon
- FIN7
- CISA AA22-277A
- Gozi Malware
- CISA AA23-347A
- Qakbot
- Medusa Ransomware
- DarkGate Malware
- Rhysida Ransomware
- Volt Typhoon
- FIN7
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1059.007
- T1059.007
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
+13 -31
View File
@@ -1,7 +1,7 @@
name: Windows Defacement Modify Transcodedwallpaper File
id: e11c3d90-5bc7-42ad-94cd-ba75db10d897
version: 5
date: '2024-11-13'
version: 6
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -15,39 +15,21 @@ description: The following analytic identifies modifications to the TranscodedWa
potentially leading to further system compromise or data exfiltration.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path
!="*\\Windows\\Explorer.EXE" by Processes.action Processes.dest Processes.original_file_name
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_path !="*\\Windows\\Explorer.EXE"
by _time span=1h Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path
= "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by Filesystem.action
Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash
Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl
Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user
Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
file_access_time file_create_time file_hash file_modify_time file_name file_path
file_acl file_size firstTime lastTime | stats values(action) as action values(dest)
as dest values(original_file_name) as original_file_name values(parent_process)
as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid)
as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name)
as parent_process_name values(parent_process_path) as parent_process_path values(process)
as process values(process_exec) as process_exec values(process_hash) as process_hash
values(process_id) as process_id values(process_integrity_level) as process_integrity_level
values(process_name) as process_name values(process_path) as process_path values(user)
as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time)
as file_access_time values(file_create_time) as file_create_time values(file_hash)
as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name
values(file_path) as file_path values(file_acl) as file_acl values(file_size) as
file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name)
| `windows_defacement_modify_transcodedwallpaper_file_filter`'
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid,
_time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper"
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid | fields file_name file_path process_name process_path
process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition,
detections/endpoint/windows_defender_asr_registry_modification.yml
+22 -19
View File
@@ -1,13 +1,14 @@
name: Windows Defender ASR Registry Modification
id: 6a1b6cbe-6612-44c3-92b9-1a1bd77412eb
version: 5
date: '2024-11-13'
version: 6
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: Hunting
data_source:
- Windows Event Log Defender 5007
description: The following analytic detects modifications to Windows Defender Attack
- Windows Event Log Defender 5007
description:
The following analytic detects modifications to Windows Defender Attack
Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational
logs, specifically EventCode 5007, to identify changes in ASR rules. This activity
is significant because ASR rules are designed to block actions commonly used by
@@ -15,7 +16,8 @@ description: The following analytic detects modifications to Windows Defender At
an attempt to weaken system defenses. If confirmed malicious, this could allow an
attacker to bypass security measures, leading to potential system compromise and
data breaches.
search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$"
search:
'`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$"
| rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" | rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*="
| eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1",
"Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval
@@ -25,33 +27,34 @@ search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Regis
Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT
ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)`
| `windows_defender_asr_registry_modification_filter`'
how_to_implement: The following analytic requires collection of Windows Defender Operational
how_to_implement:
The following analytic requires collection of Windows Defender Operational
logs in either XML or multi-line. To collect, setup a new input for the Windows
Defender Operational logs. In addition, it does require a lookup that maps the ID
to ASR Rule name.
known_false_positives: False positives are expected from legitimate applications generating
known_false_positives:
False positives are expected from legitimate applications generating
events that are similar to those generated by malicious activity. For example, Event
ID 5007 is generated when a process attempts to modify a registry key that is related
to ASR rules. This can be triggered by legitimate applications that attempt to modify
registry keys that are not blocked by ASR rules.
references:
- https://asrgen.streamlit.app/
- https://asrgen.streamlit.app/
tags:
analytic_story:
- Windows Attack Surface Reduction
- Windows Attack Surface Reduction
asset_type: Endpoint
atomic_guid: []
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/defender/asr_registry.log
source: WinEventLog:Microsoft-Windows-Windows Defender/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/defender/asr_registry.log
source: WinEventLog:Microsoft-Windows-Windows Defender/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_defender_asr_rule_disabled.yml
+39 -35
View File
@@ -1,20 +1,22 @@
name: Windows Defender ASR Rule Disabled
id: 429d611b-3183-49a7-b235-fc4203c4e1cb
version: 5
date: '2024-11-13'
version: 6
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- Windows Event Log Defender 5007
description: The following analytic identifies when a Windows Defender ASR rule disabled
- Windows Event Log Defender 5007
description:
The following analytic identifies when a Windows Defender ASR rule disabled
events. ASR is a feature of Windows Defender Exploit Guard that prevents actions
and apps that are typically used by exploit-seeking malware to infect machines.
ASR rules are applied to processes and applications. When a process or application
attempts to perform an action that is blocked by an ASR rule, an event is generated.
This detection searches for ASR rule disabled events that are generated when an
ASR rule is disabled.
search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$"
search:
'`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$"
| rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" | rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*="
| eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1",
"Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval
@@ -24,52 +26,54 @@ search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Regis
lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value,
ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`'
how_to_implement: The following analytic requires collection of Windows Defender Operational
how_to_implement:
The following analytic requires collection of Windows Defender Operational
logs in either XML or multi-line. To collect, setup a new input for the Windows
Defender Operational logs. In addition, it does require a lookup that maps the ID
to ASR Rule name.
known_false_positives: False positives may occur if applications are typically disabling
known_false_positives:
False positives may occur if applications are typically disabling
ASR rules in the environment. Monitor for changes to ASR rules to determine if this
is a false positive.
references:
- https://asrgen.streamlit.app/
- https://asrgen.streamlit.app/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: ASR rule disabled event, $ASR_Rule$, was triggered on $dest$.
risk_objects:
- field: dest
type: system
score: 100
- field: dest
type: system
score: 100
threat_objects: []
tags:
analytic_story:
- Windows Attack Surface Reduction
- Windows Attack Surface Reduction
asset_type: Endpoint
atomic_guid: []
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/defender/asr_disabled_registry.log
source: WinEventLog:Microsoft-Windows-Windows Defender/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/defender/asr_disabled_registry.log
source: WinEventLog:Microsoft-Windows-Windows Defender/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
+49 -61
View File
@@ -1,11 +1,12 @@
name: Windows Deleted Registry By A Non Critical Process File Path
id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the deletion of registry keys by non-critical
description:
The following analytic detects the deletion of registry keys by non-critical
processes. It leverages Endpoint Detection and Response (EDR) data, focusing on
registry deletion events and correlating them with processes not typically associated
with system or program files. This activity is significant as it may indicate malware,
@@ -14,38 +15,22 @@ description: The following analytic detects the deletion of registry keys by non
system damage, loss of critical configurations, and potential disruption of services.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 12
- Sysmon EventID 1 AND Sysmon EventID 13
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path
IN ("*\\windows\\*", "*\\program files*") by Processes.action Processes.dest Processes.original_file_name
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
WHERE Registry.action=deleted BY _time span=1h Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| join process_guid [| tstats
`security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT
(Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h
Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=deleted
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | table action dest original_file_name parent_process
parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path
process process_exec process_guid process_hash process_id process_integrity_level
process_name process_path user user_id vendor_product registry_hive registry_path
registry_key_name registry_value_data registry_value_name registry_value_type status
| stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(registry_hive) as registry_hive values(registry_path) as
registry_path values(registry_key_name) as registry_key_name values(registry_value_data)
as registry_value_data values(registry_value_name) as registry_value_name values(registry_value_type)
as registry_value_type values(status) as status by process_guid | where isnotnull(process_path)
AND isnotnull(registry_value_name) | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`'
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`]
| fields _time parent_process_name parent_process process_name process_path process
process_guid registry_path registry_value_name registry_value_data registry_key_name
action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -55,47 +40,50 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: This detection can catch for third party application updates
known_false_positives:
This detection can catch for third party application updates
or installation. In this scenario false positive filter is needed.
references:
- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html
- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The registry was deleted by a suspicious process named $process_name$ with
message:
The registry was deleted by a suspicious process named $process_name$ with
the process path $process_path$ on dest $dest$.
risk_objects:
- field: dest
type: system
score: 36
- field: dest
type: system
score: 36
threat_objects: []
tags:
analytic_story:
- Data Destruction
- Double Zero Destructor
- Data Destruction
- Double Zero Destructor
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_disable_change_password_through_registry.yml
+40 -35
View File
@@ -1,11 +1,12 @@
name: Windows Disable Change Password Through Registry
id: 0df33e1a-9ef6-11ec-a1ad-acde48001122
version: 9
date: '2024-12-08'
version: 10
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects a suspicious registry modification that
description:
The following analytic detects a suspicious registry modification that
disables the Change Password feature on a Windows host. It identifies changes to
the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword"
with a value of "0x00000001". This activity is significant as it can prevent users
@@ -14,8 +15,9 @@ description: The following analytic detects a suspicious registry modification t
to an attack, allowing the attacker to persist and potentially escalate their access
within the network.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -23,51 +25,54 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_disable_change_password_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This windows feature may implemented by administrator to prevent
known_false_positives:
This windows feature may implemented by administrator to prevent
normal user to change the password of a critical host or server, In this type of
scenario filter is needed to minimized false positive.
references:
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Registry modification in "DisableChangePassword" on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Ransomware
- Windows Defense Evasion Tactics
- Ransomware
- Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
+40 -36
View File
@@ -1,11 +1,12 @@
name: Windows Disable Lock Workstation Feature Through Registry
id: c82adbc6-9f00-11ec-a81f-acde48001122
version: 9
date: '2024-12-08'
version: 10
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects a suspicious registry modification that
description:
The following analytic detects a suspicious registry modification that
disables the Lock Computer feature in Windows. It leverages data from the Endpoint.Registry
data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
with a value of "0x00000001". This activity is significant because it prevents users
@@ -14,8 +15,9 @@ description: The following analytic detects a suspicious registry modification t
allow attackers to sustain their presence and execute further malicious actions
without user interruption.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -23,51 +25,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_disable_lock_workstation_feature_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Registry modification in "DisableLockWorkstation" on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Ransomware
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- Ransomware
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_disable_logoff_button_through_registry.yml
+42 -37
View File
@@ -1,11 +1,12 @@
name: Windows Disable LogOff Button Through Registry
id: b2fb6830-9ed1-11ec-9fcb-acde48001122
version: 9
date: '2024-12-08'
version: 10
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects a suspicious registry modification that
description:
The following analytic detects a suspicious registry modification that
disables the logoff feature on a Windows host. It leverages data from the Endpoint.Registry
data model to identify changes to specific registry values associated with logoff
functionality. This activity is significant because it can indicate ransomware attempting
@@ -14,8 +15,9 @@ description: The following analytic detects a suspicious registry modification t
response, and allow attackers to maintain persistence and control over the affected
system.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data
= "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id
@@ -23,53 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user
Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This windows feature may implement by administrator in some
known_false_positives:
This windows feature may implement by administrator in some
server where shutdown is critical. In that scenario filter of machine and users
that can modify this registry is needed.
references:
- https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774
- https://malwiki.org/index.php?title=DigiPop.xp
- https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2
- https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774
- https://malwiki.org/index.php?title=DigiPop.xp
- https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Registry modification in "NoLogOff" on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Ransomware
- Windows Registry Abuse
- Ransomware
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_disable_notification_center.yml
+42 -38
View File
@@ -1,11 +1,12 @@
name: Windows Disable Notification Center
id: 1cd983c8-8fd6-11ec-a09d-acde48001122
version: 9
date: '2024-12-08'
version: 10
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects the modification of the Windows registry
description:
The following analytic detects the modification of the Windows registry
to disable the Notification Center on a host machine. It leverages data from the
Endpoint.Registry data model, specifically looking for changes to the "DisableNotificationCenter"
registry value set to "0x00000001." This activity is significant because disabling
@@ -13,8 +14,9 @@ description: The following analytic detects the modification of the Windows regi
and subsequent actions. If confirmed malicious, this could allow an attacker to
operate stealthily, potentially leading to further system compromise and data exfiltration.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name=
"DisableNotificationCenter" Registry.registry_value_data = "0x00000001") by Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -22,53 +24,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_disable_notification_center_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable this windows features.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The Windows notification center was disabled on $dest$ by $user$.
risk_objects:
- field: user
type: user
score: 48
- field: dest
type: system
score: 48
- field: user
type: user
score: 48
- field: dest
type: system
score: 48
threat_objects: []
tags:
analytic_story:
- Windows Defense Evasion Tactics
- CISA AA23-347A
- Windows Registry Abuse
- Windows Defense Evasion Tactics
- CISA AA23-347A
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_disable_shutdown_button_through_registry.yml
+40 -35
View File
@@ -1,11 +1,12 @@
name: Windows Disable Shutdown Button Through Registry
id: 55fb2958-9ecd-11ec-a06a-acde48001122
version: 9
date: '2024-12-08'
version: 10
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects suspicious registry modifications that
description:
The following analytic detects suspicious registry modifications that
disable the shutdown button on a user's logon screen. It leverages data from the
Endpoint.Registry data model, specifically monitoring changes to registry paths
associated with shutdown policies. This activity is significant because it is a
@@ -14,8 +15,9 @@ description: The following analytic detects suspicious registry modifications th
this could impede system recovery efforts, making it difficult to restart the machine
and remove other harmful modifications.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
Registry.registry_value_data = "0x00000001")) by Registry.action Registry.dest Registry.process_guid
@@ -24,51 +26,54 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_disable_shutdown_button_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This windows feature may implement by administrator in some
known_false_positives:
This windows feature may implement by administrator in some
server where shutdown is critical. In that scenario filter of machine and users
that can modify this registry is needed.
references:
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Registry modification in "shutdownwithoutlogon" on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Ransomware
- Windows Registry Abuse
- Ransomware
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml
+44 -39
View File
@@ -1,11 +1,12 @@
name: Windows Disable Windows Group Policy Features Through Registry
id: 63a449ae-9f04-11ec-945e-acde48001122
version: 10
date: '2024-12-16'
version: 11
date: '2025-04-22'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious registry modifications aimed
description:
The following analytic detects suspicious registry modifications aimed
at disabling Windows Group Policy features. It leverages data from the Endpoint.Registry
data model, focusing on specific registry paths and values associated with disabling
key Windows functionalities. This activity is significant because it is commonly
@@ -14,8 +15,9 @@ description: The following analytic detects suspicious registry modifications ai
analyze and respond to the attack, allowing the attacker to maintain control and
persist within the compromised environment.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*"
Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu",
@@ -26,54 +28,57 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_disable_windows_group_policy_features_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Disabling these features for legitimate purposes is not a common
known_false_positives:
Disabling these features for legitimate purposes is not a common
use case but can still be implemented by the administrators. Filter as needed.
references:
- https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis
- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
- https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis
- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Registry modification to disable windows group policy features on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Ransomware
- CISA AA23-347A
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- Ransomware
- CISA AA23-347A
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_dll_side_loading_in_calc.yml
+39 -34
View File
@@ -1,11 +1,12 @@
name: Windows DLL Side-Loading In Calc
id: af01f6db-26ac-440e-8d89-2793e303f137
version: 7
date: '2025-04-16'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious DLL modules loaded by calc.exe
description:
The following analytic detects suspicious DLL modules loaded by calc.exe
that are not located in the %systemroot%\system32 or %systemroot%\sysWoW64 directories.
This detection leverages Sysmon EventCode 7 to identify DLL side-loading, a technique
often used by Qakbot malware to execute malicious DLLs. This activity is significant
@@ -14,8 +15,9 @@ description: The following analytic detects suspicious DLL modules loaded by cal
execute arbitrary code, maintain persistence, and escalate privileges within the
environment.
data_source:
- Sysmon EventID 7
search: '`sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windows\\system32\\*",
- Sysmon EventID 7
search:
'`sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windows\\system32\\*",
"*:\\windows\\sysWow64\\*")) AND NOT(ImageLoaded IN("*:\\windows\\system32\\*",
"*:\\windows\\sysWow64\\*", "*:\\windows\\WinSXS\\*")) | fillnull | stats count
min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file
@@ -23,51 +25,54 @@ search: '`sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windo
process_name process_path service_dll_signature_exists service_dll_signature_verified
signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_dll_side_loading_in_calc_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on processes that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
latest TA for the endpoint product.
known_false_positives: unknown
references:
- https://www.bitdefender.com/blog/hotforsecurity/new-qakbot-malware-strain-replaces-windows-calculator-dll-to-infected-pcs/
- https://www.bitdefender.com/blog/hotforsecurity/new-qakbot-malware-strain-replaces-windows-calculator-dll-to-infected-pcs/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common
message:
a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common
windows OS installation folder on $dest$
risk_objects:
- field: dest
type: system
score: 90
- field: dest
type: system
score: 90
threat_objects: []
tags:
analytic_story:
- Qakbot
- Earth Alux
- Qakbot
- Earth Alux
asset_type: Endpoint
mitre_attack_id:
- T1574.002
- T1574.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml
+39 -35
View File
@@ -1,15 +1,16 @@
name: Windows DLL Side-Loading Process Child Of Calc
id: 295ca9ed-e97b-4520-90f7-dfb6469902e1
version: 7
date: '2025-04-16'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
description: The following analytic identifies suspicious child processes spawned
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
description:
The following analytic identifies suspicious child processes spawned
by calc.exe, indicative of DLL side-loading techniques. This detection leverages
data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs,
names, and parent processes. This activity is significant as it is commonly associated
@@ -17,7 +18,8 @@ description: The following analytic identifies suspicious child processes spawne
If confirmed malicious, this behavior could allow attackers to execute arbitrary
code, maintain persistence, and escalate privileges, posing a severe threat to the
environment.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
= "calc.exe") AND Processes.process_name != "win32calc.exe" by Processes.action
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
@@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_dll_side_loading_process_child_of_calc_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -38,43 +41,44 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: calc.exe has a child process $process_name$ on $dest$
risk_objects:
- field: dest
type: system
score: 81
- field: dest
type: system
score: 81
threat_objects: []
tags:
analytic_story:
- Qakbot
- Earth Alux
- Qakbot
- Earth Alux
asset_type: Endpoint
mitre_attack_id:
- T1574.002
- T1574.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml
+40 -34
View File
@@ -1,13 +1,14 @@
name: Windows Exfiltration Over C2 Via Invoke RestMethod
id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba
version: 6
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Powershell Script Block Logging 4104
description: The following analytic detects potential data exfiltration using PowerShell's
- Powershell Script Block Logging 4104
description:
The following analytic detects potential data exfiltration using PowerShell's
Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts
that attempt to upload files via HTTP POST requests. This activity is significant
as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots
@@ -15,55 +16,60 @@ description: The following analytic detects potential data exfiltration using Po
this could lead to data breaches, loss of sensitive information, and further compromise
of the affected systems. Immediate investigation is recommended to determine the
intent and scope of the activity.
search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND
search:
'`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND
ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText
= "* Post *" AND ScriptBlockText = "* -InFile *" | fillnull | stats count min(_time)
as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product
EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
how_to_implement:
To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives should be limited. Filter as needed.
references:
- https://twitter.com/_CERT_UA/status/1620781684257091584
- https://cert.gov.ua/article/3761104
- https://twitter.com/_CERT_UA/status/1620781684257091584
- https://cert.gov.ua/article/3761104
drilldown_searches:
- name: View the detection results for - "$Computer$"
search: '%original_detection_search% | search Computer = "$Computer$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$Computer$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$Computer$"
search: '%original_detection_search% | search Computer = "$Computer$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$Computer$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A PowerShell script on $dest$ is attempting to transfer files to a remote
message:
A PowerShell script on $dest$ is attempting to transfer files to a remote
URL.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Winter Vivern
- Winter Vivern
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1041
- T1041
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_hide_notification_features_through_registry.yml
+39 -35
View File
@@ -1,11 +1,12 @@
name: Windows Hide Notification Features Through Registry
id: cafa4bce-9f06-11ec-a7b2-acde48001122
version: 9
date: '2024-12-08'
version: 10
date: '2025-04-22'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects suspicious registry modifications aimed
description:
The following analytic detects suspicious registry modifications aimed
at hiding common Windows notification features on a compromised host. It leverages
data from the Endpoint.Registry data model, focusing on specific registry paths
and values. This activity is significant as it is often used by ransomware to obscure
@@ -13,8 +14,9 @@ description: The following analytic detects suspicious registry modifications ai
this could prevent users from noticing critical system alerts, thereby aiding the
attacker in maintaining persistence and furthering their malicious activities undetected.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork",
"HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") by
@@ -23,50 +25,52 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_hide_notification_features_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Registry modification to hide windows notification on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Ransomware
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- Ransomware
- Windows Defense Evasion Tactics
- Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_http_network_communication_from_msiexec.yml
+54 -65
View File
@@ -1,11 +1,12 @@
name: Windows HTTP Network Communication From MSIExec
id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99
version: 4
date: '2025-04-17'
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects MSIExec making network connections over
description:
The following analytic detects MSIExec making network connections over
ports 443 or 80. This behavior is identified by correlating process creation events
from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically,
MSIExec does not perform network communication to the internet, making this activity
@@ -15,37 +16,22 @@ description: The following analytic detects MSIExec making network connections o
or further malware deployment.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_msiexec` by Processes.action Processes.dest Processes.original_file_name
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec`
by _time Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| tstats prestats=t append=t `security_content_summariesonly` count min(_time) as
firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where
All_Traffic.dest_port IN ("80","443") by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `windows_http_network_communication_from_msiexec_filter`'
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where
All_Traffic.dest_port IN ("80","443") by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)` ]
| table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip
| `windows_http_network_communication_from_msiexec_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -57,51 +43,54 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: False positives will be present and filtering is required.
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: An instance of $process_name$ was identified on endpoint $dest$ contacting
message:
An instance of $process_name$ was identified on endpoint $dest$ contacting
a remote destination $dest_ip$
risk_objects:
- field: user
type: user
score: 35
- field: dest
type: system
score: 35
- field: user
type: user
score: 35
- field: dest
type: system
score: 35
threat_objects:
- field: parent_process_name
type: parent_process_name
- field: process_name
type: process_name
- field: parent_process_name
type: parent_process_name
- field: process_name
type: process_name
tags:
analytic_story:
- Windows System Binary Proxy Execution MSIExec
- Windows System Binary Proxy Execution MSIExec
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1218.007
- T1218.007
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml
+41 -37
View File
@@ -1,13 +1,14 @@
name: Windows Impair Defenses Disable AV AutoStart via Registry
id: 31a13f43-812e-4752-a6ca-c6c87bf03e83
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 13
- Sysmon EventID 13
type: TTP
status: production
description: The following analytic detects modifications to the registry related
description:
The following analytic detects modifications to the registry related
to the disabling of autostart functionality for certain antivirus products, such
as Kingsoft and Tencent. Malware like ValleyRAT may alter specific registry keys
to prevent these security tools from launching automatically at startup, thereby
@@ -16,7 +17,8 @@ description: The following analytic detects modifications to the registry relate
attempts to disable protective software. Detecting these modifications early is
critical for maintaining system integrity and preventing further compromise by malicious
actors.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search:
'| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE Registry.registry_path IN("*\\kingsoft\\antivirus\\KAVReport\\*" , "*\\kingsoft\\antivirus\\KSetting\\*",
"*\\kingsoft\\antivirus\\Windhunter\\*" ,"*\\Tencent\\QQPCMgr\\*") AND ((Registry.registry_value_name
IN("autostart","kxesc", "WindhunterSwitch") AND Registry.registry_value_data = "0x00000000")
@@ -26,52 +28,54 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user
Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_av_autostart_via_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape
- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers
- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape
- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: disable anti-virus autostart via registry on [$dest$].
risk_objects:
- field: user
type: user
score: 90
- field: dest
type: system
score: 90
- field: user
type: user
score: 90
- field: dest
type: system
score: 90
threat_objects: []
tags:
analytic_story:
- ValleyRAT
- ValleyRAT
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+2 -2
View File
@@ -18,8 +18,8 @@ data_source:
- Sysmon EventID 1
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles*
/c *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *"
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
detections/endpoint/windows_inprocserver32_new_outlook_form.yml
+43 -37
View File
@@ -1,13 +1,14 @@
name: Windows InProcServer32 New Outlook Form
id: fedb49c4-4bd7-4d42-8fd9-f8c8538c73c4
version: 5
date: '2024-11-13'
version: 6
date: '2025-04-22'
author: Michael Haag, Splunk
data_source:
- Sysmon EventID 13
- Sysmon EventID 13
type: Anomaly
status: production
description: The following analytic detects the creation or modification of registry
description:
The following analytic detects the creation or modification of registry
keys associated with new Outlook form installations, potentially indicating exploitation
of CVE-2024-21378. It leverages data from the Endpoint.Registry datamodel, focusing
on registry paths involving InProcServer32 keys linked to Outlook forms. This activity
@@ -15,59 +16,64 @@ description: The following analytic detects the creation or modification of regi
execution via malicious form objects. If confirmed malicious, this could allow an
attacker to create arbitrary files and registry keys, leading to remote code execution
and potential full system compromise.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search:
'| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path="*\\InProcServer32\\*" Registry.registry_value_data=*\\FORMS\\*
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_inprocserver32_new_outlook_form_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: False positives are possible if the organization adds new forms
known_false_positives:
False positives are possible if the organization adds new forms
to Outlook via an automated method. Filter by name or path to reduce false positives.
references:
- https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/
- https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry key associated with a new Outlook form installation was created
message:
A registry key associated with a new Outlook form installation was created
or modified. This could indicate exploitation of CVE-2024-21378 on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Outlook RCE CVE-2024-21378
- Outlook RCE CVE-2024-21378
cve:
- CVE-2024-21378
- CVE-2024-21378
asset_type: Endpoint
mitre_attack_id:
- T1566
- T1112
- T1566
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_installutil_remote_network_connection.yml
+27 -35
View File
@@ -1,7 +1,7 @@
name: Windows InstallUtil Remote Network Connection
id: 4fbf9270-43da-11ec-9486-acde48001122
version: 12
date: '2025-03-27'
version: 13
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -16,39 +16,31 @@ description: The following analytic detects the Windows InstallUtil.exe binary m
of this activity.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: "| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes\n\
\ where `process_installutil`\n by Processes.action Processes.dest Processes.original_file_name\
\ Processes.parent_process Processes.parent_process_exec \n Processes.parent_process_guid\
\ Processes.parent_process_id Processes.parent_process_name \n Processes.parent_process_path\
\ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash\
\ \n Processes.process_id Processes.process_integrity_level Processes.process_name\
\ Processes.process_path \n Processes.user Processes.user_id Processes.vendor_product\
\ \n| `drop_dm_object_name(Processes)` \n| tstats prestats=t append=t `security_content_summariesonly`\
\ count min(_time) as firstTime max(_time)\n as lastTime from datamodel=Network_Traffic.All_Traffic\
\ where All_Traffic.dest_port!=0\n by All_Traffic.action All_Traffic.app All_Traffic.dest\
\ All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction \n All_Traffic.dvc\
\ All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip\
\ All_Traffic.src_port \n All_Traffic.transport All_Traffic.user All_Traffic.vendor_product\
\ All_Traffic.process_id\n| `drop_dm_object_name(All_Traffic)` \n| table action\
\ dest original_file_name parent_process parent_process_exec \n parent_process_guid\
\ parent_process_id parent_process_name \n parent_process_path process process_exec\
\ process_guid process_hash \n process_id process_integrity_level process_name\
\ process_path \n user user_id vendor_product app dest_ip dest_port direction dvc\
\ protocol \n protocol_version src src_ip src_port transport \n| stats values(action)\
\ as action values(dest) as dest values(original_file_name) as original_file_name\
\ values(parent_process) as parent_process \n values(parent_process_exec) as parent_process_exec\
\ values(parent_process_guid) as parent_process_guid \n values(parent_process_id)\
\ as parent_process_id values(parent_process_name) as parent_process_name \n values(parent_process_path)\
\ as parent_process_path values(process) as process \n values(process_exec) as\
\ process_exec values(process_hash) as process_hash \n values(process_guid) as\
\ process_guid values(process_integrity_level) as process_integrity_level values(process_name)\
\ as process_name\n values(process_path) as process_path values(user) as user values(user_id)\
\ as user_id \n values(vendor_product) as vendor_product values(app) as app values(dest_ip)\
\ as dest_ip values(dest_port) as dest_port values(direction) as direction\n values(dvc)\
\ as dvc values(protocol) as protocol values(protocol_version) as protocol_version\
\ values(src) as src values(src_ip) as src_ip values(src_port) as src_port values(transport)\
\ as transport by process_id \n| where isnotnull(process_name) AND isnotnull(dest_port)\
\ \n| `windows_installutil_remote_network_connection_filter`"
search: |-
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_installutil` by _time span=1h Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| join process_id dest
[| tstats `security_content_summariesonly`
count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port !=
0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)`
| rename dest as command_and_control
| rename src as dest]
| table _time user src dest parent_process_name process_name process_path process process_id dest_port command_and_control
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as process values(command_and_control) as command_and_control by user dest process_name process_id dest_port parent_process_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `windows_installutil_remote_network_connection_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/windows_installutil_uninstall_option_with_network.yml
+19 -33
View File
@@ -1,7 +1,7 @@
name: Windows InstallUtil Uninstall Option with Network
id: 1a52c836-43ef-11ec-a36c-acde48001122
version: 10
date: '2025-02-10'
version: 11
date: '2025-04-22'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -15,37 +15,23 @@ description: The following analytic identifies the use of Windows InstallUtil.ex
movement within the network.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 3
search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by Processes.action
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port!=0 by All_Traffic.action All_Traffic.app All_Traffic.dest
All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc
All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest
original_file_name parent_process parent_process_exec parent_process_guid parent_process_id
parent_process_name parent_process_path process process_exec process_guid process_hash
process_id process_integrity_level process_name process_path user user_id vendor_product
app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port
transport | stats values(action) as action values(dest) as dest values(original_file_name)
as original_file_name values(parent_process) as parent_process values(parent_process_exec)
as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id)
as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
as parent_process_path values(process) as process values(process_exec) as process_exec
values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level)
as process_integrity_level values(process_name) as process_name values(process_path)
as process_path values(user) as user values(user_id) as user_id values(vendor_product)
as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port)
as dest_port values(direction) as direction values(dvc) as dvc values(protocol)
as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip)
as src_ip values(src_port) as src_port values(transport) as transport by process_id
| where isnotnull(process_name) AND isnotnull(dest_port) | `windows_installutil_uninstall_option_with_network_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
span=1h Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id
[| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest
parent_process_name process_name process_path process process_id dest_port C2 |
`windows_installutil_uninstall_option_with_network_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/windows_known_abused_dll_created.yml
+2 -3
View File
@@ -1,7 +1,7 @@
name: Windows Known Abused DLL Created
id: ea91651a-772a-4b02-ac3d-985b364a5f07
version: 6
date: '2025-02-10'
version: 7
date: '2025-04-22'
author: Steven Dick
status: production
type: Anomaly
@@ -79,7 +79,6 @@ tags:
asset_type: Endpoint
mitre_attack_id:
- T1574.001
- T1574.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml
+2 -3
View File
@@ -1,7 +1,7 @@
name: Windows Known Abused DLL Loaded Suspiciously
id: dd6d1f16-adc0-4e87-9c34-06189516b803
version: 6
date: '2025-02-10'
version: 7
date: '2025-04-22'
author: Steven Dick
status: production
type: TTP
@@ -65,7 +65,6 @@ tags:
asset_type: Endpoint
mitre_attack_id:
- T1574.001
- T1574.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/windows_known_graphicalproton_loaded_modules.yml
+37 -32
View File
@@ -1,20 +1,22 @@
name: Windows Known GraphicalProton Loaded Modules
id: bf471c94-0324-4b19-a113-d02749b969bc
version: 7
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 7
description: The following analytic detects the loading of DLL modules associated
- Sysmon EventID 7
description:
The following analytic detects the loading of DLL modules associated
with the GraphicalProton backdoor implant, commonly used by SVR in targeted attacks.
It leverages Sysmon EventCode 7 to identify specific DLLs loaded by processes. This
activity is significant as it may indicate the presence of a sophisticated backdoor,
warranting immediate investigation. If confirmed malicious, the attacker could gain
persistent access to the compromised host, potentially leading to further exploitation
and data exfiltration.
search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\AclNumsInvertHost.dll", "*\\ModeBitmapNumericAnimate.dll",
search:
'`sysmon` EventCode=7 ImageLoaded IN ("*\\AclNumsInvertHost.dll", "*\\ModeBitmapNumericAnimate.dll",
"*\\UnregisterAncestorAppendAuto.dll", "*\\DeregisterSeekUsers.dll", "*\\ScrollbarHandleGet.dll",
"*\\PerformanceCaptionApi.dll", "*\\WowIcmpRemoveReg.dll", "*\\BlendMonitorStringBuild.dll",
"*\\HandleFrequencyAll.dll", "*\\HardSwapColor.dll", "*\\LengthInMemoryActivate.dll",
@@ -24,47 +26,50 @@ search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\AclNumsInvertHost.dll", "*\\Mo
process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists
service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_known_graphicalproton_loaded_modules_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the process name and imageloaded executions from your endpoints. If you
are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: unknown
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Windows Known GraphicalProton backdoor Loaded Modules on $dest$.
risk_objects:
- field: dest
type: system
score: 36
- field: dest
type: system
score: 36
threat_objects: []
tags:
analytic_story:
- CISA AA23-347A
- CISA AA23-347A
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1574.002
- T1574.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_lolbas_executed_as_renamed_file.yml
+52 -45
View File
@@ -1,21 +1,23 @@
name: Windows LOLBAS Executed As Renamed File
id: fd496996-7d9e-4894-8d40-bb85b6192dc6
version: 6
date: '2025-04-17'
date: '2025-04-22'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies a LOLBAS process being executed where
description:
The following analytic identifies a LOLBAS process being executed where
it's process name does not match it's original file name attribute. Processes that
have been renamed and executed may be an indicator that an adversary is attempting
to evade defenses or execute malicious code. The LOLBAS project documents Windows
native binaries that can be abused by threat actors to perform tasks like executing
malicious code.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` latest(Processes.parent_process)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` latest(Processes.parent_process)
as parent_process, latest(Processes.process) as process, latest(Processes.process_guid)
as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes
where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path
@@ -29,7 +31,8 @@ search: '| tstats `security_content_summariesonly` latest(Processes.parent_proc
| lookup lolbas_file_path lolbas_file_name as original_file_name OUTPUT description
as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_lolbas_executed_as_renamed_file_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -38,56 +41,60 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: A certain amount of false positives are likely with this detection.
known_false_positives:
A certain amount of false positives are likely with this detection.
MSI based installers often trigger for SETUPAPL.dll and vendors will often copy
system exectables to a different path for application usage.
references:
- https://attack.mitre.org/techniques/T1036/
- https://attack.mitre.org/techniques/T1036/003/
- https://attack.mitre.org/techniques/T1036/
- https://attack.mitre.org/techniques/T1036/003/
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The file originally named $original_file_name$ was executed as $process_name$
message:
The file originally named $original_file_name$ was executed as $process_name$
on $dest$
risk_objects:
- field: dest
type: system
score: 40
- field: user
type: user
score: 40
- field: dest
type: system
score: 40
- field: user
type: user
score: 40
threat_objects:
- field: process_name
type: process_name
- field: process_name
type: process_name
tags:
analytic_story:
- Living Off The Land
- Masquerading - Rename System Utilities
- Windows Defense Evasion Tactics
- Living Off The Land
- Masquerading - Rename System Utilities
- Windows Defense Evasion Tactics
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1036.003
- T1218.011
- T1036.003
- T1218.011
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_masquerading_explorer_as_child_process.yml
+40 -35
View File
@@ -1,11 +1,12 @@
name: Windows Masquerading Explorer As Child Process
id: 61490da9-52a1-4855-a0c5-28233c88c481
version: 8
date: '2025-04-17'
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies instances where explorer.exe is spawned
description:
The following analytic identifies instances where explorer.exe is spawned
by unusual parent processes such as cmd.exe, powershell.exe, or regsvr32.exe. This
detection leverages data from Endpoint Detection and Response (EDR) agents, focusing
on process and parent process relationships. This activity is significant because
@@ -14,10 +15,11 @@ description: The following analytic identifies instances where explorer.exe is s
If confirmed malicious, this behavior could allow attackers to execute arbitrary
code, evade detection, and maintain persistence within the environment.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN("cmd.exe", "powershell.exe", "regsvr32.exe") AND Processes.process_name = "explorer.exe"
AND Processes.process IN ("*\\explorer.exe") by Processes.action Processes.dest
@@ -28,7 +30,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `windows_masquerading_explorer_as_child_process_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -39,43 +42,45 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: explorer.exe has a suspicious parent process $parent_process_name$ on $dest$
risk_objects:
- field: dest
type: system
score: 81
- field: dest
type: system
score: 81
threat_objects: []
tags:
analytic_story:
- Qakbot
- Compromised Windows Host
- Qakbot
- Compromised Windows Host
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1574.002
- T1574.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_authenticationleveloverride.yml
+39 -34
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry AuthenticationLevelOverride
id: 6410a403-36bb-490f-a06a-11c3be7d2a41
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows registry
key "AuthenticationLevelOverride" within the Terminal Server Client settings. It
leverages data from the Endpoint.Registry datamodel to identify changes where the
registry value is set to 0x00000000. This activity is significant as it may indicate
@@ -15,7 +16,8 @@ description: The following analytic detects modifications to the Windows registr
by DarkGate malware for malicious installations. If confirmed malicious, this could
allow attackers to gain unauthorized remote access, potentially leading to data
exfiltration or further system compromise.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal
Server Client\\AuthenticationLevelOverride" Registry.registry_value_data = 0x00000000
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -23,49 +25,52 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_authenticationleveloverride_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for authentication level settings was modified on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- DarkGate Malware
- DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_auto_minor_updates.yml
+22 -18
View File
@@ -1,49 +1,53 @@
name: Windows Modify Registry Auto Minor Updates
id: be498b9f-d804-4bbf-9fc0-d5448466b313
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
data_source:
- Sysmon EventID 13
description: The following analytic identifies a suspicious modification to the Windows
- Sysmon EventID 13
description:
The following analytic identifies a suspicious modification to the Windows
auto update configuration registry. It detects changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates"
with a value of "0x00000000". This activity is significant as it is commonly used
by adversaries, including malware like RedLine Stealer, to bypass detection and
deploy additional payloads. If confirmed malicious, this modification could allow
attackers to evade defenses, potentially leading to further system compromise and
exploitation of zero-day vulnerabilities.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates"
AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_auto_minor_updates_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
tags:
analytic_story:
- RedLine Stealer
- RedLine Stealer
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_auto_update_notif.yml
+40 -35
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry Auto Update Notif
id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic detects a suspicious modification to the Windows
- Sysmon EventID 13
description:
The following analytic detects a suspicious modification to the Windows
registry that changes the auto-update notification setting to "Notify before download."
This detection leverages data from the Endpoint.Registry data model, focusing on
specific registry paths and values. This activity is significant because it is a
@@ -15,59 +16,63 @@ description: The following analytic detects a suspicious modification to the Win
evade detection and potentially deploy additional payloads. If confirmed malicious,
this modification could allow attackers to bypass security measures, maintain persistence,
and exploit vulnerabilities on the target host.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions"
AND Registry.registry_value_data="0x00000002" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_auto_update_notif_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows auto update notification on $dest$
risk_objects:
- field: dest
type: system
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- RedLine Stealer
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
- 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_configure_bitlocker.yml
+39 -34
View File
@@ -1,20 +1,22 @@
name: Windows Modify Registry Configure BitLocker
id: bd1c770f-1b55-411e-b49e-20d07bcac5f8
version: 4
date: '2024-11-13'
version: 5
date: '2025-04-22'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 13
- Sysmon EventID 13
type: TTP
status: production
description: This analytic is developed to detect suspicious registry modifications
description:
This analytic is developed to detect suspicious registry modifications
targeting BitLocker settings. The malware ShrinkLocker alters various registry keys
to change how BitLocker handles encryption, potentially bypassing TPM requirements,
enabling BitLocker without TPM, and enforcing specific startup key and PIN configurations.
Such modifications can weaken system security, making it easier for unauthorized
access and data breaches. Detecting these changes is crucial for maintaining robust
encryption and data protection.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Policies\\Microsoft\\FVE\\*"
Registry.registry_value_name IN("EnableBDEWithNoTPM", "EnableNonTPM", "UseAdvancedStartup")
Registry.registry_value_data = 0x00000001) OR (Registry.registry_path= "*\\Policies\\Microsoft\\FVE\\*"
@@ -25,50 +27,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_configure_bitlocker_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows bitlocker registry settings on $dest$
risk_objects:
- field: dest
type: system
score: 64
- field: dest
type: system
score: 64
threat_objects: []
tags:
analytic_story:
- ShrinkLocker
- ShrinkLocker
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting//fve-reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting//fve-reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_default_icon_setting.yml
+43 -38
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Default Icon Setting
id: a7a7afdb-3c58-45b6-9bff-63e5acfd9d40
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious modifications to the Windows
description:
The following analytic detects suspicious modifications to the Windows
registry's default icon settings, a technique associated with Lockbit ransomware.
It leverages data from the Endpoint Registry data model, focusing on changes to
registry paths under "*HKCR\\*\\defaultIcon\\(Default)*". This activity is significant
@@ -14,8 +15,9 @@ description: The following analytic detects suspicious modifications to the Wind
lead to system defacement and signal a broader ransomware attack, potentially compromising
sensitive data and system integrity.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
="*\\defaultIcon\\(Default)*" Registry.registry_path = "*HKCR\\*" by Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -23,7 +25,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
| `windows_modify_registry_default_icon_setting_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
how_to_implement:
To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
@@ -31,47 +34,49 @@ how_to_implement: To successfully implement this search, you must be ingesting d
to the registry.
known_false_positives: unknown
references:
- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A suspicious registry modification to change the default icon association
message:
A suspicious registry modification to change the default icon association
of windows to ransomware was detected on endpoint $dest$ by user $user$.
risk_objects:
- field: dest
type: system
score: 64
- field: user
type: user
score: 64
- field: dest
type: system
score: 64
- field: user
type: user
score: 64
threat_objects: []
tags:
analytic_story:
- LockBit Ransomware
- LockBit Ransomware
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_delete_firewall_rules.yml
+43 -38
View File
@@ -1,70 +1,75 @@
name: Windows Modify Registry Delete Firewall Rules
id: 41c61539-98ca-4750-b3ec-7c29a2f06343
version: 5
date: '2024-12-16'
version: 6
date: '2025-04-22'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 12
- Sysmon EventID 12
type: TTP
status: production
description: The following analytic detects a potential deletion of firewall rules,
description:
The following analytic detects a potential deletion of firewall rules,
indicating a possible security breach or unauthorized access attempt. It identifies
actions where firewall rules are removed using commands like netsh advfirewall firewall
delete rule, which can expose the network to external threats by disabling critical
security measures. Monitoring these activities helps maintain network integrity
and prevent malicious attacks.
search: '`sysmon` EventCode=12 TargetObject = "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
search:
'`sysmon` EventCode=12 TargetObject = "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
EventType=DeleteValue | stats count min(_time) as firstTime max(_time) as lastTime
by action dest process_guid process_id registry_hive registry_path registry_key_name
status user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_delete_firewall_rules_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
how_to_implement:
To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network admin may add/remove/modify public inbound firewall
known_false_positives:
network admin may add/remove/modify public inbound firewall
rule that may cause this rule to be triggered.
references:
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: firewall deletion found in registry on $dest$
risk_objects:
- field: user
type: user
score: 64
- field: dest
type: system
score: 64
- field: user
type: user
score: 64
- field: dest
type: system
score: 64
threat_objects: []
tags:
analytic_story:
- ShrinkLocker
- CISA AA24-241A
- ShrinkLocker
- CISA AA24-241A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disable_rdp.yml
+39 -34
View File
@@ -1,19 +1,21 @@
name: Windows Modify Registry Disable RDP
id: 11ed764f-eb9c-4be7-bdad-2209b9d33ee1
version: 4
date: '2024-11-13'
version: 5
date: '2025-04-22'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 13
- Sysmon EventID 13
type: Anomaly
status: production
description: This analytic is developed to detect suspicious registry modifications
description:
This analytic is developed to detect suspicious registry modifications
that disable Remote Desktop Protocol (RDP) by altering the "fDenyTSConnections"
key. Changing this key's value to 1 prevents remote connections, which can disrupt
remote management and access. Such modifications could indicate an attempt to hinder
remote administration or isolate the system from remote intervention, potentially
signifying malicious activity.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal
Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000001" by Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -21,50 +23,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_disable_rdp_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows RDP registry settings on $dest$
risk_objects:
- field: dest
type: system
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- ShrinkLocker
- ShrinkLocker
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp//fdenytsconnection-reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp//fdenytsconnection-reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disable_restricted_admin.yml
+41 -37
View File
@@ -1,20 +1,22 @@
name: Windows Modify Registry Disable Restricted Admin
id: cee573a0-7587-48e6-ae99-10e8c657e89a
version: '7'
date: '2025-03-14'
version: 8
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows registry
entry "DisableRestrictedAdmin," which controls the Restricted Admin mode behavior.
This detection leverages registry activity logs from endpoint data sources like
Sysmon or Carbon Black. Monitoring this activity is crucial as changes to this setting
can disable a security feature that limits credential exposure during remote connections.
If confirmed malicious, an attacker could weaken security controls, increasing the
risk of credential theft and unauthorized access to sensitive systems.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin"
Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -22,7 +24,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_disable_restricted_admin_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
how_to_implement:
To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
@@ -30,46 +33,47 @@ how_to_implement: To successfully implement this search, you must be ingesting d
to the registry.
known_false_positives: Administrator may change this registry setting. Filter as needed.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$" and "$user$"
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Windows Modify Registry Disable Restricted Admin on $dest$ by $user$.
risk_objects:
- field: dest
type: system
score: 64
- field: user
type: user
score: 64
- field: dest
type: system
score: 64
- field: user
type: user
score: 64
threat_objects: []
tags:
analytic_story:
- Medusa Ransomware
- CISA AA23-347A
- Medusa Ransomware
- CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disable_toast_notifications.yml
+40 -35
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Disable Toast Notifications
id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry
description:
The following analytic detects modifications to the Windows registry
that disable toast notifications. It leverages data from the Endpoint.Registry datamodel,
specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*"
with a value set to "0x00000000". This activity is significant because disabling
@@ -14,58 +15,62 @@ description: The following analytic detects modifications to the Windows registr
malicious, this action could allow attackers to operate undetected, leading to prolonged
persistence and potential further compromise of the system.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*"
Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for DisallowRun settings was modified to enable on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Azorult
- Azorult
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml
+43 -37
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Disable Win Defender Raw Write Notif
id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry
description:
The following analytic detects modifications to the Windows registry
that disable the Windows Defender raw write notification feature. It leverages data
from the Endpoint.Registry datamodel, specifically monitoring changes to the registry
path associated with Windows Defender's real-time protection settings. This activity
@@ -15,8 +16,9 @@ description: The following analytic detects modifications to the Windows registr
to execute code, persist in the environment, and access sensitive information without
detection.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows
Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001"
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -24,52 +26,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_disable_win_defender_raw_write_notif_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive. Filter as needed.
references:
- https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The registry for raw write notification settings was modified to disable
message:
The registry for raw write notification settings was modified to disable
on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Azorult
- CISA AA23-347A
- Azorult
- CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
+41 -36
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry Disable WinDefender Notifications
id: 8e207707-ad40-4eb3-b865-3a52aec91f26
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects a suspicious registry modification aimed
- Sysmon EventID 13
description:
The following analytic detects a suspicious registry modification aimed
at disabling Windows Defender notifications. It leverages data from the Endpoint.Registry
data model, specifically looking for changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender Security Center\\Notifications\\DisableNotifications" with a value of "0x00000001".
@@ -15,7 +16,8 @@ description: The following analytic detects a suspicious registry modification a
security alerts, a technique used by adversaries and malware like RedLine Stealer.
If confirmed malicious, this could allow attackers to operate undetected, increasing
the risk of further compromise and data exfiltration.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender Security Center\\Notifications\\DisableNotifications" AND Registry.registry_value_data="0x00000001"
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -23,53 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `windows_modify_registry_disable_windefender_notifications_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification to disable Windows Defender notification on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- CISA AA23-347A
- RedLine Stealer
- CISA AA23-347A
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
- 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml
+43 -37
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Disable Windows Security Center Notif
id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry
description:
The following analytic detects modifications to the Windows registry
aimed at disabling Windows Security Center notifications. It leverages data from
the Endpoint.Registry datamodel, specifically monitoring changes to the registry
path "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" with
@@ -15,60 +16,65 @@ description: The following analytic detects modifications to the Windows registr
undetected, potentially leading to further exploitation and compromise of the host
system.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*"
Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for security center notification settings was modified to
message:
the registry for security center notification settings was modified to
disable mode on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Azorult
- CISA AA23-347A
- Azorult
- CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml
+41 -35
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry DisableRemoteDesktopAntiAlias
id: 4927c6f1-4667-42e6-bd7a-f5222116386b
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows registry
key "DisableRemoteDesktopAntiAlias" with a value set to 0x00000001. This detection
leverages data from the Endpoint datamodel, specifically monitoring changes in the
Registry node. This activity is significant as it may indicate the presence of DarkGate
@@ -15,7 +16,8 @@ description: The following analytic detects modifications to the Windows registr
If confirmed malicious, this modification could allow an attacker to maintain persistence
and control over the compromised host, potentially leading to further exploitation
and data exfiltration.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal
Services\\DisableRemoteDesktopAntiAlias" Registry.registry_value_data = 0x00000001
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -23,50 +25,54 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_disableremotedesktopantialias_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for remote desktop settings was modified to be DisableRemoteDesktopAntiAlias
message:
the registry for remote desktop settings was modified to be DisableRemoteDesktopAntiAlias
on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- DarkGate Malware
- DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disablesecuritysettings.yml
+42 -36
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry DisableSecuritySettings
id: 989019b4-b7aa-418a-9a17-2293e91288b6
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows registry
that disable security settings for Terminal Services. It leverages the Endpoint
data model, specifically monitoring changes to the registry path associated with
Terminal Services security settings. This activity is significant because altering
@@ -15,7 +16,8 @@ description: The following analytic detects modifications to the Windows registr
allowing unauthorized remote access. If confirmed malicious, such modifications
could enable attackers to gain persistent remote access to the system, facilitating
further exploitation and data exfiltration.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal
Services\\DisableSecuritySettings" Registry.registry_value_data = 0x00000001 by
Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -23,51 +25,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_disablesecuritysettings_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for terminal services settings was modified to disable security
message:
the registry for terminal services settings was modified to disable security
settings on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- DarkGate Malware
- CISA AA23-347A
- DarkGate Malware
- CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disablesecuritysetting.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disablesecuritysetting.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disabling_wer_settings.yml
+41 -36
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Disabling WER Settings
id: 21cbcaf1-b51f-496d-a0c1-858ff3070452
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications in the Windows registry
description:
The following analytic detects modifications in the Windows registry
to disable Windows Error Reporting (WER) settings. It leverages data from the Endpoint.Registry
datamodel, specifically monitoring changes to registry paths related to WER with
a value set to "0x00000001". This activity is significant as adversaries may disable
@@ -13,8 +14,9 @@ description: The following analytic detects modifications in the Windows registr
If confirmed malicious, this could allow attackers to operate undetected, potentially
leading to prolonged persistence and further exploitation within the environment.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows
Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -22,51 +24,54 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_disabling_wer_settings_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for WER settings was modified to be disabled on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Azorult
- CISA AA23-347A
- Azorult
- CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_disallow_windows_app.yml
+39 -34
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry DisAllow Windows App
id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry
description:
The following analytic detects modifications to the Windows registry
aimed at preventing the execution of specific computer programs. It leverages data
from the Endpoint.Registry datamodel, focusing on changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*"
with a value of "0x00000001". This activity is significant as it can indicate an
@@ -13,57 +14,61 @@ description: The following analytic detects modifications to the Windows registr
malicious, this could allow an attacker to evade detection and maintain persistence
on the compromised host.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*"
Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disallow_windows_app_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive. Filter as needed.
references:
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The registry for DisallowRun settings was modified to enable on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Azorult
- Azorult
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
+41 -36
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry Do Not Connect To Win Update
id: e09c598e-8dd0-4e73-b740-4b96b689199e
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic detects a suspicious modification to the Windows
- Sysmon EventID 13
description:
The following analytic detects a suspicious modification to the Windows
registry that disables automatic updates. It leverages data from the Endpoint datamodel,
specifically monitoring changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations"
with a value of "0x00000001". This activity is significant as it can be used by
@@ -15,60 +16,64 @@ description: The following analytic detects a suspicious modification to the Win
the system from receiving critical updates. If confirmed malicious, this could allow
attackers to exploit vulnerabilities, persist in the environment, and potentially
deploy additional payloads.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations"
AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_do_not_connect_to_win_update_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: a registry modification in Windows auto update configuration on $dest$
risk_objects:
- field: dest
type: system
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- RedLine Stealer
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
- 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_dontshowui.yml
+39 -34
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry DontShowUI
id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows Error Reporting
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows Error Reporting
registry key "DontShowUI" to suppress error reporting dialogs. It leverages data
from the Endpoint datamodel's Registry node to identify changes where the registry
value is set to 0x00000001. This activity is significant as it is commonly associated
@@ -15,7 +16,8 @@ description: The following analytic detects modifications to the Windows Error R
installation. If confirmed malicious, this behavior could allow attackers to maintain
a low profile, avoiding user alerts and potentially enabling further malicious activities
without user intervention.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows\\Windows
Error Reporting\\DontShowUI" Registry.registry_value_data = 0x00000001 by Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -23,49 +25,52 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_dontshowui_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for WER settings was modified to be disable show UI on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- DarkGate Malware
- DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_enablelinkedconnections.yml
+42 -36
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry EnableLinkedConnections
id: 93048164-3358-4af0-8680-aa5f38440516
version: 7
date: '2025-01-21'
version: 8
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects a suspicious modification to the Windows
- Sysmon EventID 13
description:
The following analytic detects a suspicious modification to the Windows
registry setting for EnableLinkedConnections. It leverages data from the Endpoint.Registry
datamodel to identify changes where the registry path is "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections"
and the value is set to "0x00000001". This activity is significant because enabling
@@ -15,59 +16,64 @@ description: The following analytic detects a suspicious modification to the Win
administrator-level privileges, a technique often abused by malware like BlackByte
ransomware. If confirmed malicious, this could lead to unauthorized access to sensitive
network resources, escalating the attacker's privileges.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_enablelinkedconnections_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/
- https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows EnableLinkedConnections configuration
message:
A registry modification in Windows EnableLinkedConnections configuration
on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- BlackByte Ransomware
- BlackByte Ransomware
asset_type: Endpoint
atomic_guid:
- 4f4e2f9f-6209-4fcf-9b15-3b7455706f5b
- 4f4e2f9f-6209-4fcf-9b15-3b7455706f5b
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_longpathsenabled.yml
+40 -35
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry LongPathsEnabled
id: 36f9626c-4272-4808-aadd-267acce681c0
version: 7
date: '2025-01-21'
version: 8
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic detects a modification to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects a modification to the Windows registry
setting "LongPathsEnabled," which allows file paths longer than 260 characters.
This detection leverages data from the Endpoint.Registry datamodel, focusing on
changes to the specific registry path and value. This activity is significant because
@@ -15,58 +16,62 @@ description: The following analytic detects a modification to the Windows regist
path limitations, potentially aiding in evasion techniques. If confirmed malicious,
this modification could facilitate the execution of long-path payloads, aiding in
persistence and further system compromise.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled"
Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_longpathsenabled_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/
- https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows LongPathEnable configuration on $dest$
risk_objects:
- field: dest
type: system
score: 16
- field: dest
type: system
score: 16
threat_objects: []
tags:
analytic_story:
- BlackByte Ransomware
- BlackByte Ransomware
asset_type: Endpoint
atomic_guid:
- 4f4e2f9f-6209-4fcf-9b15-3b7455706f5b
- 4f4e2f9f-6209-4fcf-9b15-3b7455706f5b
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_maxconnectionperserver.yml
+40 -35
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry MaxConnectionPerServer
id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic identifies a suspicious modification of the Windows
- Sysmon EventID 13
description:
The following analytic identifies a suspicious modification of the Windows
registry setting for max connections per server. It detects changes to specific
registry paths using data from the Endpoint.Registry datamodel. This activity is
significant because altering this setting can be exploited by attackers to increase
@@ -15,7 +16,8 @@ description: The following analytic identifies a suspicious modification of the
DDoS attacks or enabling more effective lateral movement within a compromised network.
If confirmed malicious, this could lead to network disruption or further compromise
of additional systems.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet
Settings\\MaxConnectionsPerServer*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet
Settings\\MaxConnectionsPer1_0Server*") Registry.registry_value_data = "0x0000000a"
@@ -24,50 +26,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_maxconnectionperserver_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://asec.ahnlab.com/en/17692/
- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
- https://asec.ahnlab.com/en/17692/
- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in max connection per server configuration on $dest$
risk_objects:
- field: dest
type: system
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- Warzone RAT
- Warzone RAT
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/maxconnectionperserver/registry_event.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/maxconnectionperserver/registry_event.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
+40 -35
View File
@@ -1,72 +1,77 @@
name: Windows Modify Registry No Auto Reboot With Logon User
id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic detects a suspicious modification to the Windows
- Sysmon EventID 13
description:
The following analytic detects a suspicious modification to the Windows
registry that disables automatic reboot with a logged-on user. This detection leverages
the Endpoint data model to identify changes to the registry path `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers`
with a value of `0x00000001`. This activity is significant as it is commonly used
by adversaries, including malware like RedLine Stealer, to evade detection and maintain
persistence. If confirmed malicious, this could allow attackers to bypass security
measures and deploy additional payloads without interruption.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers"
AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_reboot_with_logon_user_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows auto update configuration on $dest$
risk_objects:
- field: dest
type: system
score: 9
- field: dest
type: system
score: 9
threat_objects: []
tags:
analytic_story:
- RedLine Stealer
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
- 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_no_auto_update.yml
+41 -36
View File
@@ -1,73 +1,78 @@
name: Windows Modify Registry No Auto Update
id: fbd4f333-17bb-4eab-89cb-860fa2e0600e
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic identifies a suspicious modification to the Windows
- Sysmon EventID 13
description:
The following analytic identifies a suspicious modification to the Windows
registry that disables automatic updates. It detects changes to the registry path
`SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate` with a value
of `0x00000001`. This activity is significant as it is commonly used by adversaries,
including malware like RedLine Stealer, to evade detection and maintain persistence.
If confirmed malicious, this could allow attackers to bypass security updates, leaving
the system vulnerable to further exploitation and potential zero-day attacks.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate"
AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_update_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows auto update configuration on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- CISA AA23-347A
- RedLine Stealer
- CISA AA23-347A
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
- 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_nochangingwallpaper.yml
+41 -35
View File
@@ -1,20 +1,22 @@
name: Windows Modify Registry NoChangingWallPaper
id: a2276412-e254-4e9a-9082-4d92edb6a3e0
version: 7
date: '2025-01-21'
version: 8
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows registry
aimed at preventing wallpaper changes. It leverages data from the Endpoint.Registry
datamodel, specifically monitoring changes to the "NoChangingWallPaper" registry
value. This activity is significant as it is a known tactic used by Rhysida ransomware
to enforce a malicious wallpaper, thereby limiting user control over system settings.
If confirmed malicious, this registry change could indicate a ransomware infection,
leading to further system compromise and user disruption.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\\NoChangingWallPaper"
Registry.registry_value_data = 1) by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
@@ -22,50 +24,54 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_nochangingwallpaper_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry settings was modified to disable changing of wallpaper on
message:
the registry settings was modified to disable changing of wallpaper on
$dest$.
risk_objects:
- field: dest
type: system
score: 36
- field: dest
type: system
score: 36
threat_objects: []
tags:
analytic_story:
- Rhysida Ransomware
- Rhysida Ransomware
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml
+41 -35
View File
@@ -1,69 +1,75 @@
name: Windows Modify Registry on Smart Card Group Policy
id: 1522145a-8e86-4f83-89a8-baf62a8f489d
version: 4
date: '2024-11-13'
version: 5
date: '2025-04-22'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 13
- Sysmon EventID 13
type: Anomaly
status: production
description: This analytic is developed to detect suspicious registry modifications
description:
This analytic is developed to detect suspicious registry modifications
targeting the "scforceoption" key. Altering this key enforces smart card login for
all users, potentially disrupting normal access methods. Unauthorized changes to
this setting could indicate an attempt to restrict access or force a specific authentication
method, possibly signifying malicious intent to manipulate system security protocols.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\System\\scforceoption*"
Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid
Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_on_smart_card_group_policy_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification in Windows Smart Card Group Policy registry settings
message:
A registry modification in Windows Smart Card Group Policy registry settings
on $dest$
risk_objects:
- field: dest
type: system
score: 25
- field: dest
type: system
score: 25
threat_objects: []
tags:
analytic_story:
- ShrinkLocker
- ShrinkLocker
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_proxyenable.yml
+39 -34
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry ProxyEnable
id: b27f20bd-ef20-41d1-a1e9-25dedd5bf2f5
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows registry
key "ProxyEnable" to enable proxy settings. It leverages data from the Endpoint.Registry
datamodel, specifically monitoring changes to the "Internet Settings\ProxyEnable"
registry path. This activity is significant as it is commonly exploited by malware
@@ -15,7 +16,8 @@ description: The following analytic detects modifications to the Windows registr
Command and Control (C2) servers. If confirmed malicious, this could allow attackers
to redirect network traffic through a proxy, facilitating unauthorized communication
and data exfiltration, thereby compromising the security of the affected host.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Internet
Settings\\ProxyEnable" Registry.registry_value_data = 0x00000001 by Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -23,49 +25,52 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_proxyenable_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry settings was modified to enable proxy on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- DarkGate Malware
- DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_enable/proxyenable.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_enable/proxyenable.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_proxyserver.yml
+39 -34
View File
@@ -1,69 +1,74 @@
name: Windows Modify Registry ProxyServer
id: 12bdaa0b-3c59-4489-aae1-bff6d67746ef
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
data_source:
- Sysmon EventID 13
description: The following analytic detects modifications to the Windows registry
- Sysmon EventID 13
description:
The following analytic detects modifications to the Windows registry
key for setting up a proxy server. It leverages data from the Endpoint.Registry
datamodel, focusing on changes to the "Internet Settings\\ProxyServer" registry
path. This activity is significant as it can indicate malware or adversaries configuring
a proxy to facilitate unauthorized communication with Command and Control (C2) servers.
If confirmed malicious, this could allow attackers to establish persistent, covert
channels for data exfiltration or further exploitation of the compromised host.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Internet
Settings\\ProxyServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id
Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data
Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user
Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_proxyserver_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive, however is not common. Filter as needed.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry settings was modified to setup proxy server on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- DarkGate Malware
- DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
+38 -34
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Qakbot Binary Data Registry
id: 2e768497-04e0-4188-b800-70dd2be0e30d
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a suspicious registry
description:
The following analytic detects the creation of a suspicious registry
entry by Qakbot malware, characterized by 8 random registry value names with encrypted
binary data. This detection leverages data from Endpoint Detection and Response
(EDR) agents, focusing on registry modifications under the "SOFTWARE\\Microsoft\\"
@@ -14,9 +15,10 @@ description: The following analytic detects the creation of a suspicious registr
data. If confirmed malicious, this could allow attackers to maintain persistence
and execute arbitrary code on the compromised system.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 12
- Sysmon EventID 1 AND Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count dc(registry_value_name) as
- Sysmon EventID 1 AND Sysmon EventID 12
- Sysmon EventID 1 AND Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count dc(registry_value_name) as
registry_value_name_count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\*"
AND Registry.registry_value_data = "Binary Data" by _time span=1m Registry.action
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
@@ -38,7 +40,8 @@ search: '| tstats `security_content_summariesonly` count dc(registry_value_name)
as registry_value_name_count values(registry_key_name) by dest process_guid process_name
parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| where registry_value_name_count >= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -49,42 +52,43 @@ how_to_implement: The detection is based on data that originates from Endpoint D
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Registry with binary data created by $process_name$ on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Qakbot
- Qakbot
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml
+44 -38
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Regedit Silent Reg Import
id: 824dd598-71be-4203-bc3b-024f4cda340e
version: 5
date: '2024-11-13'
version: 6
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the modification of the Windows registry
description:
The following analytic detects the modification of the Windows registry
using the regedit.exe application with the silent mode parameter. It leverages data
from Endpoint Detection and Response (EDR) agents, focusing on process names and
command-line executions. This activity is significant because the silent mode allows
@@ -14,10 +15,11 @@ description: The following analytic detects the modification of the Windows regi
attackers to persist in the environment, escalate privileges, or manipulate system
configurations, leading to potential system compromise.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe")
AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.action
@@ -28,7 +30,8 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_regedit_silent_reg_import_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
how_to_implement:
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -37,47 +40,50 @@ how_to_implement: The detection is based on data that originates from Endpoint D
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: Administrators may execute this command that may cause some
known_false_positives:
Administrators may execute this command that may cause some
false positive. Filter as needed.
references:
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The regedit app was executed with silet mode parameter to import .reg file
message:
The regedit app was executed with silet mode parameter to import .reg file
on $dest$.
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Azorult
- Azorult
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml
+43 -37
View File
@@ -1,11 +1,12 @@
name: Windows Modify Registry Suppress Win Defender Notif
id: e3b42daf-fff4-429d-bec8-2a199468cea9
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications in the Windows registry
description:
The following analytic detects modifications in the Windows registry
to suppress Windows Defender notifications. It leverages data from the Endpoint.Registry
datamodel, specifically targeting changes to the "Notification_Suppress" registry
value. This activity is significant because adversaries, including those deploying
@@ -14,8 +15,9 @@ description: The following analytic detects modifications in the Windows registr
detection, maintain persistence, and execute further malicious activities without
alerting the user or security tools.
data_source:
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 13
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows
Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001"
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -23,52 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_modify_registry_suppress_win_defender_notif_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may
known_false_positives:
administrators may enable or disable this feature that may
cause some false positive.
references:
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: the registry for suppresing windows fdefender notification settings was
message:
the registry for suppresing windows fdefender notification settings was
modified to disabled on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- Azorult
- CISA AA23-347A
- Azorult
- CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_modify_registry_tamper_protection.yml
+40 -35
View File
@@ -1,13 +1,14 @@
name: Windows Modify Registry Tamper Protection
id: 12094335-88fc-4c3a-b55f-e62dd8c93c23
version: 6
date: '2024-11-13'
version: 7
date: '2025-04-22'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 13
description: The following analytic detects a suspicious modification to the Windows
- Sysmon EventID 13
description:
The following analytic detects a suspicious modification to the Windows
Defender Tamper Protection registry setting. It leverages data from the Endpoint
datamodel, specifically targeting changes where the registry path is set to disable
Tamper Protection. This activity is significant because disabling Tamper Protection
@@ -15,7 +16,8 @@ description: The following analytic detects a suspicious modification to the Win
potentially leading to reduced security on the system. If confirmed malicious, this
could enable attackers to evade detection, persist in the environment, and execute
further malicious activities without interference from Windows Defender.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows
Defender\\Features\\TamperProtection" AND Registry.registry_value_data="0x00000000"
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
@@ -23,52 +25,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `windows_modify_registry_tamper_protection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
how_to_implement:
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators may enable or disable this feature that may
known_false_positives:
Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A registry modification to tamper Windows Defender protection on $dest$
risk_objects:
- field: dest
type: system
score: 49
- field: dest
type: system
score: 49
threat_objects: []
tags:
analytic_story:
- RedLine Stealer
- RedLine Stealer
asset_type: Endpoint
atomic_guid:
- 12e03af7-79f9-4f95-af48-d3f12f28a260
- 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
- T1112
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog

Some files were not shown because too many files have changed in this diff Show More