diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index ab07874e2d..bc264e1c60 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -70,6 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 75d969f3d3..f29e38cf3f 100644 --- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -1,7 +1,7 @@ name: Detect Outlook exe writing a zip file id: a51bfe1a-94f0-4822-b1e4-16ae10145893 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Bhavin Patel, Splunk status: experimental type: TTP @@ -14,38 +14,21 @@ description: The following analytic identifies the execution of `outlook.exe` wr the security of the affected system and network. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe + by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest + Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename + process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id + type=inner[| tstats `security_content_summariesonly` count values(Filesystem.file_path) + as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*.zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* - OR Filesystem.file_path=*Local\\Temp*) by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(parent_process) as parent_process values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(file_access_time) as file_access_time values(file_create_time) - as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time - values(file_name) as file_name values(file_path) as file_path values(file_acl) as - file_acl values(file_size) as file_size by process_guid | where isnotnull(process) - AND isnotnull(file_name) | `detect_outlook_exe_writing_a_zip_file_filter`' + OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash + Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | rename process_id as malicious_id| fields + malicious_id outlook_id dest file_path file_name file_hash count file_id] | table + firstTime lastTime user malicious_id outlook_id process_name parent_process_name + file_name file_path | where file_name != "" | `detect_outlook_exe_writing_a_zip_file_filter`' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 746dd7ad03..5643d865a3 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -75,19 +75,16 @@ tags: analytic_story: - DHS Report TA18-074A - Active Directory Lateral Movement - - BlackByte Ransomware - HAFNIUM Group - Rhysida Ransomware - Medusa Ransomware - DarkSide Ransomware - SamSam Ransomware - - DarkGate Malware - CISA AA22-320A - Sandworm Tools - IcedID - BlackByte Ransomware - DarkGate Malware - - Rhysida Ransomware - Cactus Ransomware - Volt Typhoon - Seashell Blizzard diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index c7080c8ebd..6d5fb08735 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -1,11 +1,12 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects modifications to the Windows registry +description: + The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" with a value of "0x00000001". This activity is significant because malware, such @@ -14,8 +15,9 @@ description: The following analytic detects modifications to the Windows registr could hinder incident response efforts and allow the attacker to maintain control over the compromised system. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -23,51 +25,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Disabled Registry Tools on $dest$ risk_objects: - - field: dest - type: system - score: 40 + - field: dest + type: system + score: 40 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - NjRAT + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - NjRAT asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 144b97ce74..621bea141f 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -1,11 +1,12 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 10 -date: '2024-12-08' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects a suspicious registry modification aimed +description: + The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. It leverages data from the Endpoint.Registry data model, focusing on changes to the "Control\\MiniNt" registry path. This activity is significant because it can prevent Windows from @@ -14,61 +15,64 @@ description: The following analytic detects a suspicious registry modification a undetected, making it difficult to trace their actions and compromising the integrity of security audits. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Unknown. references: -- https://twitter.com/0gtweet/status/1182516740955226112 + - https://twitter.com/0gtweet/status/1182516740955226112 drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Modified/added/deleted registry entry $registry_path$ on $dest$ risk_objects: - - field: dest - type: system - score: 80 - - field: user - type: user - score: 80 + - field: dest + type: system + score: 80 + - field: user + type: user + score: 80 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - CISA AA23-347A - - Windows Registry Abuse + - Windows Defense Evasion Tactics + - CISA AA23-347A + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 98d7b67a79..248ecfcd06 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -1,11 +1,12 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly -description: The following analytic detects modifications to the Windows registry +description: + The following analytic detects modifications to the Windows registry that disable the display of hidden files. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with hidden file settings. This activity is significant because malware, such as worms and trojan @@ -13,8 +14,9 @@ description: The following analytic detects modifications to the Windows registr behavior could allow an attacker to conceal malicious files on the system, making it harder for security tools and analysts to identify and remove the threat. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" @@ -24,58 +26,60 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis + - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Disabled 'Show Hidden Files' on $dest$ risk_objects: - - field: dest - type: system - score: 40 + - field: dest + type: system + score: 40 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Azorult + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - Azorult asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 - - T1564.001 + - T1112 + - T1562.001 + - T1564.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index d168ac71e4..796c76ccd4 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -1,11 +1,12 @@ name: Disable Windows App Hotkeys id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects a suspicious registry modification aimed +description: + The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values indicative of this behavior. This activity is significant as it can impair an analyst's ability @@ -13,8 +14,9 @@ description: The following analytic detects a suspicious registry modification a response efforts. If confirmed malicious, this technique can allow an attacker to maintain persistence and evade detection, complicating the remediation process. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") by Registry.action @@ -23,50 +25,52 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Disabled 'Windows App Hotkeys' on $dest$ risk_objects: - - field: dest - type: system - score: 40 + - field: dest + type: system + score: 40 threat_objects: [] tags: analytic_story: - - XMRig - - Windows Registry Abuse + - XMRig + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 6f4dde4f4f..57495f502b 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -1,11 +1,12 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects modifications to the registry that disable +description: + The following analytic detects modifications to the registry that disable the CMD prompt application. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableCMD" registry value. This activity is significant because disabling CMD can hinder an analyst's ability to investigate @@ -14,8 +15,9 @@ description: The following analytic detects modifications to the registry that d for directory and file traversal, complicating incident response and allowing the attacker to maintain persistence. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -23,54 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: The Windows command prompt was disabled on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - NjRAT + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - NjRAT asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 726b04c1ae..363b3627ef 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -1,11 +1,12 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects registry modifications that disable the +description: + The following analytic detects registry modifications that disable the Control Panel on Windows systems. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" with a value of "0x00000001". This activity is significant as it is commonly used @@ -14,8 +15,9 @@ description: The following analytic detects registry modifications that disable this could allow attackers to maintain control over the infected machine and prevent remediation efforts. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -23,53 +25,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: The Windows Control Panel was disabled on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse + - Windows Defense Evasion Tactics + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test (XML) - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test (XML) + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 15f095558e..d337deb039 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -1,11 +1,12 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects the modification of the Windows registry +description: + The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" with a value of "0x00000001". This activity is significant because the Run application @@ -13,8 +14,9 @@ description: The following analytic detects the modification of the Windows regi malicious, this action could hinder system cleaning efforts and make it more difficult to run essential tools, thereby aiding malware persistence. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -22,55 +24,58 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.malwarebytes.com/detections/pum-optional-norun/ + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://blog.malwarebytes.com/detections/pum-optional-norun/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: The Windows registry was modified to disable run application in window + message: + The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse + - Windows Defense Evasion Tactics + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 69023c9b89..3eec217377 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -15,37 +15,16 @@ description: The following analytic detects instances of DLLHost.exe running wit network's security. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=dllhost.exe Processes.action!="blocked" by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `dllhost_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe + Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" + | rename dest as src | join host process_id [| tstats `security_content_summariesonly` + count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) + as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port + != 0 by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 0c4dda3622..56a4489388 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,11 +1,12 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 version: 6 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file downloads by the Telegram +description: + The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download @@ -13,59 +14,64 @@ description: The following analytic detects suspicious file downloads by the Tel malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network. data_source: -- Sysmon EventID 15 -search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" + - Sysmon EventID 15 +search: + '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Contents Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: normal download of file in telegram app. (if it was a common +known_false_positives: + normal download of file in telegram app. (if it was a common app in network) references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Suspicious files were downloaded with the Telegram application on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Phemedrone Stealer - - Crypto Stealer - - Snake Keylogger - - XMRig + - Phemedrone Stealer + - Crypto Stealer + - Snake Keylogger + - XMRig + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1105 + - T1105 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index cf32813a6f..60fc5e16cf 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -1,11 +1,12 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 10 -date: '2024-12-08' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects a suspicious registry modification that +description: + The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This @@ -14,8 +15,9 @@ description: The following analytic detects a suspicious registry modification t If confirmed malicious, this could allow an attacker to obtain sensitive credentials, leading to further compromise and lateral movement within the network. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,54 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html + - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: wdigest registry $registry_path$ was modified on $dest$ risk_objects: - - field: user - type: user - score: 80 - - field: dest - type: system - score: 80 + - field: user + type: user + score: 80 + - field: dest + type: system + score: 80 threat_objects: [] tags: analytic_story: - - Credential Dumping - - Windows Registry Abuse - - CISA AA22-320A + - Credential Dumping + - Windows Registry Abuse + - CISA AA22-320A asset_type: Endpoint mitre_attack_id: - - T1112 - - T1003 + - T1112 + - T1003 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 5f16d96bbd..70e280e803 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -1,11 +1,12 @@ name: Enumerate Users Local Group Using Telegram id: fcd74532-ae54-11eb-a5ab-acde48001122 version: 8 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects a Telegram process enumerating all network +description: + The following analytic detects a Telegram process enumerating all network users in a local group. It leverages EventCode 4798, which is generated when a process enumerates a user's security-enabled local groups on a computer or device. This activity is significant as it may indicate an attempt to gather information on user @@ -13,60 +14,64 @@ description: The following analytic detects a Telegram process enumerating all n this behavior could allow an attacker to map out user accounts, potentially leading to privilege escalation or lateral movement within the network. data_source: -- Windows Event Log Security 4798 -search: '`wineventlog_security` EventCode=4798 CallerProcessName = "*\\telegram.exe" + - Windows Event Log Security 4798 +search: + '`wineventlog_security` EventCode=4798 CallerProcessName = "*\\telegram.exe" | stats count min(_time) as firstTime max(_time) as lastTime by user Computer EventCode CallerProcessName ProcessID SubjectUserSid SubjectDomainName SubjectLogonId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment. known_false_positives: unknown references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: The Telegram application has been identified enumerating local groups on + message: + The Telegram application has been identified enumerating local groups on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 80 - - field: dest - type: system - score: 80 + - field: user + type: user + score: 80 + - field: dest + type: system + score: 80 threat_objects: [] tags: analytic_story: - - XMRig - - Compromised Windows Host + - XMRig + - Compromised Windows Host + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1087 + - T1087 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 848b988bf1..afd814f56a 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -1,11 +1,12 @@ name: Excessive number of taskhost processes id: f443dac2-c7cf-11eb-ab51-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-25' author: Michael Hart status: production type: Anomaly -description: The following analytic identifies an excessive number of taskhost.exe +description: + The following analytic identifies an excessive number of taskhost.exe and taskhostex.exe processes running within a short time frame. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and their counts. This behavior is significant as it is commonly associated with post-exploitation @@ -14,10 +15,11 @@ description: The following analytic identifies an excessive number of taskhost.e activity could indicate an ongoing attack, allowing attackers to execute code, escalate privileges, or move laterally within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.action) as action + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id @@ -41,9 +43,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.action) as a values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(user) as user values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product values(process_name) - as process_name by _time, dest, firstTime, lastTime | `security_content_ctime(firstTime)` + as process_name by _time, dest, firstTime, lastTime | where taskhost_count > + 10 or taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -52,46 +56,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators, administrative actions or certain applications +known_false_positives: + Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. references: -- https://attack.mitre.org/software/S0250/ + - https://attack.mitre.org/software/S0250/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An excessive amount of taskhost.exe and taskhostex.exe was executed on + message: + An excessive amount of taskhost.exe and taskhostex.exe was executed on $dest$ indicative of suspicious behavior. risk_objects: - - field: dest - type: system - score: 56 + - field: dest + type: system + score: 56 threat_objects: [] tags: analytic_story: - - Meterpreter + - Meterpreter asset_type: Endpoint mitre_attack_id: - - T1059 + - T1059 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 1502d05c4d..8f41292294 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -106,10 +106,6 @@ tags: - WhisperGate - WinDealer RAT - XMRig - - MoonPeak - - Industroyer2 - - Amadey - - IcedID - Earth Alux asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index f0a7eebd5b..8916822ec2 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -1,11 +1,12 @@ name: FodHelper UAC Bypass id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 -version: 9 -date: '2025-02-10' +version: 10 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the execution of fodhelper.exe, which +description: + The following analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. The detection method uses Endpoint Detection and Response (EDR) telemetry to identify when fodhelper.exe spawns a child process and accesses the registry @@ -14,10 +15,11 @@ description: The following analytic detects the execution of fodhelper.exe, whic with elevated privileges, leading to unauthorized system changes and potential full system compromise. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -37,55 +40,57 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: Limited to no false positives are expected. references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 -- https://attack.mitre.org/techniques/T1548/002/ + - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md + - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 + - https://attack.mitre.org/techniques/T1548/002/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: Suspicious registry keys added by process fodhelper.exe with a parent_process + message: + Suspicious registry keys added by process fodhelper.exe with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 81 - - field: dest - type: system - score: 81 + - field: user + type: user + score: 81 + - field: dest + type: system + score: 81 threat_objects: - - field: parent_process_name - type: parent_process_name + - field: parent_process_name + type: parent_process_name tags: analytic_story: - - IcedID - - ValleyRAT - - Compromised Windows Host - - Windows Defense Evasion Tactics + - IcedID + - ValleyRAT + - Compromised Windows Host + - Windows Defense Evasion Tactics asset_type: Endpoint mitre_attack_id: - - T1112 - - T1548.002 + - T1112 + - T1548.002 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 9a83716be3..c95e2198cd 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -1,11 +1,12 @@ name: GetWmiObject User Account with PowerShell id: b44f6ac6-0429-11ec-87e9-acde48001122 version: 7 -date: '2025-04-17' +date: '2025-04-22' author: Mauricio Velazco, Splunk status: production type: Hunting -description: The following analytic detects the execution of `powershell.exe` with +description: + The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount` parameter to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. @@ -14,10 +15,11 @@ description: The following analytic detects the execution of `powershell.exe` wi malicious, this behavior could lead to further reconnaissance, privilege escalation, or lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,25 +39,27 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this PowerShell commandlet +known_false_positives: + Administrators or power users may use this PowerShell commandlet for troubleshooting. references: -- https://attack.mitre.org/techniques/T1087/001/ + - https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - - Winter Vivern - - Active Directory Discovery + - Winter Vivern + - Active Directory Discovery + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1087.001 + - T1087.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 44b2166007..8c82b15f7c 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,7 @@ name: GPUpdate with no Command Line Arguments with Network id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 9 -date: '2024-12-10' +version: 10 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -16,37 +16,24 @@ description: The following analytic detects the execution of gpupdate.exe withou leading to system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=gpupdate.exe by Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid Processes.process_hash - Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `gpupdate_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=gpupdate.exe + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"| + join process_id [| tstats `security_content_summariesonly` count values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip + values(All_Traffic.direction) as direction values(All_Traffic.dvc) as dvc values(All_Traffic.protocol) as protocol + values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src) as src values(All_Traffic.src_ip) as src_ip + values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest + parent_process_name process_name process_path process process_id dest_port C2 app dest_ip direction dvc protocol + protocol_version src src_ip src_port transport | + `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index aa1648ca7b..4476ff86f3 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,7 +1,7 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -14,38 +14,24 @@ description: The following analytic detects the Java process writing a .jsp file the affected system, posing a severe security risk. data_source: - Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name - IN ("java","java.exe", "javaw.exe") by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.jsp*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name="*.jsp*" by _time Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process) AND isnotnull(file_name) | - `java_writing_jsp_file_filter`' + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name + file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) + as lastTime by dest process_name process_guid file_name file_path file_create_time + user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `java_writing_jsp_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/endpoint/lolbas_with_network_traffic.yml index eb5d3e1481..b7136b6e89 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/endpoint/lolbas_with_network_traffic.yml @@ -1,11 +1,12 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 version: 8 -date: '2025-04-17' +date: '2025-04-22' author: Steven Dick status: production type: TTP -description: The following analytic identifies the use of Living Off the Land Binaries +description: + The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently @@ -14,8 +15,9 @@ description: The following analytic identifies the use of Living Off the Land Bi to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: -- Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 3 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where (All_Traffic.app IN ("*Regsvcs.exe", "*\\Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe", "*Xwizard.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe", @@ -34,56 +36,60 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=app ".*\\\(?.*)$" | `lolbas_with_network_traffic_filter`' -how_to_implement: To successfully implement this detection you must ingest events +how_to_implement: + To successfully implement this detection you must ingest events into the Network traffic data model that contain the source, destination, and communicating process in the app field. Relevant processes must also be ingested in the Endpoint data model with matching process_id field. Sysmon EID1 and EID3 are good examples of this type this data type. -known_false_positives: Legitimate usage of internal automation or scripting, especially +known_false_positives: + Legitimate usage of internal automation or scripting, especially powershell.exe or pwsh.exe, internal to internal or logon scripts. It may be necessary to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1") references: -- https://lolbas-project.github.io/# -- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ drilldown_searches: -- name: View the detection results for - "$src$" - search: '%original_detection_search% | search src = "$src$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: The LOLBAS $process_name$ on device $src$ was seen communicating with $dest$. risk_objects: - - field: src - type: system - score: 25 + - field: src + type: system + score: 25 threat_objects: - - field: dest_ip - type: ip_address + - field: dest_ip + type: ip_address tags: analytic_story: - - Living Off The Land + - Living Off The Land + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1105 - - T1567 - - T1218 + - T1105 + - T1567 + - T1218 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: network tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index e88d82648d..bc333c82c0 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -1,11 +1,12 @@ name: Malicious InProcServer32 Modification id: 127c8d08-25ff-11ec-9223-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects a process modifying the registry with +description: + The following analytic detects a process modifying the registry with a known malicious CLSID under InProcServer32. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications within the HKLM or HKCU Software Classes CLSID paths. This activity is significant as it may indicate @@ -13,16 +14,18 @@ description: The following analytic detects a process modifying the registry wit malicious, this could allow an attacker to persist in the environment, execute arbitrary code, or escalate privileges, posing a severe threat to system integrity and security. data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + - Sysmon EventID 12 + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -31,52 +34,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives should be limited, filter as needed. In our +known_false_positives: + False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. references: -- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ -- https://tria.ge/210929-ap75vsddan -- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 + - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ + - https://tria.ge/210929-ap75vsddan + - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A process identified on endpoint $dest$ modifying the registry with a known + message: + A process identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. risk_objects: - - field: dest - type: system - score: 80 + - field: dest + type: system + score: 80 threat_objects: [] tags: analytic_story: - - Suspicious Regsvr32 Activity - - Remcos + - Suspicious Regsvr32 Activity + - Remcos asset_type: Endpoint mitre_attack_id: - - T1218.010 - - T1112 + - T1218.010 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml index d42c13bc07..39519c3105 100644 --- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml @@ -1,11 +1,12 @@ name: Mmc LOLBAS Execution Process Spawn id: f6601940-4c74-11ec-b9b7-3e22fbd008af version: 7 -date: '2025-04-17' +date: '2025-04-22' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution +description: + The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `mmc.exe` is the parent process. This activity is significant because adversaries can abuse the DCOM protocol and MMC20 COM object @@ -14,10 +15,11 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu allowing attackers to execute code remotely, potentially leading to further compromise and persistence within the environment. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", @@ -37,7 +39,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -46,49 +49,52 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Legitimate applications may trigger this behavior, filter as +known_false_positives: + Legitimate applications may trigger this behavior, filter as needed. references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques -- https://lolbas-project.github.io/ + - https://attack.mitre.org/techniques/T1021/003/ + - https://www.cybereason.com/blog/dcom-lateral-movement-techniques + - https://lolbas-project.github.io/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Mmc.exe spawned a LOLBAS process on $dest$. risk_objects: - - field: dest - type: system - score: 54 + - field: dest + type: system + score: 54 threat_objects: [] tags: analytic_story: - - Active Directory Lateral Movement - - Living Off The Land + - Active Directory Lateral Movement + - Living Off The Land + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1021.003 - - T1218.014 + - T1021.003 + - T1218.014 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index cab03bb644..c8d97e3776 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -1,7 +1,7 @@ name: MSI Module Loaded by Non-System Binary id: ccb98a66-5851-11ec-b91c-acde48001122 -version: 7 -date: '2025-02-10' +version: 8 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Hunting @@ -38,7 +38,7 @@ tags: cve: - CVE-2021-41379 mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 3b8dd38765..7ee1c1ab58 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Msmpeng Application DLL Side Loading id: 8bb3f280-dd9b-11eb-84d5-acde48001122 -version: 8 -date: '2025-02-10' +version: 9 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Sanjay Govind status: production type: TTP @@ -57,7 +57,7 @@ tags: - Revil Ransomware asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index cfca818b75..d55f428f53 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -1,7 +1,7 @@ name: Outbound Network Connection from Java Using Default Ports id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Lou Stella, Splunk status: production type: TTP @@ -15,39 +15,24 @@ description: "The following analytic detects outbound network connections from J \ further compromise of the affected server." data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port - = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `outbound_network_connection_from_java_using_default_ports_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port + = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process dest_port + | `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/potential_telegram_api_request_via_commandline.yml b/detections/endpoint/potential_telegram_api_request_via_commandline.yml index 042c15166a..a187136d1f 100644 --- a/detections/endpoint/potential_telegram_api_request_via_commandline.yml +++ b/detections/endpoint/potential_telegram_api_request_via_commandline.yml @@ -1,11 +1,12 @@ name: Potential Telegram API Request Via CommandLine id: d6b0d627-d0bf-46b1-936f-c48284767d21 version: 3 -date: '2025-04-17' +date: '2025-04-22' author: Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa status: production type: Anomaly -description: The following analytic detects the presence of "api.telegram.org" in +description: + The following analytic detects the presence of "api.telegram.org" in the CommandLine of a process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity can be significant as the telegram API has been used as an exfiltration @@ -13,10 +14,11 @@ description: The following analytic detects the presence of "api.telegram.org" i or malware to exfiltrate data or receive additional C2 instruction, potentially leading to further compromise and persistence within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process= "*api.telegram.org*" NOT Processes.process IN ("*-osint -url*", "* --single-argument*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potential_telegram_api_request_via_commandline_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -35,52 +38,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positive may stem from application or users requesting +known_false_positives: + False positive may stem from application or users requesting the API directly via CommandLine for testing purposes. Investigate the matches and apply the necessary filters. references: -- https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior -- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior -- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content -- https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content + - https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior + - https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior + - https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content + - https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Process $process_name$ with command line $process$ in $dest$ risk_objects: - - field: dest - type: system - score: 30 + - field: dest + type: system + score: 30 threat_objects: - - field: process_name - type: process_name + - field: process_name + type: process_name tags: analytic_story: - - XMRig + - XMRig + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1102.002 - - T1041 + - T1102.002 + - T1041 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 9a6b80d664..d710231880 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,11 +1,12 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 version: 15 -date: '2025-04-17' +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Hunting -description: The following analytic identifies suspicious PowerShell execution using +description: + The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers @@ -14,8 +15,9 @@ description: The following analytic identifies suspicious PowerShell execution u execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security. data_source: -- Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), + - Powershell Script Block Logging 4104 +search: + '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) @@ -43,53 +45,52 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | rename Computer as dest, UserID as user | `powershell_4104_hunting_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs +how_to_implement: + The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Limited false positives. May filter as needed. references: -- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md -- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell -- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt -- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1 -- https://www.mandiant.com/resources/greater-visibilityt -- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ -- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html -- https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ + - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md + - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell + - https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt + - https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ + - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1 + - https://www.mandiant.com/resources/greater-visibilityt + - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ + - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html + - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ tags: analytic_story: - - Braodo Stealer - - Cactus Ransomware - - China-Nexus Threat Activity - - CISA AA23-347A - - CISA AA24-241A - - Cleo File Transfer Software - - DarkGate Malware - - Data Destruction - - Flax Typhoon - - Hermetic Wiper - - Lumma Stealer - - Malicious PowerShell - - Medusa Ransomware - - Rhysida Ransomware - - Salt Typhoon - - SystemBC - - PHP-CGI RCE Attack on Japanese Organizations - - Rhysida Ransomware - - Salt Typhoon - - SystemBC + - Braodo Stealer + - Cactus Ransomware + - China-Nexus Threat Activity + - CISA AA23-347A + - CISA AA24-241A + - Cleo File Transfer Software + - DarkGate Malware + - Data Destruction + - Flax Typhoon + - Hermetic Wiper + - Lumma Stealer + - Malicious PowerShell + - Medusa Ransomware + - Rhysida Ransomware + - Salt Typhoon + - SystemBC + - PHP-CGI RCE Attack on Japanese Organizations + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1059.001 + - T1059.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 82edc8ce79..8950bff300 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -1,11 +1,12 @@ name: Powershell Creating Thread Mutex id: 637557ec-ca08-11eb-bd0a-acde48001122 version: 9 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of PowerShell scripts using +description: + The following analytic detects the execution of PowerShell scripts using the `mutex` function via EventCode 4104. This detection leverages PowerShell Script Block Logging to identify scripts that create thread mutexes, a technique often used in obfuscated scripts to ensure only one instance runs on a compromised machine. @@ -14,61 +15,66 @@ description: The following analytic detects the execution of PowerShell scripts control over a process, potentially leading to further exploitation or persistence within the environment. data_source: -- Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | fillnull + - Powershell Script Block Logging 4104 +search: + '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable +how_to_implement: + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: powershell developer may used this function in their script +known_false_positives: + powershell developer may used this function in their script for instance checking too. references: -- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/ -- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 -- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf -- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/ + - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 + - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf + - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user_id$" - search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user_id$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A suspicious powershell script contains Thread Mutex on host $dest$ risk_objects: - - field: dest - type: system - score: 40 - - field: user_id - type: user - score: 40 + - field: dest + type: system + score: 40 + - field: user_id + type: user + score: 40 threat_objects: [] tags: analytic_story: - - Malicious PowerShell + - Malicious PowerShell + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1027.005 - - T1059.001 + - T1027.005 + - T1059.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 1d77d40f68..d2990b0d4e 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,11 +1,12 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-22' author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the presence of a registry key associated +description: + The following analytic detects the presence of a registry key associated with the Remcos RAT agent on a host. It leverages data from the Endpoint.Processes and Endpoint.Registry data models in Splunk, focusing on instances where the "license" key is found in the "Software\Remcos" path. This behavior is significant as it indicates @@ -14,16 +15,18 @@ description: The following analytic detects the presence of a registry key assoc over the system, steal sensitive information, or use the compromised host for further attacks. Immediate investigation and remediation are required. data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + - Sysmon EventID 12 + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`remcos_client_registry_install_entry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -34,44 +37,46 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://attack.mitre.org/software/S0332/ + - https://attack.mitre.org/software/S0332/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A registry entry $registry_path$ with registry keyname $registry_key_name$ + message: + A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ risk_objects: - - field: dest - type: system - score: 90 + - field: dest + type: system + score: 90 threat_objects: [] tags: analytic_story: - - Remcos - - Windows Registry Abuse + - Remcos + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index febc39bf6a..ab85a04276 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -1,11 +1,12 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-22' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic identifies suspicious modifications in the registry +description: + The following analytic identifies suspicious modifications in the registry entry, specifically targeting paths used by malware like REVIL. It detects changes in registry paths such as `SOFTWARE\\WOW6432Node\\Facebook_Assistant` and `SOFTWARE\\WOW6432Node\\BlackLivesMatter`. This detection leverages data from Endpoint Detection and Response (EDR) agents, @@ -15,9 +16,10 @@ description: The following analytic identifies suspicious modifications in the r attackers to maintain persistence, encrypt files, and store critical ransomware-related information on compromised hosts. data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + - Sysmon EventID 12 + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path @@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_registry_entry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,49 +39,51 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A registry entry $registry_path$ with registry value $registry_value_name$ + message: + A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ risk_objects: - - field: dest - type: system - score: 60 - - field: user - type: user - score: 60 + - field: dest + type: system + score: 60 + - field: user + type: user + score: 60 threat_objects: [] tags: analytic_story: - - Ransomware - - Revil Ransomware - - Windows Registry Abuse + - Ransomware + - Revil Ransomware + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index dd2b27110a..85db4c3643 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -1,11 +1,12 @@ name: Rundll32 Shimcache Flush id: a913718a-25b6-11ec-96d3-acde48001122 -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of a suspicious rundll32 +description: + The following analytic detects the execution of a suspicious rundll32 command line used to clear the shim cache. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because clearing the shim cache is an anti-forensic @@ -13,10 +14,11 @@ description: The following analytic detects the execution of a suspicious rundll malicious, this action could hinder incident response efforts, allowing an attacker to cover their tracks and maintain persistence on the compromised machine. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid @@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,47 +39,48 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://blueteamops.medium.com/shimcache-flush-89daff28d15e + - https://blueteamops.medium.com/shimcache-flush-89daff28d15e drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: rundll32 process execute $process$ to clear shim cache on $dest$ risk_objects: - - field: dest - type: system - score: 80 - - field: user - type: user - score: 80 + - field: dest + type: system + score: 80 + - field: user + type: user + score: 80 threat_objects: [] tags: analytic_story: - - Unusual Processes - - Living Off The Land - - Compromised Windows Host + - Unusual Processes + - Living Off The Land + - Compromised Windows Host asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index a9734a3629..5e74ee67e5 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -15,37 +15,24 @@ description: The following analytic detects the execution of rundll32.exe withou of the system. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_rundll32` AND Processes.action!="blocked" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `rundll32_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where `process_rundll32` AND Processes.action!="blocked" + by host _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(?i)(rundll32\.exe.{0,4}$)" | rename dest as src | join host process_id + [| tstats `security_content_summariesonly` count + FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host + All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] + | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index d2b24b770d..42bc1bd9e3 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -15,37 +15,23 @@ description: The following analytic detects instances of searchprotocolhost.exe and control, potentially leading to data exfiltration or further system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=searchprotocolhost.exe by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `searchprotocolhost_with_no_command_line_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats + `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name + process_name process_path process process_id dest_port C2 | `searchprotocolhost_with_no_command_line_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index ac3e2aeaef..63852cc5a6 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL id: d5bf5cf2-da71-11eb-92c2-acde48001122 -version: 9 -date: '2025-03-27' +version: 10 +date: '2025-04-22' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -16,38 +16,20 @@ description: The following analytic detects `spoolsv.exe` writing a `.dll` file, data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `spoolsv_writing_a_dll_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=spoolsv.exe by _time Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" + Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.process_guid Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | + fields _time dest file_create_time file_name file_path process_name process_path + process_guid process] | dedup file_create_time | table dest file_create_time, file_name, + file_path, process_name process_guid | `spoolsv_writing_a_dll_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 9298a6651d..91c2570260 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -1,11 +1,12 @@ name: Suspicious Copy on System32 id: ce633e56-25b2-11ec-9e76-acde48001122 version: 9 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file copy operations from the +description: + The following analytic detects suspicious file copy operations from the System32 or SysWow64 directories, often indicative of malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes initiated by command-line tools like cmd.exe or PowerShell. This behavior is significant as @@ -14,10 +15,11 @@ description: The following analytic detects suspicious file copy operations from arbitrary code, potentially leading to system compromise or further lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*") @@ -30,7 +32,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | eval splitted_commandline=split(process," ") | eval first_cmdline=lower(mvindex(splitted_commandline,0)) | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`suspicious_copy_on_system32_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -41,52 +44,54 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: every user may do this event but very un-ussual. references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 + - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Execution of copy exe to copy file from $process$ on $dest$ risk_objects: - - field: dest - type: system - score: 63 - - field: user - type: user - score: 63 + - field: dest + type: system + score: 63 + - field: user + type: user + score: 63 threat_objects: [] tags: analytic_story: - - Qakbot - - Sandworm Tools - - IcedID - - Volt Typhoon - - AsyncRAT - - Unusual Processes - - Compromised Windows Host + - Qakbot + - Sandworm Tools + - IcedID + - Volt Typhoon + - AsyncRAT + - Unusual Processes + - Compromised Windows Host + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1036.003 + - T1036.003 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 9cc0d39dc3..666343c940 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious Image Creation In Appdata Folder id: f6f904c4-1ac0-11ec-806b-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,39 +15,21 @@ description: The following analytic detects the creation of image files in the A compromising sensitive information and user privacy. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe - Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path="*\\appdata\\Roaming\\*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_image_creation_in_appdata_folder_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= + "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields _time dest file_create_time file_name + file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 635fd7e6b6..e2236b5130 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -1,11 +1,12 @@ name: Suspicious Process Executed From Container File id: d8120352-3b62-411c-8cb6-7b47584dd5e8 version: 6 -date: '2025-04-17' +date: '2025-04-22' author: Steven Dick status: production type: TTP -description: The following analytic identifies a suspicious process executed from +description: + The following analytic identifies a suspicious process executed from within common container/archive file types such as ZIP, ISO, IMG, and others. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is a common @@ -13,10 +14,11 @@ description: The following analytic identifies a suspicious process executed fro malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") AND Processes.action="allowed" by Processes.action Processes.dest Processes.original_file_name @@ -28,7 +30,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces | regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" | rex field=process "(?i).+\\\\(?[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -39,53 +42,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: Various business process or userland applications and behavior. references: -- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations -- https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/ -- https://attack.mitre.org/techniques/T1204/002/ + - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations + - https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/ + - https://attack.mitre.org/techniques/T1204/002/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A suspicious process $process_name$ was launched from $file_name$ on $dest$. risk_objects: - - field: dest - type: system - score: 16 - - field: user - type: user - score: 16 + - field: dest + type: system + score: 16 + - field: user + type: user + score: 16 threat_objects: - - field: file_name - type: file_name + - field: file_name + type: file_name tags: analytic_story: - - Unusual Processes - - Amadey - - Remcos - - Snake Keylogger + - Unusual Processes + - Amadey + - Remcos + - Snake Keylogger + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1204.002 - - T1036.008 + - T1204.002 + - T1036.008 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 13523532b8..8ecaf28eef 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -1,11 +1,12 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -version: 10 -date: '2024-11-13' +version: 11 +date: '2025-04-22' author: David Dorsey, Splunk status: production type: Anomaly -description: The following analytic identifies instances of reg.exe being launched +description: + The following analytic identifies instances of reg.exe being launched from a command prompt (cmd.exe) that was not initiated by the user, as indicated by a parent process other than explorer.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process @@ -15,10 +16,11 @@ description: The following analytic identifies instances of reg.exe being launch to modify critical system settings, potentially leading to privilege escalation or persistent access. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name != explorer.exe Processes.process_name =cmd.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec @@ -32,7 +34,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename parent_process_id as process_id |dedup process_id| table process_id dest] | `suspicious_reg_exe_process_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -41,56 +44,59 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: It's possible for system administrators to write scripts that +known_false_positives: + It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. references: -- https://car.mitre.org/wiki/CAR-2013-03-001/ + - https://car.mitre.org/wiki/CAR-2013-03-001/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a registry entry. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows Defense Evasion Tactics - - Disabling Security Tools - - DHS Report TA18-074A + - Windows Defense Evasion Tactics + - Disabling Security Tools + - DHS Report TA18-074A asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 9464b212cf..911dd6035f 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious WAV file in Appdata Folder id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,39 +16,21 @@ description: The following analytic detects the creation of .wav files in the Ap data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe - Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_wav_file_in_appdata_folder_filter`' + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields file_name file_path process_name process_path + process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index ce4e741840..662f188f9f 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -1,7 +1,7 @@ name: Suspicious writes to windows Recycle Bin id: b5541828-8ffd-4070-9d95-b3da4de924cb -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Rico Valdez, Splunk status: production type: TTP @@ -15,38 +15,20 @@ description: The following analytic detects when a process other than explorer.e tools. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) + as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*" + by Filesystem.process_name Filesystem.process_id Filesystem.dest | `drop_dm_object_name("Filesystem")` + | join process_id [| tstats `security_content_summariesonly` values(Processes.user) + as user values(Processes.process_name) as process_name values(Processes.parent_process_name) + as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name != "explorer.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path - = "*$Recycle.Bin*" by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_writes_to_windows_recycle_bin_filter`' + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + | table user process_name process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes. diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index b907525320..d7aafa7b1b 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -1,7 +1,7 @@ name: Unknown Process Using The Kerberos Protocol id: c91a0852-9fbb-11ec-af44-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -15,37 +15,22 @@ description: The following analytic identifies a non-lsass.exe process making an access or lateral movement within the network. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name!=lsass.exe by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name!=lsass.exe by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `unknown_process_using_the_kerberos_protocol_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id dest [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename src as dest ] | table _time dest + parent_process_name process_name process_path process process_id dest_port | `unknown_process_using_the_kerberos_protocol_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index c78db66802..1774fe2ceb 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -1,11 +1,12 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f -version: 8 -date: '2024-11-13' +version: 9 +date: '2025-04-24' author: Jose Hernandez, Bhavin Patel, Splunk status: production type: TTP -description: The following analytic identifies the execution of `adfind.exe` with +description: + The following analytic identifies the execution of `adfind.exe` with specific command-line arguments related to Active Directory queries. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant because @@ -14,10 +15,11 @@ description: The following analytic identifies the execution of `adfind.exe` wit allow attackers to map the AD environment, facilitating further attacks such as privilege escalation or lateral movement. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*-gcb *" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*")) @@ -27,8 +29,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_adfind_exe_filter`| `windows_adfind_exe_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection + | `windows_adfind_exe_filter`' +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -37,61 +40,64 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: ADfind is a command-line tool for AD administration and management +known_false_positives: + ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro. references: -- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption -- https://www.joeware.net/freetools/tools/adfind/index.htm -- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ + - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption + - https://www.joeware.net/freetools/tools/adfind/index.htm + - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ drilldown_searches: -- name: View the detection results for - "$user$" - search: '%original_detection_search% | search user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: Windows AdFind Exe detected with command-line arguments associated with + message: + Windows AdFind Exe detected with command-line arguments associated with Active Directory queries on machine - [dest] risk_objects: - - field: user - type: user - score: 25 + - field: user + type: user + score: 25 threat_objects: [] tags: analytic_story: - - Domain Trust Discovery - - IcedID - - NOBELIUM Group - - Graceful Wipe Out Attack - - BlackSuit Ransomware + - Domain Trust Discovery + - IcedID + - NOBELIUM Group + - Graceful Wipe Out Attack + - BlackSuit Ransomware asset_type: Endpoint atomic_guid: - - 736b4f53-f400-4c22-855d-1a6b5a551600 - - b95fd967-4e62-4109-b48d-265edfd28c3a - - e1ec8d20-509a-4b9a-b820-06c9b2da8eb7 - - 5e2938fb-f919-47b6-8b29-2f6a1f718e99 - - abf00f6c-9983-4d9a-afbc-6b1c6c6448e1 - - 51a98f96-0269-4e09-a10f-e307779a8b05 + - 736b4f53-f400-4c22-855d-1a6b5a551600 + - b95fd967-4e62-4109-b48d-265edfd28c3a + - e1ec8d20-509a-4b9a-b820-06c9b2da8eb7 + - 5e2938fb-f919-47b6-8b29-2f6a1f718e99 + - abf00f6c-9983-4d9a-afbc-6b1c6c6448e1 + - 51a98f96-0269-4e09-a10f-e307779a8b05 mitre_attack_id: - - T1018 + - T1018 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index bfc41b6178..af36506aad 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -1,11 +1,12 @@ name: Windows Cmdline Tool Execution From Non-Shell Process id: 2afa393f-b88d-41b7-9793-623c93a2dfde version: 5 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, +description: + The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant @@ -14,10 +15,11 @@ description: The following analytic identifies instances where `ipconfig.exe`, ` allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", @@ -29,7 +31,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -38,64 +41,68 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: A network operator or systems administrator may utilize an +known_false_positives: + A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation + - https://attack.mitre.org/groups/G0046/ + - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A non-standard parent process $parent_process_name$ spawned child process + message: + A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. risk_objects: - - field: dest - type: system - score: 56 - - field: user - type: user - score: 56 + - field: dest + type: system + score: 56 + - field: user + type: user + score: 56 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - CISA AA22-277A - - Gozi Malware - - CISA AA23-347A - - Qakbot - - Medusa Ransomware - - DarkGate Malware - - Rhysida Ransomware - - Volt Typhoon - - FIN7 + - CISA AA22-277A + - Gozi Malware + - CISA AA23-347A + - Qakbot + - Medusa Ransomware + - DarkGate Malware + - Rhysida Ransomware + - Volt Typhoon + - FIN7 + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1059.007 + - T1059.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index 042d104f0c..2475cef1f1 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -1,7 +1,7 @@ name: Windows Defacement Modify Transcodedwallpaper File id: e11c3d90-5bc7-42ad-94cd-ba75db10d897 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,39 +15,21 @@ description: The following analytic identifies modifications to the TranscodedWa potentially leading to further system compromise or data exfiltration. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path - !="*\\Windows\\Explorer.EXE" by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_path !="*\\Windows\\Explorer.EXE" + by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path - = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by Filesystem.action - Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash - Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user - Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - file_access_time file_create_time file_hash file_modify_time file_name file_path - file_acl file_size firstTime lastTime | stats values(action) as action values(dest) - as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `windows_defacement_modify_transcodedwallpaper_file_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, + _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields file_name file_path process_name process_path + process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml index d79a433c88..2102119480 100644 --- a/detections/endpoint/windows_defender_asr_registry_modification.yml +++ b/detections/endpoint/windows_defender_asr_registry_modification.yml @@ -1,13 +1,14 @@ name: Windows Defender ASR Registry Modification id: 6a1b6cbe-6612-44c3-92b9-1a1bd77412eb -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Hunting data_source: -- Windows Event Log Defender 5007 -description: The following analytic detects modifications to Windows Defender Attack + - Windows Event Log Defender 5007 +description: + The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by @@ -15,7 +16,8 @@ description: The following analytic detects modifications to Windows Defender At an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches. -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" +search: + '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval @@ -25,33 +27,34 @@ search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" +search: + '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval @@ -24,52 +26,54 @@ search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -49,42 +52,43 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/ + - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Registry with binary data created by $process_name$ on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Qakbot + - Qakbot asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index 3fc45fe76a..41701c6e43 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -1,11 +1,12 @@ name: Windows Modify Registry Regedit Silent Reg Import id: 824dd598-71be-4203-bc3b-024f4cda340e -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the modification of the Windows registry +description: + The following analytic detects the modification of the Windows registry using the regedit.exe application with the silent mode parameter. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because the silent mode allows @@ -14,10 +15,11 @@ description: The following analytic detects the modification of the Windows regi attackers to persist in the environment, escalate privileges, or manipulate system configurations, leading to potential system compromise. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.action @@ -28,7 +30,8 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -37,47 +40,50 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators may execute this command that may cause some +known_false_positives: + Administrators may execute this command that may cause some false positive. Filter as needed. references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -- https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe + - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: The regedit app was executed with silet mode parameter to import .reg file + message: + The regedit app was executed with silet mode parameter to import .reg file on $dest$. risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Azorult + - Azorult asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index a75f59daff..575020a9a2 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -1,11 +1,12 @@ name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects modifications in the Windows registry +description: + The following analytic detects modifications in the Windows registry to suppress Windows Defender notifications. It leverages data from the Endpoint.Registry datamodel, specifically targeting changes to the "Notification_Suppress" registry value. This activity is significant because adversaries, including those deploying @@ -14,8 +15,9 @@ description: The following analytic detects modifications in the Windows registr detection, maintain persistence, and execute further malicious activities without alerting the user or security tools. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,52 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may +known_false_positives: + administrators may enable or disable this feature that may cause some false positive. references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp + - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: the registry for suppresing windows fdefender notification settings was + message: + the registry for suppresing windows fdefender notification settings was modified to disabled on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Azorult - - CISA AA23-347A + - Azorult + - CISA AA23-347A asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index 9634e06bbd..d08ffdf575 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry Tamper Protection id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Sysmon EventID 13 -description: The following analytic detects a suspicious modification to the Windows + - Sysmon EventID 13 +description: + The following analytic detects a suspicious modification to the Windows Defender Tamper Protection registry setting. It leverages data from the Endpoint datamodel, specifically targeting changes where the registry path is set to disable Tamper Protection. This activity is significant because disabling Tamper Protection @@ -15,7 +16,8 @@ description: The following analytic detects a suspicious modification to the Win potentially leading to reduced security on the system. If confirmed malicious, this could enable attackers to evade detection, persist in the environment, and execute further malicious activities without interference from Windows Defender. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection" AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,52 +25,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_tamper_protection_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may enable or disable this feature that may +known_false_positives: + Administrators may enable or disable this feature that may cause some false positive. references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A registry modification to tamper Windows Defender protection on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 12e03af7-79f9-4f95-af48-d3f12f28a260 mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml index 076a776081..2e443fed5a 100644 --- a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml +++ b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml @@ -1,73 +1,78 @@ name: Windows Modify Registry to Add or Modify Firewall Rule id: 43254751-e2ce-409a-b6b4-4f851e8dcc26 -version: 6 -date: '2024-12-08' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 -- Sysmon EventID 14 + - Sysmon EventID 13 + - Sysmon EventID 14 type: Anomaly status: production -description: The following analytic detects a potential addition or modification of +description: + The following analytic detects a potential addition or modification of firewall rules, signaling possible configuration changes or security policy adjustments. It tracks commands such as netsh advfirewall firewall add rule and netsh advfirewall firewall set rule, which may indicate attempts to alter network access controls. Monitoring these actions ensures the integrity of firewall settings and helps prevent unauthorized network access. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.action = modified by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_to_add_or_modify_firewall_rule_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: network admin may add/remove/modify public inbound firewall +known_false_positives: + network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. references: -- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: firewall deletion found in registry on $dest$ risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - ShrinkLocker - - CISA AA24-241A + - ShrinkLocker + - CISA AA24-241A asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml index dabe7abc87..d9f015b52c 100644 --- a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml +++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry UpdateServiceUrlAlternate id: ca4e94fb-7969-4d63-8630-3625809a1f70 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly data_source: -- Sysmon EventID 13 -description: The following analytic detects a suspicious modification to the Windows + - Sysmon EventID 13 +description: + The following analytic detects a suspicious modification to the Windows Update configuration registry key, specifically targeting the UpdateServiceUrlAlternate setting. It leverages data from the Endpoint.Registry datamodel to identify changes to this registry path. This activity is significant because adversaries, including @@ -15,57 +16,61 @@ description: The following analytic detects a suspicious modification to the Win additional payloads. If confirmed malicious, this modification could allow attackers to redirect update services, potentially leading to the execution of malicious code, further system compromise, and persistent evasion of security defenses. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\UpdateServiceUrlAlternate" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_updateserviceurlalternate_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may enable or disable this feature that may +known_false_positives: + Administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A registry modification in Windows auto update configuration on $dest$ risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml index ff68181b94..9129b422fd 100644 --- a/detections/endpoint/windows_modify_registry_usewuserver.yml +++ b/detections/endpoint/windows_modify_registry_usewuserver.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry USeWuServer id: c427bafb-0b2c-4b18-ad85-c03c6fed9e75 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Hunting data_source: -- Sysmon EventID 13 -description: The following analytic detects a suspicious modification to the Windows + - Sysmon EventID 13 +description: + The following analytic detects a suspicious modification to the Windows Update configuration registry key "UseWUServer." It leverages data from the Endpoint.Registry data model to identify changes where the registry value is set to "0x00000001." This activity is significant because it is commonly used by adversaries, including @@ -15,36 +16,39 @@ description: The following analytic detects a suspicious modification to the Win zero-day vulnerabilities. If confirmed malicious, this modification could allow attackers to evade defenses, persist on the target host, and deploy additional malicious payloads. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\UseWUServer" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_usewuserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: administrators may enable or disable this feature that may +known_false_positives: + administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_utilize_progids.yml b/detections/endpoint/windows_modify_registry_utilize_progids.yml index e555a5a77f..8cfc59d5df 100644 --- a/detections/endpoint/windows_modify_registry_utilize_progids.yml +++ b/detections/endpoint/windows_modify_registry_utilize_progids.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry Utilize ProgIDs id: 64fa82dd-fd11-472a-9e94-c221fffa591d -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: Anomaly status: production -description: The following analytic detects modifications to the Windows Registry +description: + The following analytic detects modifications to the Windows Registry specifically targeting Programmatic Identifier associations to bypass User Account Control (UAC) Windows OS feature. ValleyRAT may create or alter registry entries to targetted progIDs like `.pwn` files with malicious processes, allowing it to @@ -16,60 +17,63 @@ description: The following analytic detects modifications to the Windows Registr analysts to identify potential threats like ValleyRAT execution attempts. Early detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\ms-settings\\CurVer\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_utilize_progids_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers -- https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A possible ValleyRAT Registry modification in [$dest$]. risk_objects: - - field: user - type: user - score: 49 - - field: dest - type: system - score: 49 + - field: user + type: user + score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - ValleyRAT + - ValleyRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml index 5175b182e2..c210c9a573 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry ValleyRAT C2 Config id: ac59298a-8d81-4c02-8c9b-ffdac993891f -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: TTP status: production -description: "The following analytic detects modifications to theregistry related\ +description: + "The following analytic detects modifications to theregistry related\ \ to ValleyRAT C2 configuration. Specifically, it monitors changes in registry\ \ keys where ValleyRAT saves the IP address and port information of its command-and-control\ \ (C2) server. This activity is a key indicator of ValleyRAT attempting to establish\ @@ -16,7 +17,8 @@ description: "The following analytic detects modifications to theregistry relate \ and investigate the associated threats. Early detection of these changes helps\ \ prevent further exploitation and limits the malware\u2019s ability to exfiltrate\ \ data or control infected systems." -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Console\\IpDateInfo" AND Registry.registry_value_data="Binary Data") OR (Registry.registry_path= "*\\Console\\SelfPath" AND Registry.registry_value_data="*.exe") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -24,52 +26,54 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_c2_config_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A registry modification related to ValleyRAT on [$dest$] risk_objects: - - field: user - type: user - score: 90 - - field: dest - type: system - score: 90 + - field: user + type: user + score: 90 + - field: dest + type: system + score: 90 threat_objects: [] tags: analytic_story: - - ValleyRAT + - ValleyRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml index 913c572d24..88c4397f92 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry ValleyRat PWN Reg Entry id: 6947c44e-be1f-4dd9-b198-bc42be5be196 -version: 7 -date: '2024-12-16' +version: 8 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: TTP status: production -description: The following analytic detects modifications to the Windows Registry +description: + The following analytic detects modifications to the Windows Registry specifically targeting `.pwn` file associations related to the ValleyRAT malware. ValleyRAT may create or alter registry entries to associate `.pwn` files with malicious processes, allowing it to execute harmful scripts or commands when these files are @@ -15,59 +16,62 @@ description: The following analytic detects modifications to the Windows Registr this detection enables security analysts to identify potential ValleyRAT infection attempts. Early detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*.pwn\\Shell\\Open\\command" OR Registry.registry_value_data = ".pwn") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_pwn_reg_entry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A possible ValleyRAT Registry modification in [$dest$]. risk_objects: - - field: user - type: user - score: 90 - - field: dest - type: system - score: 90 + - field: user + type: user + score: 90 + - field: dest + type: system + score: 90 threat_objects: [] tags: analytic_story: - - ValleyRAT + - ValleyRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 02b792d50b..6f73c081c0 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry With MD5 Reg Key Name id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Sysmon EventID 13 -description: The following analytic detects potentially malicious registry modifications + - Sysmon EventID 13 +description: + The following analytic detects potentially malicious registry modifications characterized by MD5-like registry key names. It leverages the Endpoint data model to identify registry entries under the SOFTWARE path with 32-character hexadecimal names, a technique often used by NjRAT malware for fileless storage of keylogs and @@ -15,7 +16,8 @@ description: The following analytic detects potentially malicious registry modif or similar malware, which can lead to unauthorized data access and persistent threats within the environment. If confirmed malicious, attackers could maintain persistence and exfiltrate sensitive information. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path @@ -28,47 +30,49 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_with_md5_reg_key_name_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. known_false_positives: unknown references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A md5 registry value name $registry_value_name$ is created on $dest$ risk_objects: - - field: dest - type: system - score: 36 + - field: dest + type: system + score: 36 threat_objects: [] tags: analytic_story: - - NjRAT + - NjRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml index c28ee4daa0..08f8560fa5 100644 --- a/detections/endpoint/windows_modify_registry_wuserver.yml +++ b/detections/endpoint/windows_modify_registry_wuserver.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry WuServer id: a02ad386-e26d-44ce-aa97-6a46cee31439 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Hunting data_source: -- Sysmon EventID 13 -description: The following analytic detects suspicious modifications to the Windows + - Sysmon EventID 13 +description: + The following analytic detects suspicious modifications to the Windows Update Server (WUServer) registry settings. It leverages data from the Endpoint.Registry data model to identify changes in the registry path associated with Windows Update configurations. This activity is significant because adversaries, including malware @@ -15,36 +16,39 @@ description: The following analytic detects suspicious modifications to the Wind payloads. If confirmed malicious, this registry modification could allow attackers to evade defenses, potentially leading to further system compromise and persistent unauthorized access. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_wuserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may enable or disable this feature that may +known_false_positives: + Administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml index 4896a0a1b3..145fb004f7 100644 --- a/detections/endpoint/windows_modify_registry_wustatusserver.yml +++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry wuStatusServer id: 073e69d0-68b2-4142-aa90-a7ee6f590676 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Hunting data_source: -- Sysmon EventID 13 -description: The following analytic identifies suspicious modifications to the Windows + - Sysmon EventID 13 +description: + The following analytic identifies suspicious modifications to the Windows Update configuration registry, specifically targeting the WUStatusServer key. It leverages data from the Endpoint datamodel to detect changes in the registry path associated with Windows Update settings. This activity is significant as it is commonly @@ -15,36 +16,39 @@ description: The following analytic identifies suspicious modifications to the W and deploy additional payloads. If confirmed malicious, this modification could allow attackers to evade defenses, potentially leading to further system compromise and persistent unauthorized access. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUStatusServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_wustatusserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: administrators may enable or disable this feature that may +known_false_positives: + administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 35edca0366..9dd34be412 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -1,11 +1,12 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 9 -date: '2024-12-08' +version: 10 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects suspicious modifications to the Windows +description: + The following analytic detects suspicious modifications to the Windows registry keys related to file compression color and information tips. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "ShowCompColor" and "ShowInfoTip" values under the "Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" @@ -14,8 +15,9 @@ description: The following analytic detects suspicious modifications to the Wind elements. If confirmed malicious, this could signify an attempt to manipulate file visibility and deceive users, potentially aiding in further malicious activities. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path @@ -23,51 +25,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Data Destruction - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Hermetic Wiper + - Data Destruction + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - Hermetic Wiper asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml new file mode 100644 index 0000000000..bd514f9048 --- /dev/null +++ b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml @@ -0,0 +1,93 @@ +name: Windows MSC EvilTwin Directory Path Manipulation +id: 7f6b8a95-3fb7-429a-8c53-e5d4f8d92a10 +version: 3 +date: '2025-04-17' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects potential MSC EvilTwin loader exploitation, + which manipulates directory paths with spaces to bypass security controls. The technique, + described as CVE-2025-26633, involves crafting malicious MSC files that leverage + MUIPath parameter manipulation. This detection focuses on suspicious MSC file execution + patterns with unconventional command-line parameters, particularly those containing + unusual spaces in Windows System32 paths or suspicious additional parameters after + the MSC file. If confirmed malicious, this behavior could allow an attacker to execute + arbitrary code with elevated privileges through DLL side-loading or path traversal + techniques. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name="mmc.exe" + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_id Processes.process_name Processes.process_path Processes.action + Processes.original_file_name Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_integrity_level Processes.user_id Processes.vendor_product +| `drop_dm_object_name(Processes)` +| regex process="(?i).*mmc\.exe.*((Windows\s+\\\\System32)|(Windows\s+System32)|(\\\\Windows\s+\\\\System32)|(Program\s+Files\s+\\\\)|(Program\s+Files\s+\(\\w+\)\s+\\\\)|(Progra~1\s+\\\\))" +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_msc_eviltwin_directory_path_manipulation_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Some legitimate system maintenance tools might use MSC files + with unusual parameters. Filter for specific known maintenance activities in your + environment. +references: +- https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/ +- https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024 +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Process $process_name$ executed an MSC file with suspicious directory path + manipulation on $dest$ + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process +tags: + analytic_story: + - Water Gamayun + - Windows Defense Evasion Tactics + - Living Off The Land + asset_type: Endpoint + mitre_attack_id: + - T1218 + - T1036.005 + - T1203 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2025-26633 +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/eviltwin/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index ef0f7d86d6..0fef996e02 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -1,11 +1,12 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 version: 8 -date: '2025-04-17' +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the execution of msiexec.exe with the +description: + The following analytic detects the execution of msiexec.exe with the /y switch parameter, which enables the loading of DLLRegisterServer. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and parent-child process relationships. This activity is @@ -14,10 +15,11 @@ description: The following analytic detects the execution of msiexec.exe with th this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*/y*", "*-y*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -35,54 +38,58 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: This analytic will need to be tuned for your environment based +known_false_positives: + This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows System Binary Proxy Execution MSIExec + - Windows System Binary Proxy Execution MSIExec + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml index f6f623b5d3..adb2ad97a5 100644 --- a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml +++ b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml @@ -1,15 +1,16 @@ name: Windows MsiExec HideWindow Rundll32 Execution id: 9683271d-92e4-43b5-a907-1983bfb9f7fd version: 7 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -description: The following analytic detects the execution of the msiexec.exe process + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +description: + The following analytic detects the execution of the msiexec.exe process with the /HideWindow and rundll32 command-line parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant because it is a known tactic @@ -17,7 +18,8 @@ description: The following analytic detects the execution of the msiexec.exe pro processes. If confirmed malicious, this behavior could allow an attacker to download additional payloads, execute malicious code, or establish communication with remote servers, thereby evading detection and maintaining persistence. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = msiexec.exe Processes.process = "* /HideWindow *" Processes.process = "* rundll32*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_hidewindow_rundll32_execution_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,47 +39,51 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Other possible 3rd party msi software installers use this technique +known_false_positives: + Other possible 3rd party msi software installers use this technique as part of its installation process. references: -- https://twitter.com/Max_Mal_/status/1736392741758611607 -- https://twitter.com/1ZRR4H/status/1735944522075386332 + - https://twitter.com/Max_Mal_/status/1736392741758611607 + - https://twitter.com/1ZRR4H/status/1735944522075386332 drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: a msiexec parent process with /hidewindow rundll32 process commandline + message: + a msiexec parent process with /hidewindow rundll32 process commandline on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Qakbot + - Qakbot + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 75c56b6c9a..b1679fde89 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -1,11 +1,12 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda version: 8 -date: '2025-04-17' +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the use of msiexec.exe with an HTTP or +description: + The following analytic detects the use of msiexec.exe with an HTTP or HTTPS URL in the command line, indicating a remote file download attempt. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant as @@ -13,10 +14,11 @@ description: The following analytic detects the use of msiexec.exe with an HTTP from a remote server. If confirmed malicious, this could lead to unauthorized code execution, system compromise, or further malware deployment within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*http://*", "*https://*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid @@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -34,54 +37,58 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives may be present, filter by destination or parent +known_false_positives: + False positives may be present, filter by destination or parent process as needed. references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows System Binary Proxy Execution MSIExec + - Windows System Binary Proxy Execution MSIExec + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index 29762e518f..ef90b82190 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -1,11 +1,12 @@ name: Windows MSIExec Spawn Discovery Command id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee version: 9 -date: '2025-04-17' +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects MSIExec spawning multiple discovery commands, +description: + The following analytic detects MSIExec spawning multiple discovery commands, such as Cmd.exe or PowerShell.exe. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where MSIExec is the parent process. This activity is significant because MSIExec typically does @@ -14,10 +15,11 @@ description: The following analytic detects MSIExec spawning multiple discovery system information, potentially leading to further exploitation or lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe", "pwsh.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_spawn_discovery_command_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,56 +39,60 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives will be present with MSIExec spawning Cmd or +known_false_positives: + False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query. references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows System Binary Proxy Execution MSIExec - - Medusa Ransomware + - Windows System Binary Proxy Execution MSIExec + - Medusa Ransomware + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_inprocserver32_added.yml b/detections/endpoint/windows_new_inprocserver32_added.yml index ac2d4ce5ad..3f5d60bc3b 100644 --- a/detections/endpoint/windows_new_inprocserver32_added.yml +++ b/detections/endpoint/windows_new_inprocserver32_added.yml @@ -1,13 +1,14 @@ name: Windows New InProcServer32 Added id: 0fa86e31-0f73-4ec7-9ca3-dc88e117f1db -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Michael Haag, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: Hunting status: production -description: The following analytic detects the addition of new InProcServer32 registry +description: + The following analytic detects the addition of new InProcServer32 registry keys on Windows endpoints. It leverages data from the Endpoint.Registry datamodel to identify changes in registry paths associated with InProcServer32. This activity is significant because malware often uses this mechanism to achieve persistence @@ -15,35 +16,37 @@ description: The following analytic detects the addition of new InProcServer32 r harmful DLL. If confirmed malicious, this could allow an attacker to persist in the environment or execute arbitrary code, posing a significant threat to system integrity and security. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.dest Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_inprocserver32_added_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: False positives are expected. Filtering will be needed to properly +known_false_positives: + False positives are expected. Filtering will be needed to properly reduce legitimate applications from the results. references: -- https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/ + - https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/ tags: analytic_story: - - Outlook RCE CVE-2024-21378 + - Outlook RCE CVE-2024-21378 asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint cve: - - CVE-2024-21378 + - CVE-2024-21378 tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 5f04acee23..c492ae63e3 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -1,7 +1,7 @@ name: Windows Office Product Dropped Cab or Inf File id: dbdd251e-dd45-4ec9-a555-f5e151391746 -version: 3 -date: '2025-02-10' +version: 4 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP @@ -15,37 +15,21 @@ description: The following analytic detects Office products writing .cab or .inf data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_office_products` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.cab", "*.inf") by Filesystem.action Filesystem.dest - Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size - Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product - | `drop_dm_object_name(Filesystem)` | table action dest original_file_name parent_process - parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path - process process_exec process_guid process_hash process_id process_integrity_level - process_name process_path user user_id vendor_product file_access_time file_create_time - file_hash file_modify_time file_name file_path file_acl file_size firstTime lastTime - | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(file_access_time) as file_access_time values(file_create_time) - as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time - values(file_name) as file_name values(file_path) as file_path values(file_acl) as - file_acl values(file_size) as file_size by process_guid | where isnotnull(process) - AND isnotnull(file_name) | `windows_office_product_dropped_cab_or_inf_file_filter`' + where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time + dest file_create_time file_name file_path process_name process_path process proc_guid] + | dedup file_create_time | table dest, process_name, process, file_create_time, + file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index 82da6b59e2..9f178e97e1 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -1,7 +1,7 @@ name: Windows Office Product Dropped Uncommon File id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 -version: 3 -date: '2025-02-10' +version: 4 +date: '2025-04-22' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: production type: Anomaly @@ -15,37 +15,20 @@ description: The following analytic detects Microsoft Office applications droppi access, posing a severe threat to the environment. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", - "*.vbe", "*.vbs") by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_office_products` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name + IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", "*.vbe", "*.vbs") by _time + span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process process_guid] | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path, process_guid | `windows_office_product_dropped_uncommon_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index c45090b83e..44f6bbe726 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -1,13 +1,14 @@ name: Windows Outlook WebView Registry Modification id: 6e1ad5d4-d9af-496a-96ec-f31c11cd09f2 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-04-22' author: Michael Haag, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: Anomaly status: production -description: The following analytic identifies modifications to specific Outlook registry +description: + The following analytic identifies modifications to specific Outlook registry values related to WebView and Today features. It detects when a URL is set in these registry locations, which could indicate attempts to manipulate Outlook's web-based components. The analytic focuses on changes to the "URL" value within Outlook's @@ -16,7 +17,8 @@ description: The following analytic identifies modifications to specific Outlook If successful, this technique could lead to phishing attempts, data theft, or serve as a stepping stone for further compromise of the user's email client and potentially sensitive information. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_value_name) +search: + '| tstats `security_content_summariesonly` count values(Registry.registry_value_name) as registry_value_name values(Registry.registry_value_data) as registry_value_data min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path="*\\Software\\Microsoft\\Office\\*\\Outlook\\WebView\\*" @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_outlook_webview_registry_modification_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -35,47 +38,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives may occur if legitimate Outlook processes are +known_false_positives: + False positives may occur if legitimate Outlook processes are modified. references: -- https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 -- https://github.com/trustedsec/specula/wiki + - https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 + - https://github.com/trustedsec/specula/wiki drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Modification of Outlook WebView registry values on $dest$. risk_objects: - - field: dest - type: system - score: 100 + - field: dest + type: system + score: 100 threat_objects: [] tags: analytic_story: - - Suspicious Windows Registry Activities + - Suspicious Windows Registry Activities asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint cve: [] tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml index 685c811982..6540a39b8c 100644 --- a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml +++ b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml @@ -1,7 +1,7 @@ name: Windows Phishing Outlook Drop Dll In FORM Dir id: fca01769-5163-4b3a-ae44-de874adfc9bc -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 1 AND Sysmon EventID 11 @@ -14,38 +14,19 @@ description: The following analytic detects the creation of a DLL file by an out an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration. -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=outlook.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | join process_guid, _time [ | tstats `security_content_summariesonly` count min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name + ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" by _time + span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path + Filesystem.process_guid | `drop_dm_object_name(Filesystem)` | fields file_name file_path + process_name process_path process dest file_create_time _time process_guid] | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 42146b4c9a..810324ebeb 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -1,11 +1,12 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c version: 7 -date: '2025-04-17' +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Anomaly -description: The following analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` +description: + The following analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate @@ -13,57 +14,63 @@ description: The following analytic detects the use of the PowerShell cmdlet `ex malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network. data_source: -- Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*") + - Powershell Script Block Logging 4104 +search: + '`powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_export_pfxcertificate_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable +how_to_implement: + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, +known_false_positives: + It is possible administrators or scripts may run these commands, filtering may be required. references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj + - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A PowerShell Cmdlet related to exporting a PFX Certificate was ran on $dest$, + message: + A PowerShell Cmdlet related to exporting a PFX Certificate was ran on $dest$, attempting to export a certificate. risk_objects: - - field: dest - type: system - score: 36 + - field: dest + type: system + score: 36 threat_objects: [] tags: analytic_story: - - Windows Certificate Services + - Windows Certificate Services + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1552.004 - - T1649 + - T1552.004 + - T1649 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml new file mode 100644 index 0000000000..d7329ecd95 --- /dev/null +++ b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml @@ -0,0 +1,72 @@ +name: Windows PowerShell Invoke-RestMethod IP Information Collection +id: 8db47e12-9c3e-4f5a-b0d6-e42a1895cd4f +version: 1 +date: '2025-04-17' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of PowerShell's Invoke-RestMethod + cmdlet to collect geolocation data from ipinfo.io or IP address information from + api.ipify.org. This behavior leverages PowerShell Script Block Logging to identify + scripts that gather external IP information and potential geolocation data. This + activity is significant as it may indicate reconnaissance efforts, where threat + actors are attempting to determine the geographical location or network details + of a compromised system. While some legitimate software may use these services, + this pattern is commonly observed in malware and post-exploitation toolkits like + those used by Water Gamayun threat actors. +data_source: +- Powershell Script Block Logging 4104 +search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-RestMethod*" AND (ScriptBlockText="*ipinfo.io*" + OR ScriptBlockText="*api.ipify.org*")) | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powershell_invoke_restmethod_ip_information_collection_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Some legitimate applications or administrative scripts may + use these services for IP validation or geolocation. Filter as needed for approved + administrative tools. +references: +- https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/ +- https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024 +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A PowerShell script on $dest$ is collecting external IP or geolocation information using Invoke-RestMethod. + risk_objects: + - field: dest + type: system + score: 45 + threat_objects: [] +tags: + analytic_story: + - Water Gamayun + asset_type: Endpoint + mitre_attack_id: + - T1082 + - T1016 + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/irm_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 7436735e25..0fc96cd91b 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,11 +1,12 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 8 -date: '2025-04-17' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious remote thread execution in +description: + The following analytic detects suspicious remote thread execution in processes such as Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware like Qakbot. This detection leverages Sysmon EventCode 8 to identify remote thread creation in specific target processes. This activity is significant @@ -14,8 +15,9 @@ description: The following analytic detects suspicious remote thread execution i this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence on the compromised host. data_source: -- Sysmon EventID 8 -search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", + - Sysmon EventID 8 +search: + '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe","*\\cmd.exe", "*\\powershell.exe") | stats count min(_time) as firstTime max(_time) as lastTime @@ -25,55 +27,59 @@ search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", " parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_remote_thread_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data +how_to_implement: + To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of sysmon. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ + - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg + - https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: process $SourceImage$ create a remote thread to process $TargetImage$ on + message: + process $SourceImage$ create a remote thread to process $TargetImage$ on host $dest$ risk_objects: - - field: dest - type: system - score: 64 + - field: dest + type: system + score: 64 threat_objects: - - field: SourceImage - type: process + - field: SourceImage + type: process tags: analytic_story: - - Qakbot - - Graceful Wipe Out Attack - - Warzone RAT - - Earth Alux + - Qakbot + - Graceful Wipe Out Attack + - Warzone RAT + - Earth Alux + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1055.002 + - T1055.002 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml index 1858ef909e..9ed57c80d7 100644 --- a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml +++ b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml @@ -1,13 +1,14 @@ name: Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr id: feb43b86-8c38-46cd-865e-20ce8a96c26c version: 6 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Windows Event Log Security 4698 + - Windows Event Log Security 4698 type: TTP status: production -description: The following analytic detects the creation or modification of Windows +description: + The following analytic detects the creation or modification of Windows Scheduled Tasks related to CompMgmtLauncher or Eventvwr. These legitimate system utilities, used for launching the Computer Management Console and Event Viewer, can be abused by attackers to execute malicious payloads under the guise of normal @@ -15,55 +16,58 @@ description: The following analytic detects the creation or modification of Wind or elevate privileges without raising suspicion. This detection helps security analysts identify unusual or unauthorized scheduled tasks involving these executables, allowing for timely investigation and remediation of potential threats. -search: '`wineventlog_security` EventCode=4698 TaskContent = "*<Command>C:\\Windows\\System32\\CompMgmtLauncher.exe</Command>*" +search: + '`wineventlog_security` EventCode=4698 TaskContent = "*<Command>C:\\Windows\\System32\\CompMgmtLauncher.exe</Command>*" OR TaskContent = "*<Command>C:\\Windows\\System32\\zh-CN\\eventvwr.msc</Command>*" OR TaskContent = "*<Command>C:\\Windows\\System32\\eventvwr.msc</Command>*" | stats count min(_time) as firstTime max(_time) as lastTime by dest action EventData_Xml TaskContent TaskName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required. known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A schedule task created for CompMgmtLauncher or Eventvwr on [$dest$]. risk_objects: - - field: dest - type: system - score: 64 + - field: dest + type: system + score: 64 threat_objects: [] tags: analytic_story: - - ValleyRAT + - ValleyRAT + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1053 + - T1053 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/valleyrat_schedtask/valleyrat_schedtask.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/valleyrat_schedtask/valleyrat_schedtask.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index 08ac8a6d93..b95bc42c46 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -1,68 +1,74 @@ name: Windows Screen Capture Via Powershell id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170 version: 6 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Powershell Script Block Logging 4104 -description: The following analytic detects the execution of a PowerShell script designed + - Powershell Script Block Logging 4104 +description: + The following analytic detects the execution of a PowerShell script designed to capture screen images on a host. It leverages PowerShell Script Block Logging to identify specific script block text patterns associated with screen capture activities. This behavior is significant as it may indicate an attempt to exfiltrate sensitive information by capturing desktop screenshots. If confirmed malicious, this activity could allow an attacker to gather visual data from the compromised system, potentially leading to data breaches or further exploitation. -search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" +search: + '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" AND ScriptBlockText = "*.CopyFromScreen*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_screen_capture_via_powershell_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable +how_to_implement: + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: unknown references: -- https://twitter.com/_CERT_UA/status/1620781684257091584 -- https://cert.gov.ua/article/3761104 + - https://twitter.com/_CERT_UA/status/1620781684257091584 + - https://cert.gov.ua/article/3761104 drilldown_searches: -- name: View the detection results for - "$Computer$" - search: '%original_detection_search% | search Computer = "$Computer$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$Computer$" + search: '%original_detection_search% | search Computer = "$Computer$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$Computer$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A PowerShell script was identified possibly performing screen captures + message: + A PowerShell script was identified possibly performing screen captures on $dest$. risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Winter Vivern + - Winter Vivern + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1113 + - T1113 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index 6845aae0ae..16554fffee 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -1,13 +1,14 @@ name: Windows Snake Malware Registry Modification wav OpenWithProgIds id: 13cf8b79-805d-443c-bf52-f55bd7610dfd -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP data_source: -- Sysmon EventID 13 -description: The following analytic identifies modifications to the registry path + - Sysmon EventID 13 +description: + The following analytic identifies modifications to the registry path .wav\\OpenWithProgIds, associated with the Snake Malware campaign. It leverages data from the Endpoint.Registry datamodel to detect changes in this specific registry location. This activity is significant because Snake's WerFault.exe uses this registry @@ -15,7 +16,8 @@ description: The following analytic identifies modifications to the registry pat IV, and paths for its kernel driver and loader. If confirmed malicious, this could allow the attacker to load and execute Snake's kernel driver, leading to potential system compromise and persistent access. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) +search: + '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,53 +25,57 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_snake_malware_registry_modification_wav_openwithprogids_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present and will require tuning based +known_false_positives: + False positives may be present and will require tuning based on program Ids in large organizations. references: -- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A registry modification related to Snake Malware has been identified on + message: + A registry modification related to Snake Malware has been identified on $dest$. risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Snake Malware + - Snake Malware asset_type: Endpoint atomic_guid: - - 8318ad20-0488-4a64-98f4-72525a012f6b + - 8318ad20-0488-4a64-98f4-72525a012f6b mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snappybee_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml index 98f2114f7b..8e846bdee3 100644 --- a/detections/endpoint/windows_snappybee_create_test_registry.yml +++ b/detections/endpoint/windows_snappybee_create_test_registry.yml @@ -1,11 +1,12 @@ name: Windows SnappyBee Create Test Registry id: 80402396-d78a-4c6e-ade5-7697ea670adf -version: 2 -date: '2025-03-27' +version: 3 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects modifications to the Windows registry +description: + The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration @@ -15,62 +16,66 @@ description: The following analytic detects modifications to the Windows registr or suspicious command-line activity, as they may indicate malware or unauthorized software behavior. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snappybee_create_test_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators and third party software may create this registry +known_false_positives: + Administrators and third party software may create this registry entry. references: -- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html + - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: a Test registry Entry [$registry_path$] was created on [$dest$]. risk_objects: - - field: dest - type: system - score: 60 - - field: user - type: user - score: 60 + - field: dest + type: system + score: 60 + - field: user + type: user + score: 60 threat_objects: [] tags: analytic_story: - - Salt Typhoon - - China-Nexus Threat Activity - - SnappyBee + - Salt Typhoon + - China-Nexus Threat Activity + - SnappyBee asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/test_registry/test_reg.log - sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - source: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/test_registry/test_reg.log + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog diff --git a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml index 697fd098ba..4134c35c89 100644 --- a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml +++ b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml @@ -1,7 +1,7 @@ name: Windows SqlWriter SQLDumper DLL Sideload id: 2ed89ba9-c6c7-46aa-9f08-a2a1c2955aa3 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Michael Haag, Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -69,7 +69,7 @@ tags: - Midnight Blizzard asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 97b89a0ef2..3427585121 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,11 +1,12 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 11 -date: '2025-04-17' +version: 10 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic identifies processes running from file paths not +description: + The following analytic identifies processes running from file paths not typically associated with legitimate software. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional @@ -14,10 +15,11 @@ description: The following analytic identifies processes running from file paths controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", @@ -31,7 +33,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_process_file_path_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -40,91 +43,95 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators may allow execution of specific binaries in +known_false_positives: + Administrators may allow execution of specific binaries in non-standard paths. Filter as needed. references: -- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://twitter.com/pr0xylife/status/1590394227758104576 -- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ + - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://twitter.com/pr0xylife/status/1590394227758104576 + - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat + - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: Suspicious process $process_name$ running from a suspicious process path- + message: + Suspicious process $process_name$ running from a suspicious process path- $process_path$ on host- $dest$ risk_objects: - - field: dest - type: system - score: 60 + - field: dest + type: system + score: 60 threat_objects: - - field: process_path - type: process_name + - field: process_path + type: process_name tags: analytic_story: - - SystemBC - - China-Nexus Threat Activity - - Remcos - - LockBit Ransomware - - AsyncRAT - - DarkCrystal RAT - - DarkGate Malware - - ValleyRAT - - PlugX - - Data Destruction - - Qakbot - - CISA AA23-347A - - Hermetic Wiper - - Volt Typhoon - - Double Zero Destructor - - AgentTesla - - Trickbot - - Meduza Stealer - - Phemedrone Stealer - - SnappyBee - - Azorult - - WhisperGate - - Warzone RAT - - Swift Slicer - - Rhysida Ransomware - - Brute Ratel C4 - - Prestige Ransomware - - BlackByte Ransomware - - Graceful Wipe Out Attack - - Chaos Ransomware - - Handala Wiper - - RedLine Stealer - - Salt Typhoon - - XMRig - - MoonPeak - - Industroyer2 - - Amadey - - IcedID - - Earth Alux + - SystemBC + - China-Nexus Threat Activity + - Remcos + - LockBit Ransomware + - AsyncRAT + - DarkCrystal RAT + - DarkGate Malware + - ValleyRAT + - PlugX + - Data Destruction + - Qakbot + - CISA AA23-347A + - Hermetic Wiper + - Volt Typhoon + - Double Zero Destructor + - AgentTesla + - Trickbot + - Meduza Stealer + - Phemedrone Stealer + - SnappyBee + - Azorult + - WhisperGate + - Warzone RAT + - Swift Slicer + - Rhysida Ransomware + - Brute Ratel C4 + - Prestige Ransomware + - BlackByte Ransomware + - Graceful Wipe Out Attack + - Chaos Ransomware + - Handala Wiper + - RedLine Stealer + - Salt Typhoon + - XMRig + - MoonPeak + - Industroyer2 + - Amadey + - IcedID + - Earth Alux + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1543 - - T1036.005 + - T1543 + - T1036.005 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml index 768101c92b..0139f2d364 100644 --- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml +++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml @@ -1,11 +1,12 @@ name: Windows System Network Config Discovery Display DNS id: e24f0a0e-41a9-419f-9999-eacab15efc36 version: 6 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies the execution of the "ipconfig /displaydns" +description: + The following analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. Monitoring this activity is significant @@ -14,10 +15,11 @@ description: The following analytic identifies the execution of the "ipconfig /d attackers to map the network, identify DNS servers, and potentially facilitate further network-based attacks or lateral movement. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="ipconfig.exe" OR Processes.original_file_name = "ipconfig.exe" AND Processes.process = "*/displaydns*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_network_config_discovery_display_dns_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -38,46 +41,48 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns + - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS + - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: process $process_name$ with commandline $process$ is executed on $dest$ risk_objects: - - field: dest - type: system - score: 9 + - field: dest + type: system + score: 9 threat_objects: [] tags: analytic_story: - - Medusa Ransomware - - Windows Post-Exploitation - - Prestige Ransomware + - Medusa Ransomware + - Windows Post-Exploitation + - Prestige Ransomware + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1016 + - T1016 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index b3ae428b7c..b1b8bec02f 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,13 +1,14 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 version: 10 -date: '2025-04-16' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly data_source: -- Sysmon EventID 7 -description: The following analytic detects the creation of potentially malicious + - Sysmon EventID 7 +description: + The following analytic detects the creation of potentially malicious unsigned DLLs in the c:\windows\system32 or c:\windows\syswow64 folders. It leverages Sysmon EventCode 7 logs to identify unsigned DLLs with unavailable signatures loaded in these critical directories. This activity is significant as it may indicate a @@ -15,61 +16,65 @@ description: The following analytic detects the creation of potentially maliciou and execute malicious code. If confirmed malicious, this could lead to privilege escalation, allowing the attacker to gain elevated privileges and further compromise the target system. -search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" +search: + '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: It is possible some Administrative utilities will load dismcore.dll +known_false_positives: + It is possible some Administrative utilities will load dismcore.dll outside of normal system paths, filter as needed. references: -- https://asec.ahnlab.com/en/17692/ -- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. + - https://asec.ahnlab.com/en/17692/ + - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: An unsigned dll module was loaded on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - - Derusbi - - Warzone RAT - - Salt Typhoon - - NjRAT - - Earth Alux + - China-Nexus Threat Activity + - Derusbi + - Warzone RAT + - Salt Typhoon + - NjRAT + - Earth Alux asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index 9c4a6abc6d..07254d28cd 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 9 -date: '2025-02-26' +version: 10 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -64,7 +64,7 @@ tags: - DarkGate Malware asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 92d7b4b682..acc502e342 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,13 +1,14 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c version: 10 -date: '2025-04-16' +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 7 + - Sysmon EventID 7 type: Anomaly status: production -description: The following analytic identifies potential DLL side-loading instances +description: + The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. It detects this activity by analyzing Sysmon logs for Event Code 7, where both the `Image` and `ImageLoaded` paths do not match system directories like `system32`, `syswow64`, and `programfiles`. @@ -15,7 +16,8 @@ description: The following analytic identifies potential DLL side-loading instan malicious code via legitimate processes. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to privilege escalation, persistence, and unauthorized access to sensitive information. -search: '`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false SignatureStatus +search: + '`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false SignatureStatus != Valid NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) NOT (ImageLoaded IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) | rex field=Image "(?.+\\\)" | rex field=ImageLoaded @@ -25,68 +27,71 @@ search: '`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false Signa process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_ms_dll_side_loading_filter`' -how_to_implement: The analytic is designed to be run against Sysmon event logs collected +how_to_implement: + The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into Splunk. The analytic searches for EventCode 7 where the Image is either SQLDumper.exe or SQLWriter.exe and the ImageLoaded is vcruntime140.dll. The search also filters out the legitimate loading of vcruntime140.dll from the System32 directory to reduce false positives. The analytic can be modified to include additional known good paths for vcruntime140.dll to further reduce false positives. -known_false_positives: False positives are possible if legitimate processes are loading +known_false_positives: + False positives are possible if legitimate processes are loading vcruntime140.dll from non-standard directories. It is recommended to investigate the context of the process loading vcruntime140.dll to determine if it is malicious or not. Modify the search to include additional known good paths for vcruntime140.dll to reduce false positives. references: -- https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties -- https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader + - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties + - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: An instance of $Image$ loading Unsigned $ImageLoaded$ was detected on $dest$. risk_objects: - - field: dest - type: system - score: 9 + - field: dest + type: system + score: 9 threat_objects: - - field: Image - type: file_name + - field: Image + type: file_name tags: analytic_story: - - China-Nexus Threat Activity - - Derusbi - - Salt Typhoon - - APT29 Diplomatic Deceptions with WINELOADER - - Earth Alux + - China-Nexus Threat Activity + - Derusbi + - Salt Typhoon + - APT29 Diplomatic Deceptions with WINELOADER + - Earth Alux group: - - APT29 - - Cozy Bear - - Midnight Blizzard + - APT29 + - Cozy Bear + - Midnight Blizzard asset_type: Endpoint mitre_attack_id: - - T1574.002 - - T1547 + - T1574.001 + - T1547 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint cve: [] tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index 0db48f3747..1aba5bb21d 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -1,7 +1,7 @@ name: Windows WinLogon with Public Network Connection id: 65615b3a-62ea-4d65-bb9f-6f07c17df4ea -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: experimental type: Hunting @@ -15,38 +15,20 @@ description: The following analytic detects instances of Winlogon.exe, a critica bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level. -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN (winlogon.exe) Processes.process!=unknown by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN (winlogon.exe) Processes.process!=unknown + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 NOT (All_Traffic.dest IN (127.0.0.1,10.0.0.0/8,172.16.0.0/12, - 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_winlogon_with_public_network_connection_filter`' + 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as publicIp ] | table dest parent_process_name + process_name process_path process process_id dest_port publicIp | `windows_winlogon_with_public_network_connection_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 6ef56654e6..57fa9e531c 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -1,11 +1,12 @@ name: Windows WMI Impersonate Token id: cf192860-2d94-40db-9a51-c04a2e8a8f8b version: 6 -date: '2025-04-17' +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects potential WMI token impersonation activities +description: + The following analytic detects potential WMI token impersonation activities in a process or command. It leverages Sysmon EventCode 10 to identify instances where `wmiprvse.exe` has a duplicate handle or full granted access in a target process. This behavior is significant as it is commonly used by malware like Qakbot for privilege @@ -13,8 +14,9 @@ description: The following analytic detects potential WMI token impersonation ac an attacker to gain elevated privileges, evade defenses, and maintain persistence within the environment. data_source: -- Sysmon EventID 10 -search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", + - Sysmon EventID 10 +search: + '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access @@ -22,53 +24,58 @@ search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_impersonate_token_filter`' -how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which +how_to_implement: + This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -known_false_positives: administrator may execute impersonate wmi object script for +known_false_positives: + administrator may execute impersonate wmi object script for auditing. Filter is needed. references: -- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md -- https://www.joesandbox.com/analysis/278341/0/html + - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md + - https://www.joesandbox.com/analysis/278341/0/html drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ + message: + wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ to $TargetImage$ process on $dest$ risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Qakbot + - Qakbot + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1047 + - T1047 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index bb82868eb8..7cd8050eb2 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -51,9 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: > - Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections - [ListingReason: $reasons$] + message: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src_ip$ risk_objects: - field: src_ip type: system diff --git a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml index 493e713d1a..cd1550c640 100644 --- a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml +++ b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml @@ -48,6 +48,7 @@ tags: - Splunk Enterprise - Splunk Cloud - Splunk Enterprise Security + manual_test: This detection is a hunting search that has the fixed time range of 7 days baked into the search. Hence based on the time range of the data in the logs, the detection may or may not return results with TriggerCount = 1 in testing. tests: - name: True Positive Test attack_data: diff --git a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml index 3cb3a1a986..8f4c5b6208 100644 --- a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -1,7 +1,7 @@ name: Windows Gather Victim Network Info Through Ip Check Web Services id: 70f7c952-0758-46d6-9148-d8969c4481d1 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -40,6 +40,7 @@ tags: - Handala Wiper - PXA Stealer - Meduza Stealer + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1590.005 diff --git a/stories/water_gamayun.yml b/stories/water_gamayun.yml new file mode 100644 index 0000000000..cfec26d98e --- /dev/null +++ b/stories/water_gamayun.yml @@ -0,0 +1,29 @@ +name: Water Gamayun +id: f3a9e8b6-7d21-42c5-9f6b-e4f8d1c936ea +version: 1 +date: '2025-04-17' +author: Michael Haag, Splunk +status: production +description: This analytic story contains detections for techniques used by the Water Gamayun threat actor, which targets telecommunications and financial sectors. The group employs various techniques including MSC EvilTwin exploitation, custom backdoors, information stealers, and sophisticated reconnaissance methods. +narrative: | + Water Gamayun is a threat actor that has been active since at least late 2023. They target organizations primarily in the telecommunications and financial sectors through a combination of sophisticated techniques and custom malware. Their initial access vectors include signed MSI files, Living Off The Land Binaries and Scripts (LOLBAS), and exploitation of MSC vulnerability (dubbed "EvilTwin") which manipulates directory paths with spaces to bypass security controls. + + The actor's toolkit includes several custom components: + - SilentPrism: A backdoor for command and control + - DarkWisp: A backdoor with TCP communication capabilities + - EncryptHub: An information stealer targeting credentials and system information + + The group is notable for their use of Telegram as a command and control channel, the exploitation of the MSC EvilTwin technique (CVE-2025-26633), and detailed reconnaissance of victim systems including geolocation data collection. + + Defensive recommendations include implementing application control policies, monitoring for unusual PowerShell activities and MSC file executions with abnormal command-line parameters, and securing administrative tools that could be abused by attackers. +references: + - https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/ + - https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024 +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file