From e91314333975217ce7334594091202bec4164c2c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 17 Apr 2025 11:26:37 -0600 Subject: [PATCH 01/21] Water Gamayun --- .../download_files_using_telegram.yml | 5 +- ...erate_users_local_group_using_telegram.yml | 8 +- ...wmiobject_user_account_with_powershell.yml | 5 +- .../endpoint/lolbas_with_network_traffic.yml | 5 +- .../mmc_lolbas_execution_process_spawn.yml | 5 +- ...l_telegram_api_request_via_commandline.yml | 5 +- .../endpoint/powershell_4104_hunting.yml | 5 +- .../powershell_creating_thread_mutex.yml | 5 +- .../endpoint/suspicious_copy_on_system32.yml | 5 +- ...s_process_executed_from_container_file.yml | 5 +- ..._tool_execution_from_non_shell_process.yml | 5 +- ...ltration_over_c2_via_invoke_restmethod.yml | 5 +- ...ttp_network_communication_from_msiexec.yml | 5 +- ...s_known_graphicalproton_loaded_modules.yml | 5 +- ...indows_lolbas_executed_as_renamed_file.yml | 5 +- ...masquerading_explorer_as_child_process.yml | 5 +- ...c_eviltwin_directory_path_manipulation.yml | 90 +++++++++++++++++++ .../windows_msiexec_dllregisterserver.yml | 5 +- ..._msiexec_hidewindow_rundll32_execution.yml | 5 +- .../windows_msiexec_remote_download.yml | 5 +- ...indows_msiexec_spawn_discovery_command.yml | 5 +- ...ndows_powershell_export_pfxcertificate.yml | 5 +- ...indows_process_injection_remote_thread.yml | 5 +- ...tasks_for_compmgmtlauncher_or_eventvwr.yml | 8 +- .../windows_screen_capture_via_powershell.yml | 5 +- .../windows_suspicious_process_file_path.yml | 5 +- ...m_network_config_discovery_display_dns.yml | 5 +- .../windows_wmi_impersonate_token.yml | 5 +- ...ork_info_through_ip_check_web_services.yml | 5 +- stories/water_gamayun.yml | 29 ++++++ 30 files changed, 205 insertions(+), 60 deletions(-) create mode 100644 detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml create mode 100644 stories/water_gamayun.yml diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 2339006e50..03b75109d8 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,7 +1,7 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -55,6 +55,7 @@ tags: - Crypto Stealer - Snake Keylogger - XMRig + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index a597067625..684adacb56 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -1,7 +1,7 @@ name: Enumerate Users Local Group Using Telegram id: fcd74532-ae54-11eb-a5ab-acde48001122 -version: 7 -date: '2024-12-10' +version: 9 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -55,6 +55,7 @@ tags: analytic_story: - XMRig - Compromised Windows Host + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1087 @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 43b5652cfd..151ead9d47 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -1,7 +1,7 @@ name: GetWmiObject User Account with PowerShell id: b44f6ac6-0429-11ec-87e9-acde48001122 -version: 6 -date: '2025-02-10' +version: 8 +date: '2025-04-17' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -44,6 +44,7 @@ tags: analytic_story: - Winter Vivern - Active Directory Discovery + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1087.001 diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/endpoint/lolbas_with_network_traffic.yml index 6531760b46..e1372606ea 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/endpoint/lolbas_with_network_traffic.yml @@ -1,7 +1,7 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 -version: 7 -date: '2024-12-16' +version: 9 +date: '2025-04-17' author: Steven Dick status: production type: TTP @@ -71,6 +71,7 @@ rba: tags: analytic_story: - Living Off The Land + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml index 14fff15957..2398e5b455 100644 --- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml @@ -1,7 +1,7 @@ name: Mmc LOLBAS Execution Process Spawn id: f6601940-4c74-11ec-b9b7-3e22fbd008af -version: 6 -date: '2025-02-10' +version: 8 +date: '2025-04-17' author: Mauricio Velazco, Splunk status: production type: TTP @@ -77,6 +77,7 @@ tags: analytic_story: - Active Directory Lateral Movement - Living Off The Land + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1021.003 diff --git a/detections/endpoint/potential_telegram_api_request_via_commandline.yml b/detections/endpoint/potential_telegram_api_request_via_commandline.yml index 0d6b406512..d6b3e73520 100644 --- a/detections/endpoint/potential_telegram_api_request_via_commandline.yml +++ b/detections/endpoint/potential_telegram_api_request_via_commandline.yml @@ -1,7 +1,7 @@ name: Potential Telegram API Request Via CommandLine id: d6b0d627-d0bf-46b1-936f-c48284767d21 -version: 2 -date: '2025-02-19' +version: 4 +date: '2025-04-17' author: Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa status: production type: Anomaly @@ -69,6 +69,7 @@ rba: tags: analytic_story: - XMRig + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1102.002 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 292eb93fbf..eefabda86c 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: '14' -date: '2025-03-14' +version: 16 +date: '2025-04-17' author: Michael Haag, Splunk status: production type: Hunting @@ -76,6 +76,7 @@ tags: - Salt Typhoon - SystemBC - PHP-CGI RCE Attack on Japanese Organizations + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 7525e4cb2e..e8f0fd28c6 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -1,7 +1,7 @@ name: Powershell Creating Thread Mutex id: 637557ec-ca08-11eb-bd0a-acde48001122 -version: 8 -date: '2025-02-10' +version: 10 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,6 +57,7 @@ rba: tags: analytic_story: - Malicious PowerShell + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1027.005 diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 744ffbb470..433ca7743f 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -1,7 +1,7 @@ name: Suspicious Copy on System32 id: ce633e56-25b2-11ec-9e76-acde48001122 -version: 8 -date: '2025-03-27' +version: 10 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -76,6 +76,7 @@ tags: - AsyncRAT - Unusual Processes - Compromised Windows Host + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1036.003 diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 8be239d567..0617392f9a 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -1,7 +1,7 @@ name: Suspicious Process Executed From Container File id: d8120352-3b62-411c-8cb6-7b47584dd5e8 -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-04-17' author: Steven Dick status: production type: TTP @@ -74,6 +74,7 @@ tags: - Amadey - Remcos - Snake Keylogger + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1204.002 diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index 421c95c75c..75e7111e99 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -1,7 +1,7 @@ name: Windows Cmdline Tool Execution From Non-Shell Process id: 2afa393f-b88d-41b7-9793-623c93a2dfde -version: '4' -date: '2025-03-14' +version: 6 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -85,6 +85,7 @@ tags: - Rhysida Ransomware - Volt Typhoon - FIN7 + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1059.007 diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml index e0d85eea50..a678768d1e 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -1,7 +1,7 @@ name: Windows Exfiltration Over C2 Via Invoke RestMethod id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -53,6 +53,7 @@ rba: tags: analytic_story: - Winter Vivern + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1041 diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 28adb5c2ad..4581f37ed2 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -1,7 +1,7 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 -version: 3 -date: '2025-01-17' +version: 5 +date: '2025-04-17' author: Michael Haag, Splunk status: production type: Anomaly @@ -91,6 +91,7 @@ rba: tags: analytic_story: - Windows System Binary Proxy Execution MSIExec + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1218.007 diff --git a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml index 4f8a90ade3..cfa5dc8e06 100644 --- a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml +++ b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml @@ -1,7 +1,7 @@ name: Windows Known GraphicalProton Loaded Modules id: bf471c94-0324-4b19-a113-d02749b969bc -version: 6 -date: '2025-02-10' +version: 8 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ rba: tags: analytic_story: - CISA AA23-347A + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1574.002 diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml index fcabe7e43b..6f2bea0ee9 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml @@ -1,7 +1,7 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 -version: 5 -date: '2025-02-10' +version: 7 +date: '2025-04-17' author: Steven Dick status: production type: TTP @@ -76,6 +76,7 @@ tags: - Living Off The Land - Masquerading - Rename System Utilities - Windows Defense Evasion Tactics + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1036.003 diff --git a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml index 768a42d7e8..93c85976ab 100644 --- a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml +++ b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml @@ -1,7 +1,7 @@ name: Windows Masquerading Explorer As Child Process id: 61490da9-52a1-4855-a0c5-28233c88c481 -version: 7 -date: '2025-02-10' +version: 9 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -65,6 +65,7 @@ tags: analytic_story: - Qakbot - Compromised Windows Host + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1574.002 diff --git a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml new file mode 100644 index 0000000000..f3de0c4e9c --- /dev/null +++ b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml @@ -0,0 +1,90 @@ +name: Windows MSC EvilTwin Directory Path Manipulation +id: 7f6b8a95-3fb7-429a-8c53-e5d4f8d92a10 +version: 3 +date: '2025-04-17' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects potential MSC EvilTwin loader exploitation, + which manipulates directory paths with spaces to bypass security controls. The technique, + described as CVE-2025-26633, involves crafting malicious MSC files that leverage + MUIPath parameter manipulation. This detection focuses on suspicious MSC file execution + patterns with unconventional command-line parameters, particularly those containing + unusual spaces in Windows System32 paths or suspicious additional parameters after + the MSC file. If confirmed malicious, this behavior could allow an attacker to execute + arbitrary code with elevated privileges through DLL side-loading or path traversal + techniques. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name="mmc.exe" + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_id Processes.process_name Processes.process_path +| `drop_dm_object_name(Processes)` +| regex process="(?i).*mmc\.exe.*((Windows\s+\\\\System32)|(Windows\s+System32)|(\\\\Windows\s+\\\\System32)|(Program\s+Files\s+\\\\)|(Program\s+Files\s+\(\\w+\)\s+\\\\)|(Progra~1\s+\\\\))" +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_msc_eviltwin_directory_path_manipulation_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Some legitimate system maintenance tools might use MSC files + with unusual parameters. Filter for specific known maintenance activities in your + environment. +references: +- https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/ +- https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024 +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Process $process_name$ executed an MSC file with suspicious directory path + manipulation on $dest$ + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process +tags: + analytic_story: + - Water Gamayun + - Windows Defense Evasion Tactics + - Living Off The Land + asset_type: Endpoint + mitre_attack_id: + - T1218 + - T1036.005 + - T1203 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2025-26633 +tests: +- name: True Positive Test + attack_data: + - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/eviltwin/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 4cafa5c6fe..5560dc4fa8 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -1,7 +1,7 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 -version: 7 -date: '2024-11-13' +version: 9 +date: '2025-04-17' author: Michael Haag, Splunk status: production type: TTP @@ -72,6 +72,7 @@ rba: tags: analytic_story: - Windows System Binary Proxy Execution MSIExec + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1218.007 diff --git a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml index 2225347c56..ade8a5d6e3 100644 --- a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml +++ b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml @@ -1,7 +1,7 @@ name: Windows MsiExec HideWindow Rundll32 Execution id: 9683271d-92e4-43b5-a907-1983bfb9f7fd -version: 6 -date: '2025-02-10' +version: 8 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -66,6 +66,7 @@ rba: tags: analytic_story: - Qakbot + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1218.007 diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 1fe02fc074..0993062cb7 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -1,7 +1,7 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda -version: 7 -date: '2024-11-13' +version: 9 +date: '2025-04-17' author: Michael Haag, Splunk status: production type: TTP @@ -71,6 +71,7 @@ rba: tags: analytic_story: - Windows System Binary Proxy Execution MSIExec + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1218.007 diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index af2a01403c..1edf4fac8b 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -1,7 +1,7 @@ name: Windows MSIExec Spawn Discovery Command id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee -version: '8' -date: '2025-03-14' +version: 10 +date: '2025-04-17' author: Michael Haag, Splunk status: production type: TTP @@ -75,6 +75,7 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec - Medusa Ransomware + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1218.007 diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 6179990490..a522ea3a70 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -1,7 +1,7 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c -version: 6 -date: '2025-02-10' +version: 8 +date: '2025-04-17' author: Michael Haag, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ rba: tags: analytic_story: - Windows Certificate Services + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1552.004 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 7c699fb26a..f534a2c2dc 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,7 +1,7 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 7 -date: '2025-04-16' +version: 9 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -63,6 +63,7 @@ tags: - Graceful Wipe Out Attack - Warzone RAT - Earth Alux + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml index cd15c57320..e07cecb37e 100644 --- a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml +++ b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml @@ -1,7 +1,7 @@ name: Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr id: feb43b86-8c38-46cd-865e-20ce8a96c26c -version: 5 -date: '2025-02-17' +version: 7 +date: '2025-04-17' author: Teoderick Contreras, Splunk data_source: - Windows Event Log Security 4698 @@ -52,6 +52,7 @@ rba: tags: analytic_story: - ValleyRAT + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1053 @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/valleyrat_schedtask/valleyrat_schedtask.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/valleyrat_schedtask/valleyrat_schedtask.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index c3721610d7..28d0c0adc6 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -1,7 +1,7 @@ name: Windows Screen Capture Via Powershell id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170 -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -52,6 +52,7 @@ rba: tags: analytic_story: - Winter Vivern + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1113 diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index a06dab01dd..a9a96d5faa 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 10 -date: '2025-04-16' +version: 12 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -113,6 +113,7 @@ tags: - Amadey - IcedID - Earth Alux + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml index f440f5919e..fcec63ad77 100644 --- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml +++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml @@ -1,7 +1,7 @@ name: Windows System Network Config Discovery Display DNS id: e24f0a0e-41a9-419f-9999-eacab15efc36 -version: '5' -date: '2025-03-14' +version: 7 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -67,6 +67,7 @@ tags: - Medusa Ransomware - Windows Post-Exploitation - Prestige Ransomware + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1016 diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 32dca81048..3e4d5f14a9 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -1,7 +1,7 @@ name: Windows WMI Impersonate Token id: cf192860-2d94-40db-9a51-c04a2e8a8f8b -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ rba: tags: analytic_story: - Qakbot + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1047 diff --git a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml index 3cb3a1a986..8f4c5b6208 100644 --- a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -1,7 +1,7 @@ name: Windows Gather Victim Network Info Through Ip Check Web Services id: 70f7c952-0758-46d6-9148-d8969c4481d1 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-04-17' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -40,6 +40,7 @@ tags: - Handala Wiper - PXA Stealer - Meduza Stealer + - Water Gamayun asset_type: Endpoint mitre_attack_id: - T1590.005 diff --git a/stories/water_gamayun.yml b/stories/water_gamayun.yml new file mode 100644 index 0000000000..cfec26d98e --- /dev/null +++ b/stories/water_gamayun.yml @@ -0,0 +1,29 @@ +name: Water Gamayun +id: f3a9e8b6-7d21-42c5-9f6b-e4f8d1c936ea +version: 1 +date: '2025-04-17' +author: Michael Haag, Splunk +status: production +description: This analytic story contains detections for techniques used by the Water Gamayun threat actor, which targets telecommunications and financial sectors. The group employs various techniques including MSC EvilTwin exploitation, custom backdoors, information stealers, and sophisticated reconnaissance methods. +narrative: | + Water Gamayun is a threat actor that has been active since at least late 2023. They target organizations primarily in the telecommunications and financial sectors through a combination of sophisticated techniques and custom malware. Their initial access vectors include signed MSI files, Living Off The Land Binaries and Scripts (LOLBAS), and exploitation of MSC vulnerability (dubbed "EvilTwin") which manipulates directory paths with spaces to bypass security controls. + + The actor's toolkit includes several custom components: + - SilentPrism: A backdoor for command and control + - DarkWisp: A backdoor with TCP communication capabilities + - EncryptHub: An information stealer targeting credentials and system information + + The group is notable for their use of Telegram as a command and control channel, the exploitation of the MSC EvilTwin technique (CVE-2025-26633), and detailed reconnaissance of victim systems including geolocation data collection. + + Defensive recommendations include implementing application control policies, monitoring for unusual PowerShell activities and MSC file executions with abnormal command-line parameters, and securing administrative tools that could be abused by attackers. +references: + - https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/ + - https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024 +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From d868a62c2381de0ebeb743f405c2041d8c858a2d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 17 Apr 2025 11:45:42 -0600 Subject: [PATCH 02/21] Create windows_powershell_invoke_restmethod_ip_information_collection.yml --- ...e_restmethod_ip_information_collection.yml | 74 +++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml diff --git a/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml new file mode 100644 index 0000000000..27da3c58d7 --- /dev/null +++ b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml @@ -0,0 +1,74 @@ +name: Windows PowerShell Invoke-RestMethod IP Information Collection +id: 8db47e12-9c3e-4f5a-b0d6-e42a1895cd4f +version: 1 +date: '2025-04-17' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of PowerShell's Invoke-RestMethod + cmdlet to collect geolocation data from ipinfo.io or IP address information from + api.ipify.org. This behavior leverages PowerShell Script Block Logging to identify + scripts that gather external IP information and potential geolocation data. This + activity is significant as it may indicate reconnaissance efforts, where threat + actors are attempting to determine the geographical location or network details + of a compromised system. While some legitimate software may use these services, + this pattern is commonly observed in malware and post-exploitation toolkits like + those used by Water Gamayun threat actors. +data_source: +- Powershell Script Block Logging 4104 +search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-RestMethod*" AND (ScriptBlockText="*ipinfo.io*" + OR ScriptBlockText="*api.ipify.org*")) | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powershell_invoke_restmethod_ip_information_collection_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Some legitimate applications or administrative scripts may + use these services for IP validation or geolocation. Filter as needed for approved + administrative tools. +references: +- https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/ +- https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024 +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A PowerShell script on $dest$ is collecting external IP or geolocation information using Invoke-RestMethod. + risk_objects: + - field: dest + type: system + score: 45 + threat_objects: + - field: dest + type: system +tags: + analytic_story: + - Water Gamayun + asset_type: Endpoint + mitre_attack_id: + - T1082 + - T1016 + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/irm_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog From c418996d5f0d170269e86420c425ee19be7adb12 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 17 Apr 2025 11:53:17 -0600 Subject: [PATCH 03/21] Update windows_msc_eviltwin_directory_path_manipulation.yml --- .../windows_msc_eviltwin_directory_path_manipulation.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml index f3de0c4e9c..b141a6388b 100644 --- a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml +++ b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml @@ -21,7 +21,10 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="mmc.exe" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_id Processes.process_name Processes.process_path + Processes.process Processes.process_id Processes.process_name Processes.process_path Processes.action + Processes.original_file_name Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_integrity_level Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process="(?i).*mmc\.exe.*((Windows\s+\\\\System32)|(Windows\s+System32)|(\\\\Windows\s+\\\\System32)|(Program\s+Files\s+\\\\)|(Program\s+Files\s+\(\\w+\)\s+\\\\)|(Progra~1\s+\\\\))" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 677fe6a7f986b2a4be26b62bca678a6ce8ee1e96 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 21 Apr 2025 10:25:39 -0600 Subject: [PATCH 04/21] Update windows_msc_eviltwin_directory_path_manipulation.yml --- .../windows_msc_eviltwin_directory_path_manipulation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml index b141a6388b..bd514f9048 100644 --- a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml +++ b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml @@ -88,6 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/eviltwin/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/eviltwin/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog From 5bd5a5393897de5ddce914ed05ec9492a13c2df0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 21 Apr 2025 12:13:42 -0700 Subject: [PATCH 05/21] updating searches --- detections/endpoint/detect_psexec_with_accepteula_flag.yml | 5 +---- .../executables_or_script_creation_in_suspicious_path.yml | 4 ---- ...re_firewall___blacklisted_ssl_certificate_fingerprint.yml | 2 +- .../cisco_secure_firewall___rare_snort_rule_triggered.yml | 1 + 4 files changed, 3 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 746dd7ad03..8208b3197e 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -11,7 +11,7 @@ description: The following analytic identifies the execution of `PsExec.exe` wit This activity is significant because PsExec is commonly used by threat actors to execute code on remote systems, and the `accepteula` flag indicates first-time usage, which could signify initial compromise. If confirmed malicious, this activity could - allow attackers to gain remote code execution capabilities, potentially leading + allow attackers to gain remote code execution capabilities, potentially leading to further system compromise and lateral movement within the network. data_source: - Sysmon EventID 1 @@ -75,19 +75,16 @@ tags: analytic_story: - DHS Report TA18-074A - Active Directory Lateral Movement - - BlackByte Ransomware - HAFNIUM Group - Rhysida Ransomware - Medusa Ransomware - DarkSide Ransomware - SamSam Ransomware - - DarkGate Malware - CISA AA22-320A - Sandworm Tools - IcedID - BlackByte Ransomware - DarkGate Malware - - Rhysida Ransomware - Cactus Ransomware - Volt Typhoon - Seashell Blizzard diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 1502d05c4d..8f41292294 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -106,10 +106,6 @@ tags: - WhisperGate - WinDealer RAT - XMRig - - MoonPeak - - Industroyer2 - - Amadey - - IcedID - Earth Alux asset_type: Endpoint mitre_attack_id: diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index bb82868eb8..06d0a93a32 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -53,7 +53,7 @@ drilldown_searches: rba: message: > Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections - [ListingReason: $reasons$] + [ListingReason: $Reasons$] risk_objects: - field: src_ip type: system diff --git a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml index 493e713d1a..6121a12d1c 100644 --- a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml +++ b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml @@ -48,6 +48,7 @@ tags: - Splunk Enterprise - Splunk Cloud - Splunk Enterprise Security + manual_test: This detection a hunting search that has the fixed time range of 7 days baked into the search. Hence based on the time range of the data in the logs, the detection may or may not return results with TriggerCount = 1 in testing. tests: - name: True Positive Test attack_data: From bd617e1211a75bad721a04596de08042b21bf808 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 21 Apr 2025 12:27:30 -0700 Subject: [PATCH 06/21] Update windows_powershell_invoke_restmethod_ip_information_collection.yml fix threat object --- ...powershell_invoke_restmethod_ip_information_collection.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml index 27da3c58d7..d7329ecd95 100644 --- a/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml +++ b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml @@ -50,9 +50,7 @@ rba: - field: dest type: system score: 45 - threat_objects: - - field: dest - type: system + threat_objects: [] tags: analytic_story: - Water Gamayun From 366474792d028778e1422b547e039f1341aee6cd Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 21 Apr 2025 12:52:17 -0700 Subject: [PATCH 07/21] Update cisco_secure_firewall___rare_snort_rule_triggered.yml --- .../cisco_secure_firewall___rare_snort_rule_triggered.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml index 6121a12d1c..cd1550c640 100644 --- a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml +++ b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml @@ -48,7 +48,7 @@ tags: - Splunk Enterprise - Splunk Cloud - Splunk Enterprise Security - manual_test: This detection a hunting search that has the fixed time range of 7 days baked into the search. Hence based on the time range of the data in the logs, the detection may or may not return results with TriggerCount = 1 in testing. + manual_test: This detection is a hunting search that has the fixed time range of 7 days baked into the search. Hence based on the time range of the data in the logs, the detection may or may not return results with TriggerCount = 1 in testing. tests: - name: True Positive Test attack_data: From b5258b99e41002a72f84fdc57e4002df3bc284a3 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 21 Apr 2025 13:00:03 -0700 Subject: [PATCH 08/21] Update detect_psexec_with_accepteula_flag.yml --- detections/endpoint/detect_psexec_with_accepteula_flag.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 8208b3197e..5643d865a3 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -11,7 +11,7 @@ description: The following analytic identifies the execution of `PsExec.exe` wit This activity is significant because PsExec is commonly used by threat actors to execute code on remote systems, and the `accepteula` flag indicates first-time usage, which could signify initial compromise. If confirmed malicious, this activity could - allow attackers to gain remote code execution capabilities, potentially leading + allow attackers to gain remote code execution capabilities, potentially leading to further system compromise and lateral movement within the network. data_source: - Sysmon EventID 1 From a24c72d431b40f5fe62abde1abbda6568a9a88a1 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 22 Apr 2025 10:32:24 +0200 Subject: [PATCH 09/21] Revert prestats optimization --- .../detect_outlook_exe_writing_a_zip_file.yml | 45 +++++--------- ...no_command_line_arguments_with_network.yml | 41 ++++--------- ...no_command_line_arguments_with_network.yml | 49 ++++++---------- detections/endpoint/java_writing_jsp_file.yml | 38 ++++-------- ...nnection_from_java_using_default_ports.yml | 39 ++++--------- ...no_command_line_arguments_with_network.yml | 49 ++++++---------- ...host_with_no_command_line_with_network.yml | 48 ++++++--------- detections/endpoint/spoolsv_writing_a_dll.yml | 46 +++++---------- ...cious_image_creation_in_appdata_folder.yml | 48 +++++---------- .../suspicious_wav_file_in_appdata_folder.yml | 46 +++++---------- ...spicious_writes_to_windows_recycle_bin.yml | 36 +++--------- ...wn_process_using_the_kerberos_protocol.yml | 39 ++++--------- ...cement_modify_transcodedwallpaper_file.yml | 40 ++++--------- ...ry_by_a_non_critical_process_file_path.yml | 39 ++++--------- ...ttp_network_communication_from_msiexec.yml | 39 ++++--------- ..._installutil_remote_network_connection.yml | 58 ++++++++----------- ...tallutil_uninstall_option_with_network.yml | 48 ++++++--------- ...office_product_dropped_cab_or_inf_file.yml | 44 +++++--------- ...s_office_product_dropped_uncommon_file.yml | 45 +++++--------- ..._phishing_outlook_drop_dll_in_form_dir.yml | 45 +++++--------- ...inlogon_with_public_network_connection.yml | 44 +++++--------- 21 files changed, 296 insertions(+), 630 deletions(-) diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 75d969f3d3..0216ab7fd6 100644 --- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -14,38 +14,21 @@ description: The following analytic identifies the execution of `outlook.exe` wr the security of the affected system and network. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe + by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest + Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename + process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id + type=inner[| tstats `security_content_summariesonly` count values(Filesystem.file_path) + as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*.zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* - OR Filesystem.file_path=*Local\\Temp*) by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(parent_process) as parent_process values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(file_access_time) as file_access_time values(file_create_time) - as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time - values(file_name) as file_name values(file_path) as file_path values(file_acl) as - file_acl values(file_size) as file_size by process_guid | where isnotnull(process) - AND isnotnull(file_name) | `detect_outlook_exe_writing_a_zip_file_filter`' + OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash + Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | rename process_id as malicious_id| fields + malicious_id outlook_id dest file_path file_name file_hash count file_id] | table + firstTime lastTime user malicious_id outlook_id process_name parent_process_name + file_name file_path | where file_name != "" | `detect_outlook_exe_writing_a_zip_file_filter`' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 69023c9b89..3eec217377 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -15,37 +15,16 @@ description: The following analytic detects instances of DLLHost.exe running wit network's security. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=dllhost.exe Processes.action!="blocked" by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `dllhost_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe + Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" + | rename dest as src | join host process_id [| tstats `security_content_summariesonly` + count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) + as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port + != 0 by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 44b2166007..c92119620b 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -16,37 +16,24 @@ description: The following analytic detects the execution of gpupdate.exe withou leading to system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=gpupdate.exe by Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid Processes.process_hash - Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `gpupdate_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=gpupdate.exe + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"| + join process_id [| tstats `security_content_summariesonly` count values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip + values(All_Traffic.direction) as direction values(All_Traffic.dvc) as dvc values(All_Traffic.protocol) as protocol + values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src) as src values(All_Traffic.src_ip) as src_ip + values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest + parent_process_name process_name process_path process process_id dest_port C2 app dest_ip direction dvc protocol + protocol_version src src_ip src_port transport | + `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index aa1648ca7b..388f5777ee 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -14,38 +14,24 @@ description: The following analytic detects the Java process writing a .jsp file the affected system, posing a severe security risk. data_source: - Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name - IN ("java","java.exe", "javaw.exe") by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.jsp*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name="*.jsp*" by _time Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process) AND isnotnull(file_name) | - `java_writing_jsp_file_filter`' + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name + file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) + as lastTime by dest process_name process_guid file_name file_path file_create_time + user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `java_writing_jsp_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index cfca818b75..9735376444 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -15,39 +15,24 @@ description: "The following analytic detects outbound network connections from J \ further compromise of the affected server." data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port - = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `outbound_network_connection_from_java_using_default_ports_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port + = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process dest_port + | `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index a9734a3629..5e74ee67e5 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -15,37 +15,24 @@ description: The following analytic detects the execution of rundll32.exe withou of the system. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_rundll32` AND Processes.action!="blocked" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `rundll32_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where `process_rundll32` AND Processes.action!="blocked" + by host _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(?i)(rundll32\.exe.{0,4}$)" | rename dest as src | join host process_id + [| tstats `security_content_summariesonly` count + FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host + All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] + | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index d2b24b770d..42bc1bd9e3 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -15,37 +15,23 @@ description: The following analytic detects instances of searchprotocolhost.exe and control, potentially leading to data exfiltration or further system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=searchprotocolhost.exe by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `searchprotocolhost_with_no_command_line_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats + `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name + process_name process_path process process_id dest_port C2 | `searchprotocolhost_with_no_command_line_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index ac3e2aeaef..9540465f41 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -16,38 +16,20 @@ description: The following analytic detects `spoolsv.exe` writing a `.dll` file, data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `spoolsv_writing_a_dll_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=spoolsv.exe by _time Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" + Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.process_guid Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | + fields _time dest file_create_time file_name file_path process_name process_path + process_guid process] | dedup file_create_time | table dest file_create_time, file_name, + file_path, process_name process_guid | `spoolsv_writing_a_dll_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 9cc0d39dc3..689b4ce2fc 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -15,39 +15,21 @@ description: The following analytic detects the creation of image files in the A compromising sensitive information and user privacy. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe - Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path="*\\appdata\\Roaming\\*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_image_creation_in_appdata_folder_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= + "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields _time dest file_create_time file_name + file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 9464b212cf..5b2ec0c658 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -16,39 +16,21 @@ description: The following analytic detects the creation of .wav files in the Ap data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe - Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest - Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_wav_file_in_appdata_folder_filter`' + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields file_name file_path process_name process_path + process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index ce4e741840..c15bdff4f2 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -15,38 +15,20 @@ description: The following analytic detects when a process other than explorer.e tools. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) + as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*" + by Filesystem.process_name Filesystem.process_id Filesystem.dest | `drop_dm_object_name("Filesystem")` + | join process_id [| tstats `security_content_summariesonly` values(Processes.user) + as user values(Processes.process_name) as process_name values(Processes.parent_process_name) + as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name != "explorer.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path - = "*$Recycle.Bin*" by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `suspicious_writes_to_windows_recycle_bin_filter`' + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + | table user process_name process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes. diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index b907525320..14b82107f9 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -15,37 +15,22 @@ description: The following analytic identifies a non-lsass.exe process making an access or lateral movement within the network. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name!=lsass.exe by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name!=lsass.exe by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `unknown_process_using_the_kerberos_protocol_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id dest [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction + All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename src as dest ] | table _time dest + parent_process_name process_name process_path process process_id dest_port | `unknown_process_using_the_kerberos_protocol_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index 042d104f0c..47474bac0f 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -15,39 +15,21 @@ description: The following analytic identifies modifications to the TranscodedWa potentially leading to further system compromise or data exfiltration. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path - !="*\\Windows\\Explorer.EXE" by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_path !="*\\Windows\\Explorer.EXE" + by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path - = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by Filesystem.action - Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash - Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user - Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - file_access_time file_create_time file_hash file_modify_time file_name file_path - file_acl file_size firstTime lastTime | stats values(action) as action values(dest) - as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `windows_defacement_modify_transcodedwallpaper_file_filter`' + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, + _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + |rename process_guid as proc_guid | fields file_name file_path process_name process_path + process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index 6bf5de4802..483747b7b9 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -15,37 +15,22 @@ description: The following analytic detects the deletion of registry keys by non data_source: - Sysmon EventID 1 AND Sysmon EventID 12 - Sysmon EventID 1 AND Sysmon EventID 13 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path - IN ("*\\windows\\*", "*\\program files*") by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + WHERE Registry.action=deleted BY _time span=1h Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | join process_guid [| tstats + `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT + (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h + Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=deleted - by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive - Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name - Registry.registry_value_type Registry.status Registry.user Registry.vendor_product - | `drop_dm_object_name(Registry)` | table action dest original_file_name parent_process - parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path - process process_exec process_guid process_hash process_id process_integrity_level - process_name process_path user user_id vendor_product registry_hive registry_path - registry_key_name registry_value_data registry_value_name registry_value_type status - | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(registry_hive) as registry_hive values(registry_path) as - registry_path values(registry_key_name) as registry_key_name values(registry_value_data) - as registry_value_data values(registry_value_name) as registry_value_name values(registry_value_type) - as registry_value_type values(status) as status by process_guid | where isnotnull(process_path) - AND isnotnull(registry_value_name) | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`] + | fields _time parent_process_name parent_process process_name process_path process + process_guid registry_path registry_value_name registry_value_data registry_key_name + action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 4581f37ed2..04c88d5c6d 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -15,37 +15,22 @@ description: The following analytic detects MSIExec making network connections o or further malware deployment. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_msiexec` by Processes.action Processes.dest Processes.original_file_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec` + by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path - Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` - | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where - All_Traffic.dest_port IN ("80","443") by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_http_network_communication_from_msiexec_filter`' + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where + All_Traffic.dest_port IN ("80","443") by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` ] + | table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip + | `windows_http_network_communication_from_msiexec_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index fcedfa0264..fb55e8aa8e 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -16,39 +16,31 @@ description: The following analytic detects the Windows InstallUtil.exe binary m of this activity. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: "| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes\n\ - \ where `process_installutil`\n by Processes.action Processes.dest Processes.original_file_name\ - \ Processes.parent_process Processes.parent_process_exec \n Processes.parent_process_guid\ - \ Processes.parent_process_id Processes.parent_process_name \n Processes.parent_process_path\ - \ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash\ - \ \n Processes.process_id Processes.process_integrity_level Processes.process_name\ - \ Processes.process_path \n Processes.user Processes.user_id Processes.vendor_product\ - \ \n| `drop_dm_object_name(Processes)` \n| tstats prestats=t append=t `security_content_summariesonly`\ - \ count min(_time) as firstTime max(_time)\n as lastTime from datamodel=Network_Traffic.All_Traffic\ - \ where All_Traffic.dest_port!=0\n by All_Traffic.action All_Traffic.app All_Traffic.dest\ - \ All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction \n All_Traffic.dvc\ - \ All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip\ - \ All_Traffic.src_port \n All_Traffic.transport All_Traffic.user All_Traffic.vendor_product\ - \ All_Traffic.process_id\n| `drop_dm_object_name(All_Traffic)` \n| table action\ - \ dest original_file_name parent_process parent_process_exec \n parent_process_guid\ - \ parent_process_id parent_process_name \n parent_process_path process process_exec\ - \ process_guid process_hash \n process_id process_integrity_level process_name\ - \ process_path \n user user_id vendor_product app dest_ip dest_port direction dvc\ - \ protocol \n protocol_version src src_ip src_port transport \n| stats values(action)\ - \ as action values(dest) as dest values(original_file_name) as original_file_name\ - \ values(parent_process) as parent_process \n values(parent_process_exec) as parent_process_exec\ - \ values(parent_process_guid) as parent_process_guid \n values(parent_process_id)\ - \ as parent_process_id values(parent_process_name) as parent_process_name \n values(parent_process_path)\ - \ as parent_process_path values(process) as process \n values(process_exec) as\ - \ process_exec values(process_hash) as process_hash \n values(process_guid) as\ - \ process_guid values(process_integrity_level) as process_integrity_level values(process_name)\ - \ as process_name\n values(process_path) as process_path values(user) as user values(user_id)\ - \ as user_id \n values(vendor_product) as vendor_product values(app) as app values(dest_ip)\ - \ as dest_ip values(dest_port) as dest_port values(direction) as direction\n values(dvc)\ - \ as dvc values(protocol) as protocol values(protocol_version) as protocol_version\ - \ values(src) as src values(src_ip) as src_ip values(src_port) as src_port values(transport)\ - \ as transport by process_id \n| where isnotnull(process_name) AND isnotnull(dest_port)\ - \ \n| `windows_installutil_remote_network_connection_filter`" +search: |- + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | join process_id dest + [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != + 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` + | rename dest as command_and_control + | rename src as dest] + | table _time user src dest parent_process_name process_name process_path process process_id dest_port command_and_control + | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process values(command_and_control) as command_and_control by user dest process_name process_id dest_port parent_process_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `windows_installutil_remote_network_connection_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 694f33b26f..a1df7e3c8b 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -15,37 +15,23 @@ description: The following analytic identifies the use of Windows InstallUtil.ex movement within the network. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port!=0 by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_installutil_uninstall_option_with_network_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time + span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest + parent_process_name process_name process_path process process_id dest_port C2 | + `windows_installutil_uninstall_option_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 5f04acee23..4dcd653800 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -15,37 +15,21 @@ description: The following analytic detects Office products writing .cab or .inf data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_office_products` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.cab", "*.inf") by Filesystem.action Filesystem.dest - Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size - Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product - | `drop_dm_object_name(Filesystem)` | table action dest original_file_name parent_process - parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path - process process_exec process_guid process_hash process_id process_integrity_level - process_name process_path user user_id vendor_product file_access_time file_create_time - file_hash file_modify_time file_name file_path file_acl file_size firstTime lastTime - | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(file_access_time) as file_access_time values(file_create_time) - as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time - values(file_name) as file_name values(file_path) as file_path values(file_acl) as - file_acl values(file_size) as file_size by process_guid | where isnotnull(process) - AND isnotnull(file_name) | `windows_office_product_dropped_cab_or_inf_file_filter`' + where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time + dest file_create_time file_name file_path process_name process_path process proc_guid] + | dedup file_create_time | table dest, process_name, process, file_create_time, + file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index 82da6b59e2..d30e7ee472 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -15,37 +15,20 @@ description: The following analytic detects Microsoft Office applications droppi access, posing a severe threat to the environment. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", - "*.vbe", "*.vbs") by Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name - Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid - Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` - | table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_office_products` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name + IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", "*.vbe", "*.vbs") by _time + span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process process_guid] | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path, process_guid | `windows_office_product_dropped_uncommon_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml index 685c811982..57642f9990 100644 --- a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml +++ b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml @@ -14,38 +14,19 @@ description: The following analytic detects the creation of a DLL file by an out an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration. -search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as - firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | - table action dest original_file_name parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path process process_exec process_guid - process_hash process_id process_integrity_level process_name process_path user user_id - vendor_product file_access_time file_create_time file_hash file_modify_time file_name - file_path file_acl file_size firstTime lastTime | stats values(action) as action - values(dest) as dest values(original_file_name) as original_file_name values(parent_process) - as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) - as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) - as parent_process_name values(parent_process_path) as parent_process_path values(process) - as process values(process_exec) as process_exec values(process_hash) as process_hash - values(process_id) as process_id values(process_integrity_level) as process_integrity_level - values(process_name) as process_name values(process_path) as process_path values(user) - as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) - as file_access_time values(file_create_time) as file_create_time values(file_hash) - as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name - values(file_path) as file_path values(file_acl) as file_acl values(file_size) as - file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) - | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=outlook.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | join process_guid, _time [ | tstats `security_content_summariesonly` count min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name + ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" by _time + span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path + Filesystem.process_guid | `drop_dm_object_name(Filesystem)` | fields file_name file_path + process_name process_path process dest file_create_time _time process_guid] | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index 0db48f3747..763f2f9af1 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -15,38 +15,20 @@ description: The following analytic detects instances of Winlogon.exe, a critica bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level. -search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN (winlogon.exe) Processes.process!=unknown by Processes.action - Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name - Processes.process_path Processes.user Processes.user_id Processes.vendor_product - | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` - count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN (winlogon.exe) Processes.process!=unknown + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id + [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 NOT (All_Traffic.dest IN (127.0.0.1,10.0.0.0/8,172.16.0.0/12, - 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.action All_Traffic.app All_Traffic.dest - All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc - All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip - All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest - original_file_name parent_process parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process process_exec process_guid process_hash - process_id process_integrity_level process_name process_path user user_id vendor_product - app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port - transport | stats values(action) as action values(dest) as dest values(original_file_name) - as original_file_name values(parent_process) as parent_process values(parent_process_exec) - as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) - as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) - as parent_process_path values(process) as process values(process_exec) as process_exec - values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) - as process_integrity_level values(process_name) as process_name values(process_path) - as process_path values(user) as user values(user_id) as user_id values(vendor_product) - as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) - as dest_port values(direction) as direction values(dvc) as dvc values(protocol) - as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) - as src_ip values(src_port) as src_port values(transport) as transport by process_id - | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_winlogon_with_public_network_connection_filter`' + 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port + | `drop_dm_object_name(All_Traffic)` | rename dest as publicIp ] | table dest parent_process_name + process_name process_path process process_id dest_port publicIp | `windows_winlogon_with_public_network_connection_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, From 08294f4123c0e27b1aa90c2bbe87a79d16b48d24 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 22 Apr 2025 10:57:45 +0200 Subject: [PATCH 10/21] bug fix --- .../windows_indirect_command_execution_via_forfiles.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index aa054d7ff9..26070a5722 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -18,8 +18,8 @@ data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* - /c *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level From 967b68950146508ca0c366b91cf854dc7c5ed2c0 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 22 Apr 2025 11:06:07 +0200 Subject: [PATCH 11/21] bump version --- detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml | 4 ++-- .../gpupdate_with_no_command_line_arguments_with_network.yml | 4 ++-- detections/endpoint/java_writing_jsp_file.yml | 4 ++-- ...bound_network_connection_from_java_using_default_ports.yml | 4 ++-- detections/endpoint/spoolsv_writing_a_dll.yml | 4 ++-- .../endpoint/suspicious_image_creation_in_appdata_folder.yml | 4 ++-- detections/endpoint/suspicious_wav_file_in_appdata_folder.yml | 4 ++-- .../endpoint/suspicious_writes_to_windows_recycle_bin.yml | 4 ++-- .../endpoint/unknown_process_using_the_kerberos_protocol.yml | 4 ++-- .../windows_defacement_modify_transcodedwallpaper_file.yml | 4 ++-- ...s_deleted_registry_by_a_non_critical_process_file_path.yml | 4 ++-- .../windows_installutil_remote_network_connection.yml | 4 ++-- .../windows_installutil_uninstall_option_with_network.yml | 4 ++-- .../windows_office_product_dropped_cab_or_inf_file.yml | 4 ++-- .../endpoint/windows_office_product_dropped_uncommon_file.yml | 4 ++-- .../windows_phishing_outlook_drop_dll_in_form_dir.yml | 4 ++-- .../windows_winlogon_with_public_network_connection.yml | 4 ++-- 17 files changed, 34 insertions(+), 34 deletions(-) diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 0216ab7fd6..f29e38cf3f 100644 --- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -1,7 +1,7 @@ name: Detect Outlook exe writing a zip file id: a51bfe1a-94f0-4822-b1e4-16ae10145893 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Bhavin Patel, Splunk status: experimental type: TTP diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index c92119620b..8c82b15f7c 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,7 +1,7 @@ name: GPUpdate with no Command Line Arguments with Network id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 9 -date: '2024-12-10' +version: 10 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index 388f5777ee..4476ff86f3 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,7 +1,7 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 9735376444..d55f428f53 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -1,7 +1,7 @@ name: Outbound Network Connection from Java Using Default Ports id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Lou Stella, Splunk status: production type: TTP diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 9540465f41..63852cc5a6 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL id: d5bf5cf2-da71-11eb-92c2-acde48001122 -version: 9 -date: '2025-03-27' +version: 10 +date: '2025-04-22' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 689b4ce2fc..666343c940 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious Image Creation In Appdata Folder id: f6f904c4-1ac0-11ec-806b-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 5b2ec0c658..911dd6035f 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -1,7 +1,7 @@ name: Suspicious WAV file in Appdata Folder id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index c15bdff4f2..662f188f9f 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -1,7 +1,7 @@ name: Suspicious writes to windows Recycle Bin id: b5541828-8ffd-4070-9d95-b3da4de924cb -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Rico Valdez, Splunk status: production type: TTP diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index 14b82107f9..d7aafa7b1b 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -1,7 +1,7 @@ name: Unknown Process Using The Kerberos Protocol id: c91a0852-9fbb-11ec-af44-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index 47474bac0f..2475cef1f1 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -1,7 +1,7 @@ name: Windows Defacement Modify Transcodedwallpaper File id: e11c3d90-5bc7-42ad-94cd-ba75db10d897 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index 483747b7b9..362063cd7b 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -1,7 +1,7 @@ name: Windows Deleted Registry By A Non Critical Process File Path id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index fb55e8aa8e..a7c8b70286 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 12 -date: '2025-03-27' +version: 13 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index a1df7e3c8b..f082b063f8 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Uninstall Option with Network id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 4dcd653800..c492ae63e3 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -1,7 +1,7 @@ name: Windows Office Product Dropped Cab or Inf File id: dbdd251e-dd45-4ec9-a555-f5e151391746 -version: 3 -date: '2025-02-10' +version: 4 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index d30e7ee472..9f178e97e1 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -1,7 +1,7 @@ name: Windows Office Product Dropped Uncommon File id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 -version: 3 -date: '2025-02-10' +version: 4 +date: '2025-04-22' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: production type: Anomaly diff --git a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml index 57642f9990..6540a39b8c 100644 --- a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml +++ b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml @@ -1,7 +1,7 @@ name: Windows Phishing Outlook Drop Dll In FORM Dir id: fca01769-5163-4b3a-ae44-de874adfc9bc -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 1 AND Sysmon EventID 11 diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index 763f2f9af1..1aba5bb21d 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -1,7 +1,7 @@ name: Windows WinLogon with Public Network Connection id: 65615b3a-62ea-4d65-bb9f-6f07c17df4ea -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: experimental type: Hunting From f8df5c44912c9a84f26c256bc61fbf734405155e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 10:33:39 -0700 Subject: [PATCH 12/21] Update windows_deleted_registry_by_a_non_critical_process_file_path.yml fix data source --- ...dows_deleted_registry_by_a_non_critical_process_file_path.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index 362063cd7b..3c70e5701c 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -14,7 +14,6 @@ description: The following analytic detects the deletion of registry keys by non system damage, loss of critical configurations, and potential disruption of services. data_source: - Sysmon EventID 1 AND Sysmon EventID 12 -- Sysmon EventID 1 AND Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry WHERE Registry.action=deleted BY _time span=1h Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name From b1ff40dfd47b70628017c4058eb11e3eebc76d92 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 11:24:52 -0700 Subject: [PATCH 13/21] updating ids in new branch --- .../endpoint/msi_module_loaded_by_non_system_binary.yml | 6 +++--- .../endpoint/msmpeng_application_dll_side_loading.yml | 6 +++--- detections/endpoint/windows_dll_side_loading_in_calc.yml | 6 +++--- .../windows_dll_side_loading_process_child_of_calc.yml | 6 +++--- detections/endpoint/windows_known_abused_dll_created.yml | 5 ++--- .../windows_known_abused_dll_loaded_suspiciously.yml | 5 ++--- .../windows_known_graphicalproton_loaded_modules.yml | 6 +++--- .../windows_masquerading_explorer_as_child_process.yml | 6 +++--- .../endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml | 6 +++--- detections/endpoint/windows_unsigned_dll_side_loading.yml | 6 +++--- ...ndows_unsigned_dll_side_loading_in_same_process_path.yml | 6 +++--- .../endpoint/windows_unsigned_ms_dll_side_loading.yml | 6 +++--- 12 files changed, 34 insertions(+), 36 deletions(-) diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index cab03bb644..c8d97e3776 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -1,7 +1,7 @@ name: MSI Module Loaded by Non-System Binary id: ccb98a66-5851-11ec-b91c-acde48001122 -version: 7 -date: '2025-02-10' +version: 8 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Hunting @@ -38,7 +38,7 @@ tags: cve: - CVE-2021-41379 mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 3b8dd38765..7ee1c1ab58 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Msmpeng Application DLL Side Loading id: 8bb3f280-dd9b-11eb-84d5-acde48001122 -version: 8 -date: '2025-02-10' +version: 9 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Sanjay Govind status: production type: TTP @@ -57,7 +57,7 @@ tags: - Revil Ransomware asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml index c41d60021a..aa37e17f91 100644 --- a/detections/endpoint/windows_dll_side_loading_in_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml @@ -1,7 +1,7 @@ name: Windows DLL Side-Loading In Calc id: af01f6db-26ac-440e-8d89-2793e303f137 -version: 7 -date: '2025-04-16' +version: 8 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP @@ -59,7 +59,7 @@ tags: - Earth Alux asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml index c4b2a5d418..7d3c56f5ea 100644 --- a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml @@ -1,7 +1,7 @@ name: Windows DLL Side-Loading Process Child Of Calc id: 295ca9ed-e97b-4520-90f7-dfb6469902e1 -version: 7 -date: '2025-04-16' +version: 8 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -66,7 +66,7 @@ tags: - Earth Alux asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml index 72bcb18278..533baddb51 100644 --- a/detections/endpoint/windows_known_abused_dll_created.yml +++ b/detections/endpoint/windows_known_abused_dll_created.yml @@ -1,7 +1,7 @@ name: Windows Known Abused DLL Created id: ea91651a-772a-4b02-ac3d-985b364a5f07 -version: 6 -date: '2025-02-10' +version: 7 +date: '2025-04-22' author: Steven Dick status: production type: Anomaly @@ -79,7 +79,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1574.001 - - T1574.002 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml index 991d0ea5ea..5ad6b9cce9 100644 --- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml +++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml @@ -1,7 +1,7 @@ name: Windows Known Abused DLL Loaded Suspiciously id: dd6d1f16-adc0-4e87-9c34-06189516b803 -version: 6 -date: '2025-02-10' +version: 7 +date: '2025-04-22' author: Steven Dick status: production type: TTP @@ -65,7 +65,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1574.001 - - T1574.002 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml index cfa5dc8e06..f87c9828ce 100644 --- a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml +++ b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml @@ -1,7 +1,7 @@ name: Windows Known GraphicalProton Loaded Modules id: bf471c94-0324-4b19-a113-d02749b969bc -version: 8 -date: '2025-04-17' +version: 9 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,7 +57,7 @@ tags: - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml index 93c85976ab..f92c7f1321 100644 --- a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml +++ b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml @@ -1,7 +1,7 @@ name: Windows Masquerading Explorer As Child Process id: 61490da9-52a1-4855-a0c5-28233c88c481 -version: 9 -date: '2025-04-17' +version: 10 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP @@ -68,7 +68,7 @@ tags: - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml index 697fd098ba..4134c35c89 100644 --- a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml +++ b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml @@ -1,7 +1,7 @@ name: Windows SqlWriter SQLDumper DLL Sideload id: 2ed89ba9-c6c7-46aa-9f08-a2a1c2955aa3 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Michael Haag, Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -69,7 +69,7 @@ tags: - Midnight Blizzard asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index b3ae428b7c..da47b3a098 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: 10 -date: '2025-04-16' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -61,7 +61,7 @@ tags: - Earth Alux asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index 9c4a6abc6d..07254d28cd 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 9 -date: '2025-02-26' +version: 10 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -64,7 +64,7 @@ tags: - DarkGate Malware asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 92d7b4b682..881dca0a54 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: 10 -date: '2025-04-16' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -76,7 +76,7 @@ tags: - Midnight Blizzard asset_type: Endpoint mitre_attack_id: - - T1574.002 + - T1574.001 - T1547 product: - Splunk Enterprise From 4a1547b9c93203d578b3bea652820c8c1c18e409 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 11:51:26 -0700 Subject: [PATCH 14/21] updating message --- ...ure_firewall___blacklisted_ssl_certificate_fingerprint.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 06d0a93a32..7f4c1d55aa 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -51,9 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: > - Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections - [ListingReason: $Reasons$] + message: Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections [ ListingReason: $Reasons$ ] risk_objects: - field: src_ip type: system From f37ca5fc687ee1468c05281b83ae0eef4b615abc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 12:05:49 -0700 Subject: [PATCH 15/21] update message formatting --- ...ecure_firewall___blacklisted_ssl_certificate_fingerprint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 7f4c1d55aa..7cd8050eb2 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -51,7 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections [ ListingReason: $Reasons$ ] + message: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src_ip$ risk_objects: - field: src_ip type: system From 6fc106b9954ab6df061ada2aabaa9e8f1d96c194 Mon Sep 17 00:00:00 2001 From: ljstella Date: Tue, 22 Apr 2025 15:03:23 -0500 Subject: [PATCH 16/21] Version adjustments for new detection metadata validation check --- detections/endpoint/disable_registry_tool.yml | 76 ++++---- ...le_security_logs_using_minint_registry.yml | 80 ++++---- .../endpoint/disable_show_hidden_files.yml | 90 ++++----- .../endpoint/disable_windows_app_hotkeys.yml | 74 ++++---- .../endpoint/disabling_cmd_application.yml | 82 +++++---- .../endpoint/disabling_controlpanel.yml | 80 ++++---- .../endpoint/disabling_norun_windows_app.yml | 85 +++++---- .../download_files_using_telegram.yml | 81 +++++---- ...le_wdigest_uselogoncredential_registry.yml | 82 +++++---- ...erate_users_local_group_using_telegram.yml | 85 +++++---- detections/endpoint/fodhelper_uac_bypass.yml | 101 +++++----- ...wmiobject_user_account_with_powershell.yml | 48 ++--- .../endpoint/lolbas_with_network_traffic.yml | 85 +++++---- .../malicious_inprocserver32_modification.yml | 86 +++++---- .../mmc_lolbas_execution_process_spawn.yml | 87 ++++----- ...l_telegram_api_request_via_commandline.yml | 91 ++++----- .../endpoint/powershell_4104_hunting.yml | 87 ++++----- .../powershell_creating_thread_mutex.yml | 91 ++++----- .../remcos_client_registry_install_entry.yml | 77 ++++---- detections/endpoint/revil_registry_entry.yml | 87 ++++----- .../endpoint/rundll32_shimcache_flush.yml | 84 +++++---- .../endpoint/suspicious_copy_on_system32.yml | 96 +++++----- ...s_process_executed_from_container_file.yml | 98 +++++----- .../endpoint/suspicious_reg_exe_process.yml | 98 +++++----- ..._tool_execution_from_non_shell_process.yml | 116 ++++++------ ...ows_defender_asr_registry_modification.yml | 41 +++-- .../windows_defender_asr_rule_disabled.yml | 74 ++++---- ...ry_by_a_non_critical_process_file_path.yml | 80 ++++---- ...sable_change_password_through_registry.yml | 75 ++++---- ...k_workstation_feature_through_registry.yml | 76 ++++---- ...disable_logoff_button_through_registry.yml | 79 ++++---- .../windows_disable_notification_center.yml | 80 ++++---- ...sable_shutdown_button_through_registry.yml | 75 ++++---- ...group_policy_features_through_registry.yml | 83 +++++---- .../windows_dll_side_loading_in_calc.yml | 73 ++++---- ...dll_side_loading_process_child_of_calc.yml | 74 ++++---- ...ltration_over_c2_via_invoke_restmethod.yml | 77 ++++---- ...notification_features_through_registry.yml | 74 ++++---- ...ttp_network_communication_from_msiexec.yml | 91 ++++----- ...nses_disable_av_autostart_via_registry.yml | 78 ++++---- ...indows_inprocserver32_new_outlook_form.yml | 80 ++++---- ...s_known_graphicalproton_loaded_modules.yml | 70 +++---- ...indows_lolbas_executed_as_renamed_file.yml | 100 +++++----- ...masquerading_explorer_as_child_process.yml | 76 ++++---- ...y_registry_authenticationleveloverride.yml | 73 ++++---- ...ows_modify_registry_auto_minor_updates.yml | 40 ++-- ...dows_modify_registry_auto_update_notif.yml | 75 ++++---- ...ws_modify_registry_configure_bitlocker.yml | 73 ++++---- ...s_modify_registry_default_icon_setting.yml | 81 +++++---- ..._modify_registry_delete_firewall_rules.yml | 81 +++++---- .../windows_modify_registry_disable_rdp.yml | 73 ++++---- ...dify_registry_disable_restricted_admin.yml | 78 ++++---- ...y_registry_disable_toast_notifications.yml | 75 ++++---- ...y_disable_win_defender_raw_write_notif.yml | 80 ++++---- ...stry_disable_windefender_notifications.yml | 77 ++++---- ..._disable_windows_security_center_notif.yml | 80 ++++---- ...registry_disableremotedesktopantialias.yml | 76 ++++---- ...odify_registry_disablesecuritysettings.yml | 78 ++++---- ...modify_registry_disabling_wer_settings.yml | 77 ++++---- ...s_modify_registry_disallow_windows_app.yml | 73 ++++---- ..._registry_do_not_connect_to_win_update.yml | 77 ++++---- .../windows_modify_registry_dontshowui.yml | 73 ++++---- ...odify_registry_enablelinkedconnections.yml | 78 ++++---- ...ndows_modify_registry_longpathsenabled.yml | 75 ++++---- ...modify_registry_maxconnectionperserver.yml | 75 ++++---- ...egistry_no_auto_reboot_with_logon_user.yml | 75 ++++---- ...windows_modify_registry_no_auto_update.yml | 77 ++++---- ...ws_modify_registry_nochangingwallpaper.yml | 76 ++++---- ...fy_registry_on_smart_card_group_policy.yml | 76 ++++---- .../windows_modify_registry_proxyenable.yml | 73 ++++---- .../windows_modify_registry_proxyserver.yml | 73 ++++---- ...y_registry_qakbot_binary_data_registry.yml | 72 ++++---- ...ify_registry_regedit_silent_reg_import.yml | 82 +++++---- ...y_registry_suppress_win_defender_notif.yml | 80 ++++---- ...dows_modify_registry_tamper_protection.yml | 75 ++++---- ...egistry_to_add_or_modify_firewall_rule.yml | 83 +++++---- ...ify_registry_updateserviceurlalternate.yml | 73 ++++---- .../windows_modify_registry_usewuserver.yml | 40 ++-- ...indows_modify_registry_utilize_progids.yml | 80 ++++---- ...ws_modify_registry_valleyrat_c2_config.yml | 78 ++++---- ...odify_registry_valleyrat_pwn_reg_entry.yml | 78 ++++---- ..._modify_registry_with_md5_reg_key_name.yml | 70 +++---- .../windows_modify_registry_wuserver.yml | 40 ++-- ...windows_modify_registry_wustatusserver.yml | 40 ++-- ...w_compress_color_and_info_tip_registry.yml | 76 ++++---- .../windows_msiexec_dllregisterserver.yml | 98 +++++----- ..._msiexec_hidewindow_rundll32_execution.yml | 84 +++++---- .../windows_msiexec_remote_download.yml | 98 +++++----- ...indows_msiexec_spawn_discovery_command.yml | 100 +++++----- .../windows_new_inprocserver32_added.yml | 43 +++-- ..._outlook_webview_registry_modification.yml | 75 ++++---- ...ndows_powershell_export_pfxcertificate.yml | 82 +++++---- ...indows_process_injection_remote_thread.yml | 87 ++++----- ...tasks_for_compmgmtlauncher_or_eventvwr.yml | 74 ++++---- .../windows_screen_capture_via_powershell.yml | 77 ++++---- ...istry_modification_wav_openwithprogids.yml | 78 ++++---- ...windows_snappybee_create_test_registry.yml | 83 +++++---- .../windows_suspicious_process_file_path.yml | 172 +++++++++--------- ...m_network_config_discovery_display_dns.yml | 84 +++++---- .../windows_unsigned_dll_side_loading.yml | 83 +++++---- .../windows_unsigned_ms_dll_side_loading.yml | 93 +++++----- .../windows_wmi_impersonate_token.yml | 80 ++++---- 102 files changed, 4287 insertions(+), 3792 deletions(-) diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index c7080c8ebd..6d5fb08735 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -1,11 +1,12 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects modifications to the Windows registry +description: + The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" with a value of "0x00000001". This activity is significant because malware, such @@ -14,8 +15,9 @@ description: The following analytic detects modifications to the Windows registr could hinder incident response efforts and allow the attacker to maintain control over the compromised system. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -23,51 +25,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Disabled Registry Tools on $dest$ risk_objects: - - field: dest - type: system - score: 40 + - field: dest + type: system + score: 40 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - NjRAT + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - NjRAT asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 144b97ce74..621bea141f 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -1,11 +1,12 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 10 -date: '2024-12-08' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects a suspicious registry modification aimed +description: + The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. It leverages data from the Endpoint.Registry data model, focusing on changes to the "Control\\MiniNt" registry path. This activity is significant because it can prevent Windows from @@ -14,61 +15,64 @@ description: The following analytic detects a suspicious registry modification a undetected, making it difficult to trace their actions and compromising the integrity of security audits. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: Unknown. references: -- https://twitter.com/0gtweet/status/1182516740955226112 + - https://twitter.com/0gtweet/status/1182516740955226112 drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Modified/added/deleted registry entry $registry_path$ on $dest$ risk_objects: - - field: dest - type: system - score: 80 - - field: user - type: user - score: 80 + - field: dest + type: system + score: 80 + - field: user + type: user + score: 80 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - CISA AA23-347A - - Windows Registry Abuse + - Windows Defense Evasion Tactics + - CISA AA23-347A + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 98d7b67a79..248ecfcd06 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -1,11 +1,12 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly -description: The following analytic detects modifications to the Windows registry +description: + The following analytic detects modifications to the Windows registry that disable the display of hidden files. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with hidden file settings. This activity is significant because malware, such as worms and trojan @@ -13,8 +14,9 @@ description: The following analytic detects modifications to the Windows registr behavior could allow an attacker to conceal malicious files on the system, making it harder for security tools and analysts to identify and remove the threat. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" @@ -24,58 +26,60 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis + - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Disabled 'Show Hidden Files' on $dest$ risk_objects: - - field: dest - type: system - score: 40 + - field: dest + type: system + score: 40 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Azorult + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - Azorult asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 - - T1564.001 + - T1112 + - T1562.001 + - T1564.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index d168ac71e4..796c76ccd4 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -1,11 +1,12 @@ name: Disable Windows App Hotkeys id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects a suspicious registry modification aimed +description: + The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values indicative of this behavior. This activity is significant as it can impair an analyst's ability @@ -13,8 +14,9 @@ description: The following analytic detects a suspicious registry modification a response efforts. If confirmed malicious, this technique can allow an attacker to maintain persistence and evade detection, complicating the remediation process. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") by Registry.action @@ -23,50 +25,52 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Disabled 'Windows App Hotkeys' on $dest$ risk_objects: - - field: dest - type: system - score: 40 + - field: dest + type: system + score: 40 threat_objects: [] tags: analytic_story: - - XMRig - - Windows Registry Abuse + - XMRig + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 6f4dde4f4f..57495f502b 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -1,11 +1,12 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects modifications to the registry that disable +description: + The following analytic detects modifications to the registry that disable the CMD prompt application. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableCMD" registry value. This activity is significant because disabling CMD can hinder an analyst's ability to investigate @@ -14,8 +15,9 @@ description: The following analytic detects modifications to the registry that d for directory and file traversal, complicating incident response and allowing the attacker to maintain persistence. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -23,54 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: The Windows command prompt was disabled on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - NjRAT + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - NjRAT asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 726b04c1ae..363b3627ef 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -1,11 +1,12 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects registry modifications that disable the +description: + The following analytic detects registry modifications that disable the Control Panel on Windows systems. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" with a value of "0x00000001". This activity is significant as it is commonly used @@ -14,8 +15,9 @@ description: The following analytic detects registry modifications that disable this could allow attackers to maintain control over the infected machine and prevent remediation efforts. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -23,53 +25,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: The Windows Control Panel was disabled on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse + - Windows Defense Evasion Tactics + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test (XML) - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test (XML) + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 15f095558e..d337deb039 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -1,11 +1,12 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 -version: 11 -date: '2025-02-10' +version: 12 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects the modification of the Windows registry +description: + The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" with a value of "0x00000001". This activity is significant because the Run application @@ -13,8 +14,9 @@ description: The following analytic detects the modification of the Windows regi malicious, this action could hinder system cleaning efforts and make it more difficult to run essential tools, thereby aiding malware persistence. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name @@ -22,55 +24,58 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: admin may disable this application for non technical user. references: -- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry -- https://blog.malwarebytes.com/detections/pum-optional-norun/ + - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://blog.malwarebytes.com/detections/pum-optional-norun/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: The Windows registry was modified to disable run application in window + message: + The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Windows Defense Evasion Tactics - - Windows Registry Abuse + - Windows Defense Evasion Tactics + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 - - T1562.001 + - T1112 + - T1562.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 03b75109d8..56a4489388 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,11 +1,12 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 -version: 7 -date: '2025-04-17' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file downloads by the Telegram +description: + The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download @@ -13,60 +14,64 @@ description: The following analytic detects suspicious file downloads by the Tel malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network. data_source: -- Sysmon EventID 15 -search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" + - Sysmon EventID 15 +search: + '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Contents Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: normal download of file in telegram app. (if it was a common +known_false_positives: + normal download of file in telegram app. (if it was a common app in network) references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Suspicious files were downloaded with the Telegram application on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Phemedrone Stealer - - Crypto Stealer - - Snake Keylogger - - XMRig - - Water Gamayun + - Phemedrone Stealer + - Crypto Stealer + - Snake Keylogger + - XMRig + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1105 + - T1105 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index cf32813a6f..60fc5e16cf 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -1,11 +1,12 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 10 -date: '2024-12-08' +version: 11 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects a suspicious registry modification that +description: + The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This @@ -14,8 +15,9 @@ description: The following analytic detects a suspicious registry modification t If confirmed malicious, this could allow an attacker to obtain sensitive credentials, leading to further compromise and lateral movement within the network. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,54 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html + - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: wdigest registry $registry_path$ was modified on $dest$ risk_objects: - - field: user - type: user - score: 80 - - field: dest - type: system - score: 80 + - field: user + type: user + score: 80 + - field: dest + type: system + score: 80 threat_objects: [] tags: analytic_story: - - Credential Dumping - - Windows Registry Abuse - - CISA AA22-320A + - Credential Dumping + - Windows Registry Abuse + - CISA AA22-320A asset_type: Endpoint mitre_attack_id: - - T1112 - - T1003 + - T1112 + - T1003 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 684adacb56..70e280e803 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -1,11 +1,12 @@ name: Enumerate Users Local Group Using Telegram id: fcd74532-ae54-11eb-a5ab-acde48001122 -version: 9 -date: '2025-04-17' +version: 8 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects a Telegram process enumerating all network +description: + The following analytic detects a Telegram process enumerating all network users in a local group. It leverages EventCode 4798, which is generated when a process enumerates a user's security-enabled local groups on a computer or device. This activity is significant as it may indicate an attempt to gather information on user @@ -13,60 +14,64 @@ description: The following analytic detects a Telegram process enumerating all n this behavior could allow an attacker to map out user accounts, potentially leading to privilege escalation or lateral movement within the network. data_source: -- Windows Event Log Security 4798 -search: '`wineventlog_security` EventCode=4798 CallerProcessName = "*\\telegram.exe" + - Windows Event Log Security 4798 +search: + '`wineventlog_security` EventCode=4798 CallerProcessName = "*\\telegram.exe" | stats count min(_time) as firstTime max(_time) as lastTime by user Computer EventCode CallerProcessName ProcessID SubjectUserSid SubjectDomainName SubjectLogonId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment. known_false_positives: unknown references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 + - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: The Telegram application has been identified enumerating local groups on + message: + The Telegram application has been identified enumerating local groups on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 80 - - field: dest - type: system - score: 80 + - field: user + type: user + score: 80 + - field: dest + type: system + score: 80 threat_objects: [] tags: analytic_story: - - XMRig - - Compromised Windows Host - - Water Gamayun + - XMRig + - Compromised Windows Host + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1087 + - T1087 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index f0a7eebd5b..8916822ec2 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -1,11 +1,12 @@ name: FodHelper UAC Bypass id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 -version: 9 -date: '2025-02-10' +version: 10 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the execution of fodhelper.exe, which +description: + The following analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. The detection method uses Endpoint Detection and Response (EDR) telemetry to identify when fodhelper.exe spawns a child process and accesses the registry @@ -14,10 +15,11 @@ description: The following analytic detects the execution of fodhelper.exe, whic with elevated privileges, leading to unauthorized system changes and potential full system compromise. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -37,55 +40,57 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: Limited to no false positives are expected. references: -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md -- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 -- https://attack.mitre.org/techniques/T1548/002/ + - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md + - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 + - https://attack.mitre.org/techniques/T1548/002/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: Suspicious registry keys added by process fodhelper.exe with a parent_process + message: + Suspicious registry keys added by process fodhelper.exe with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. risk_objects: - - field: user - type: user - score: 81 - - field: dest - type: system - score: 81 + - field: user + type: user + score: 81 + - field: dest + type: system + score: 81 threat_objects: - - field: parent_process_name - type: parent_process_name + - field: parent_process_name + type: parent_process_name tags: analytic_story: - - IcedID - - ValleyRAT - - Compromised Windows Host - - Windows Defense Evasion Tactics + - IcedID + - ValleyRAT + - Compromised Windows Host + - Windows Defense Evasion Tactics asset_type: Endpoint mitre_attack_id: - - T1112 - - T1548.002 + - T1112 + - T1548.002 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 151ead9d47..c95e2198cd 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -1,11 +1,12 @@ name: GetWmiObject User Account with PowerShell id: b44f6ac6-0429-11ec-87e9-acde48001122 -version: 8 -date: '2025-04-17' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Splunk status: production type: Hunting -description: The following analytic detects the execution of `powershell.exe` with +description: + The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount` parameter to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. @@ -14,10 +15,11 @@ description: The following analytic detects the execution of `powershell.exe` wi malicious, this behavior could lead to further reconnaissance, privilege escalation, or lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,26 +39,27 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this PowerShell commandlet +known_false_positives: + Administrators or power users may use this PowerShell commandlet for troubleshooting. references: -- https://attack.mitre.org/techniques/T1087/001/ + - https://attack.mitre.org/techniques/T1087/001/ tags: analytic_story: - - Winter Vivern - - Active Directory Discovery - - Water Gamayun + - Winter Vivern + - Active Directory Discovery + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1087.001 + - T1087.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/endpoint/lolbas_with_network_traffic.yml index e1372606ea..b7136b6e89 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/endpoint/lolbas_with_network_traffic.yml @@ -1,11 +1,12 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 -version: 9 -date: '2025-04-17' +version: 8 +date: '2025-04-22' author: Steven Dick status: production type: TTP -description: The following analytic identifies the use of Living Off the Land Binaries +description: + The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently @@ -14,8 +15,9 @@ description: The following analytic identifies the use of Living Off the Land Bi to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: -- Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 3 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where (All_Traffic.app IN ("*Regsvcs.exe", "*\\Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe", "*Xwizard.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe", @@ -34,57 +36,60 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=app ".*\\\(?.*)$" | `lolbas_with_network_traffic_filter`' -how_to_implement: To successfully implement this detection you must ingest events +how_to_implement: + To successfully implement this detection you must ingest events into the Network traffic data model that contain the source, destination, and communicating process in the app field. Relevant processes must also be ingested in the Endpoint data model with matching process_id field. Sysmon EID1 and EID3 are good examples of this type this data type. -known_false_positives: Legitimate usage of internal automation or scripting, especially +known_false_positives: + Legitimate usage of internal automation or scripting, especially powershell.exe or pwsh.exe, internal to internal or logon scripts. It may be necessary to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1") references: -- https://lolbas-project.github.io/# -- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ drilldown_searches: -- name: View the detection results for - "$src$" - search: '%original_detection_search% | search src = "$src$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: The LOLBAS $process_name$ on device $src$ was seen communicating with $dest$. risk_objects: - - field: src - type: system - score: 25 + - field: src + type: system + score: 25 threat_objects: - - field: dest_ip - type: ip_address + - field: dest_ip + type: ip_address tags: analytic_story: - - Living Off The Land - - Water Gamayun + - Living Off The Land + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1105 - - T1567 - - T1218 + - T1105 + - T1567 + - T1218 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: network tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index e88d82648d..bc333c82c0 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -1,11 +1,12 @@ name: Malicious InProcServer32 Modification id: 127c8d08-25ff-11ec-9223-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects a process modifying the registry with +description: + The following analytic detects a process modifying the registry with a known malicious CLSID under InProcServer32. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications within the HKLM or HKCU Software Classes CLSID paths. This activity is significant as it may indicate @@ -13,16 +14,18 @@ description: The following analytic detects a process modifying the registry wit malicious, this could allow an attacker to persist in the environment, execute arbitrary code, or escalate privileges, posing a severe threat to system integrity and security. data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + - Sysmon EventID 12 + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -31,52 +34,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives should be limited, filter as needed. In our +known_false_positives: + False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. references: -- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ -- https://tria.ge/210929-ap75vsddan -- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 + - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ + - https://tria.ge/210929-ap75vsddan + - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A process identified on endpoint $dest$ modifying the registry with a known + message: + A process identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. risk_objects: - - field: dest - type: system - score: 80 + - field: dest + type: system + score: 80 threat_objects: [] tags: analytic_story: - - Suspicious Regsvr32 Activity - - Remcos + - Suspicious Regsvr32 Activity + - Remcos asset_type: Endpoint mitre_attack_id: - - T1218.010 - - T1112 + - T1218.010 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml index 2398e5b455..39519c3105 100644 --- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml @@ -1,11 +1,12 @@ name: Mmc LOLBAS Execution Process Spawn id: f6601940-4c74-11ec-b9b7-3e22fbd008af -version: 8 -date: '2025-04-17' +version: 7 +date: '2025-04-22' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution +description: + The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `mmc.exe` is the parent process. This activity is significant because adversaries can abuse the DCOM protocol and MMC20 COM object @@ -14,10 +15,11 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu allowing attackers to execute code remotely, potentially leading to further compromise and persistence within the environment. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", @@ -37,7 +39,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -46,50 +49,52 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Legitimate applications may trigger this behavior, filter as +known_false_positives: + Legitimate applications may trigger this behavior, filter as needed. references: -- https://attack.mitre.org/techniques/T1021/003/ -- https://www.cybereason.com/blog/dcom-lateral-movement-techniques -- https://lolbas-project.github.io/ + - https://attack.mitre.org/techniques/T1021/003/ + - https://www.cybereason.com/blog/dcom-lateral-movement-techniques + - https://lolbas-project.github.io/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Mmc.exe spawned a LOLBAS process on $dest$. risk_objects: - - field: dest - type: system - score: 54 + - field: dest + type: system + score: 54 threat_objects: [] tags: analytic_story: - - Active Directory Lateral Movement - - Living Off The Land - - Water Gamayun + - Active Directory Lateral Movement + - Living Off The Land + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1021.003 - - T1218.014 + - T1021.003 + - T1218.014 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/potential_telegram_api_request_via_commandline.yml b/detections/endpoint/potential_telegram_api_request_via_commandline.yml index d6b3e73520..a187136d1f 100644 --- a/detections/endpoint/potential_telegram_api_request_via_commandline.yml +++ b/detections/endpoint/potential_telegram_api_request_via_commandline.yml @@ -1,11 +1,12 @@ name: Potential Telegram API Request Via CommandLine id: d6b0d627-d0bf-46b1-936f-c48284767d21 -version: 4 -date: '2025-04-17' +version: 3 +date: '2025-04-22' author: Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa status: production type: Anomaly -description: The following analytic detects the presence of "api.telegram.org" in +description: + The following analytic detects the presence of "api.telegram.org" in the CommandLine of a process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity can be significant as the telegram API has been used as an exfiltration @@ -13,10 +14,11 @@ description: The following analytic detects the presence of "api.telegram.org" i or malware to exfiltrate data or receive additional C2 instruction, potentially leading to further compromise and persistence within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process= "*api.telegram.org*" NOT Processes.process IN ("*-osint -url*", "* --single-argument*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potential_telegram_api_request_via_commandline_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -35,53 +38,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positive may stem from application or users requesting +known_false_positives: + False positive may stem from application or users requesting the API directly via CommandLine for testing purposes. Investigate the matches and apply the necessary filters. references: -- https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior -- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior -- https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content -- https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content + - https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior + - https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior + - https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content + - https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Process $process_name$ with command line $process$ in $dest$ risk_objects: - - field: dest - type: system - score: 30 + - field: dest + type: system + score: 30 threat_objects: - - field: process_name - type: process_name + - field: process_name + type: process_name tags: analytic_story: - - XMRig - - Water Gamayun + - XMRig + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1102.002 - - T1041 + - T1102.002 + - T1041 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 43e640bb2e..d710231880 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,11 +1,12 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 16 -date: '2025-04-17' +version: 15 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Hunting -description: The following analytic identifies suspicious PowerShell execution using +description: + The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers @@ -14,8 +15,9 @@ description: The following analytic identifies suspicious PowerShell execution u execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security. data_source: -- Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), + - Powershell Script Block Logging 4104 +search: + '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) @@ -43,51 +45,52 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | rename Computer as dest, UserID as user | `powershell_4104_hunting_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs +how_to_implement: + The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Limited false positives. May filter as needed. references: -- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md -- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell -- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt -- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1 -- https://www.mandiant.com/resources/greater-visibilityt -- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ -- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html -- https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ + - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md + - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell + - https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt + - https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ + - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1 + - https://www.mandiant.com/resources/greater-visibilityt + - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ + - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html + - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ tags: analytic_story: - - Braodo Stealer - - Cactus Ransomware - - China-Nexus Threat Activity - - CISA AA23-347A - - CISA AA24-241A - - Cleo File Transfer Software - - DarkGate Malware - - Data Destruction - - Flax Typhoon - - Hermetic Wiper - - Lumma Stealer - - Malicious PowerShell - - Medusa Ransomware - - Rhysida Ransomware - - Salt Typhoon - - SystemBC - - PHP-CGI RCE Attack on Japanese Organizations - - Water Gamayun + - Braodo Stealer + - Cactus Ransomware + - China-Nexus Threat Activity + - CISA AA23-347A + - CISA AA24-241A + - Cleo File Transfer Software + - DarkGate Malware + - Data Destruction + - Flax Typhoon + - Hermetic Wiper + - Lumma Stealer + - Malicious PowerShell + - Medusa Ransomware + - Rhysida Ransomware + - Salt Typhoon + - SystemBC + - PHP-CGI RCE Attack on Japanese Organizations + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1059.001 + - T1059.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index e8f0fd28c6..8950bff300 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -1,11 +1,12 @@ name: Powershell Creating Thread Mutex id: 637557ec-ca08-11eb-bd0a-acde48001122 -version: 10 -date: '2025-04-17' +version: 9 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of PowerShell scripts using +description: + The following analytic detects the execution of PowerShell scripts using the `mutex` function via EventCode 4104. This detection leverages PowerShell Script Block Logging to identify scripts that create thread mutexes, a technique often used in obfuscated scripts to ensure only one instance runs on a compromised machine. @@ -14,62 +15,66 @@ description: The following analytic detects the execution of PowerShell scripts control over a process, potentially leading to further exploitation or persistence within the environment. data_source: -- Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | fillnull + - Powershell Script Block Logging 4104 +search: + '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable +how_to_implement: + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: powershell developer may used this function in their script +known_false_positives: + powershell developer may used this function in their script for instance checking too. references: -- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/ -- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 -- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf -- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/ + - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 + - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf + - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user_id$" - search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user_id$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A suspicious powershell script contains Thread Mutex on host $dest$ risk_objects: - - field: dest - type: system - score: 40 - - field: user_id - type: user - score: 40 + - field: dest + type: system + score: 40 + - field: user_id + type: user + score: 40 threat_objects: [] tags: analytic_story: - - Malicious PowerShell - - Water Gamayun + - Malicious PowerShell + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1027.005 - - T1059.001 + - T1027.005 + - T1059.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 1d77d40f68..d2990b0d4e 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,11 +1,12 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-22' author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the presence of a registry key associated +description: + The following analytic detects the presence of a registry key associated with the Remcos RAT agent on a host. It leverages data from the Endpoint.Processes and Endpoint.Registry data models in Splunk, focusing on instances where the "license" key is found in the "Software\Remcos" path. This behavior is significant as it indicates @@ -14,16 +15,18 @@ description: The following analytic detects the presence of a registry key assoc over the system, steal sensitive information, or use the compromised host for further attacks. Immediate investigation and remediation are required. data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + - Sysmon EventID 12 + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`remcos_client_registry_install_entry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -34,44 +37,46 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://attack.mitre.org/software/S0332/ + - https://attack.mitre.org/software/S0332/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A registry entry $registry_path$ with registry keyname $registry_key_name$ + message: + A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ risk_objects: - - field: dest - type: system - score: 90 + - field: dest + type: system + score: 90 threat_objects: [] tags: analytic_story: - - Remcos - - Windows Registry Abuse + - Remcos + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index febc39bf6a..ab85a04276 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -1,11 +1,12 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-22' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic identifies suspicious modifications in the registry +description: + The following analytic identifies suspicious modifications in the registry entry, specifically targeting paths used by malware like REVIL. It detects changes in registry paths such as `SOFTWARE\\WOW6432Node\\Facebook_Assistant` and `SOFTWARE\\WOW6432Node\\BlackLivesMatter`. This detection leverages data from Endpoint Detection and Response (EDR) agents, @@ -15,9 +16,10 @@ description: The following analytic identifies suspicious modifications in the r attackers to maintain persistence, encrypt files, and store critical ransomware-related information on compromised hosts. data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + - Sysmon EventID 12 + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path @@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_registry_entry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,49 +39,51 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ + - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ + - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A registry entry $registry_path$ with registry value $registry_value_name$ + message: + A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ risk_objects: - - field: dest - type: system - score: 60 - - field: user - type: user - score: 60 + - field: dest + type: system + score: 60 + - field: user + type: user + score: 60 threat_objects: [] tags: analytic_story: - - Ransomware - - Revil Ransomware - - Windows Registry Abuse + - Ransomware + - Revil Ransomware + - Windows Registry Abuse asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index dd2b27110a..85db4c3643 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -1,11 +1,12 @@ name: Rundll32 Shimcache Flush id: a913718a-25b6-11ec-96d3-acde48001122 -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of a suspicious rundll32 +description: + The following analytic detects the execution of a suspicious rundll32 command line used to clear the shim cache. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because clearing the shim cache is an anti-forensic @@ -13,10 +14,11 @@ description: The following analytic detects the execution of a suspicious rundll malicious, this action could hinder incident response efforts, allowing an attacker to cover their tracks and maintain persistence on the compromised machine. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid @@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,47 +39,48 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://blueteamops.medium.com/shimcache-flush-89daff28d15e + - https://blueteamops.medium.com/shimcache-flush-89daff28d15e drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: rundll32 process execute $process$ to clear shim cache on $dest$ risk_objects: - - field: dest - type: system - score: 80 - - field: user - type: user - score: 80 + - field: dest + type: system + score: 80 + - field: user + type: user + score: 80 threat_objects: [] tags: analytic_story: - - Unusual Processes - - Living Off The Land - - Compromised Windows Host + - Unusual Processes + - Living Off The Land + - Compromised Windows Host asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 433ca7743f..91c2570260 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -1,11 +1,12 @@ name: Suspicious Copy on System32 id: ce633e56-25b2-11ec-9e76-acde48001122 -version: 10 -date: '2025-04-17' +version: 9 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file copy operations from the +description: + The following analytic detects suspicious file copy operations from the System32 or SysWow64 directories, often indicative of malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes initiated by command-line tools like cmd.exe or PowerShell. This behavior is significant as @@ -14,10 +15,11 @@ description: The following analytic detects suspicious file copy operations from arbitrary code, potentially leading to system compromise or further lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*") @@ -30,7 +32,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | eval splitted_commandline=split(process," ") | eval first_cmdline=lower(mvindex(splitted_commandline,0)) | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`suspicious_copy_on_system32_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -41,53 +44,54 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: every user may do this event but very un-ussual. references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 + - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Execution of copy exe to copy file from $process$ on $dest$ risk_objects: - - field: dest - type: system - score: 63 - - field: user - type: user - score: 63 + - field: dest + type: system + score: 63 + - field: user + type: user + score: 63 threat_objects: [] tags: analytic_story: - - Qakbot - - Sandworm Tools - - IcedID - - Volt Typhoon - - AsyncRAT - - Unusual Processes - - Compromised Windows Host - - Water Gamayun + - Qakbot + - Sandworm Tools + - IcedID + - Volt Typhoon + - AsyncRAT + - Unusual Processes + - Compromised Windows Host + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1036.003 + - T1036.003 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 0617392f9a..e2236b5130 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -1,11 +1,12 @@ name: Suspicious Process Executed From Container File id: d8120352-3b62-411c-8cb6-7b47584dd5e8 -version: 7 -date: '2025-04-17' +version: 6 +date: '2025-04-22' author: Steven Dick status: production type: TTP -description: The following analytic identifies a suspicious process executed from +description: + The following analytic identifies a suspicious process executed from within common container/archive file types such as ZIP, ISO, IMG, and others. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is a common @@ -13,10 +14,11 @@ description: The following analytic identifies a suspicious process executed fro malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") AND Processes.action="allowed" by Processes.action Processes.dest Processes.original_file_name @@ -28,7 +30,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces | regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" | rex field=process "(?i).+\\\\(?[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -39,54 +42,55 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: Various business process or userland applications and behavior. references: -- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations -- https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/ -- https://attack.mitre.org/techniques/T1204/002/ + - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations + - https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/ + - https://attack.mitre.org/techniques/T1204/002/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A suspicious process $process_name$ was launched from $file_name$ on $dest$. risk_objects: - - field: dest - type: system - score: 16 - - field: user - type: user - score: 16 + - field: dest + type: system + score: 16 + - field: user + type: user + score: 16 threat_objects: - - field: file_name - type: file_name + - field: file_name + type: file_name tags: analytic_story: - - Unusual Processes - - Amadey - - Remcos - - Snake Keylogger - - Water Gamayun + - Unusual Processes + - Amadey + - Remcos + - Snake Keylogger + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1204.002 - - T1036.008 + - T1204.002 + - T1036.008 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 13523532b8..8ecaf28eef 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -1,11 +1,12 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -version: 10 -date: '2024-11-13' +version: 11 +date: '2025-04-22' author: David Dorsey, Splunk status: production type: Anomaly -description: The following analytic identifies instances of reg.exe being launched +description: + The following analytic identifies instances of reg.exe being launched from a command prompt (cmd.exe) that was not initiated by the user, as indicated by a parent process other than explorer.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process @@ -15,10 +16,11 @@ description: The following analytic identifies instances of reg.exe being launch to modify critical system settings, potentially leading to privilege escalation or persistent access. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name != explorer.exe Processes.process_name =cmd.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec @@ -32,7 +34,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename parent_process_id as process_id |dedup process_id| table process_id dest] | `suspicious_reg_exe_process_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -41,56 +44,59 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: It's possible for system administrators to write scripts that +known_false_positives: + It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. references: -- https://car.mitre.org/wiki/CAR-2013-03-001/ + - https://car.mitre.org/wiki/CAR-2013-03-001/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a registry entry. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows Defense Evasion Tactics - - Disabling Security Tools - - DHS Report TA18-074A + - Windows Defense Evasion Tactics + - Disabling Security Tools + - DHS Report TA18-074A asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index 75e7111e99..af36506aad 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -1,11 +1,12 @@ name: Windows Cmdline Tool Execution From Non-Shell Process id: 2afa393f-b88d-41b7-9793-623c93a2dfde -version: 6 -date: '2025-04-17' +version: 5 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, +description: + The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant @@ -14,10 +15,11 @@ description: The following analytic identifies instances where `ipconfig.exe`, ` allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", @@ -29,7 +31,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -38,65 +41,68 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: A network operator or systems administrator may utilize an +known_false_positives: + A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation + - https://attack.mitre.org/groups/G0046/ + - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A non-standard parent process $parent_process_name$ spawned child process + message: + A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. risk_objects: - - field: dest - type: system - score: 56 - - field: user - type: user - score: 56 + - field: dest + type: system + score: 56 + - field: user + type: user + score: 56 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - CISA AA22-277A - - Gozi Malware - - CISA AA23-347A - - Qakbot - - Medusa Ransomware - - DarkGate Malware - - Rhysida Ransomware - - Volt Typhoon - - FIN7 - - Water Gamayun + - CISA AA22-277A + - Gozi Malware + - CISA AA23-347A + - Qakbot + - Medusa Ransomware + - DarkGate Malware + - Rhysida Ransomware + - Volt Typhoon + - FIN7 + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1059.007 + - T1059.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml index d79a433c88..2102119480 100644 --- a/detections/endpoint/windows_defender_asr_registry_modification.yml +++ b/detections/endpoint/windows_defender_asr_registry_modification.yml @@ -1,13 +1,14 @@ name: Windows Defender ASR Registry Modification id: 6a1b6cbe-6612-44c3-92b9-1a1bd77412eb -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Hunting data_source: -- Windows Event Log Defender 5007 -description: The following analytic detects modifications to Windows Defender Attack + - Windows Event Log Defender 5007 +description: + The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by @@ -15,7 +16,8 @@ description: The following analytic detects modifications to Windows Defender At an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches. -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" +search: + '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval @@ -25,33 +27,34 @@ search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" +search: + '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval @@ -24,52 +26,54 @@ search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -49,42 +52,43 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/ + - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Registry with binary data created by $process_name$ on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Qakbot + - Qakbot asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index 3fc45fe76a..41701c6e43 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -1,11 +1,12 @@ name: Windows Modify Registry Regedit Silent Reg Import id: 824dd598-71be-4203-bc3b-024f4cda340e -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the modification of the Windows registry +description: + The following analytic detects the modification of the Windows registry using the regedit.exe application with the silent mode parameter. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because the silent mode allows @@ -14,10 +15,11 @@ description: The following analytic detects the modification of the Windows regi attackers to persist in the environment, escalate privileges, or manipulate system configurations, leading to potential system compromise. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.action @@ -28,7 +30,8 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -37,47 +40,50 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators may execute this command that may cause some +known_false_positives: + Administrators may execute this command that may cause some false positive. Filter as needed. references: -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ -- https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe + - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: The regedit app was executed with silet mode parameter to import .reg file + message: + The regedit app was executed with silet mode parameter to import .reg file on $dest$. risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Azorult + - Azorult asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index a75f59daff..575020a9a2 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -1,11 +1,12 @@ name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects modifications in the Windows registry +description: + The following analytic detects modifications in the Windows registry to suppress Windows Defender notifications. It leverages data from the Endpoint.Registry datamodel, specifically targeting changes to the "Notification_Suppress" registry value. This activity is significant because adversaries, including those deploying @@ -14,8 +15,9 @@ description: The following analytic detects modifications in the Windows registr detection, maintain persistence, and execute further malicious activities without alerting the user or security tools. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,52 +25,56 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may +known_false_positives: + administrators may enable or disable this feature that may cause some false positive. references: -- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp -- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp + - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: the registry for suppresing windows fdefender notification settings was + message: + the registry for suppresing windows fdefender notification settings was modified to disabled on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Azorult - - CISA AA23-347A + - Azorult + - CISA AA23-347A asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index 9634e06bbd..d08ffdf575 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry Tamper Protection id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Sysmon EventID 13 -description: The following analytic detects a suspicious modification to the Windows + - Sysmon EventID 13 +description: + The following analytic detects a suspicious modification to the Windows Defender Tamper Protection registry setting. It leverages data from the Endpoint datamodel, specifically targeting changes where the registry path is set to disable Tamper Protection. This activity is significant because disabling Tamper Protection @@ -15,7 +16,8 @@ description: The following analytic detects a suspicious modification to the Win potentially leading to reduced security on the system. If confirmed malicious, this could enable attackers to evade detection, persist in the environment, and execute further malicious activities without interference from Windows Defender. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection" AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,52 +25,55 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_tamper_protection_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may enable or disable this feature that may +known_false_positives: + Administrators may enable or disable this feature that may cause some false positive. references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A registry modification to tamper Windows Defender protection on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 12e03af7-79f9-4f95-af48-d3f12f28a260 mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml index 076a776081..2e443fed5a 100644 --- a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml +++ b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml @@ -1,73 +1,78 @@ name: Windows Modify Registry to Add or Modify Firewall Rule id: 43254751-e2ce-409a-b6b4-4f851e8dcc26 -version: 6 -date: '2024-12-08' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 -- Sysmon EventID 14 + - Sysmon EventID 13 + - Sysmon EventID 14 type: Anomaly status: production -description: The following analytic detects a potential addition or modification of +description: + The following analytic detects a potential addition or modification of firewall rules, signaling possible configuration changes or security policy adjustments. It tracks commands such as netsh advfirewall firewall add rule and netsh advfirewall firewall set rule, which may indicate attempts to alter network access controls. Monitoring these actions ensures the integrity of firewall settings and helps prevent unauthorized network access. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.action = modified by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_to_add_or_modify_firewall_rule_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: network admin may add/remove/modify public inbound firewall +known_false_positives: + network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. references: -- https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: firewall deletion found in registry on $dest$ risk_objects: - - field: user - type: user - score: 25 - - field: dest - type: system - score: 25 + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - ShrinkLocker - - CISA AA24-241A + - ShrinkLocker + - CISA AA24-241A asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml index dabe7abc87..d9f015b52c 100644 --- a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml +++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry UpdateServiceUrlAlternate id: ca4e94fb-7969-4d63-8630-3625809a1f70 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly data_source: -- Sysmon EventID 13 -description: The following analytic detects a suspicious modification to the Windows + - Sysmon EventID 13 +description: + The following analytic detects a suspicious modification to the Windows Update configuration registry key, specifically targeting the UpdateServiceUrlAlternate setting. It leverages data from the Endpoint.Registry datamodel to identify changes to this registry path. This activity is significant because adversaries, including @@ -15,57 +16,61 @@ description: The following analytic detects a suspicious modification to the Win additional payloads. If confirmed malicious, this modification could allow attackers to redirect update services, potentially leading to the execution of malicious code, further system compromise, and persistent evasion of security defenses. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\UpdateServiceUrlAlternate" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_updateserviceurlalternate_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may enable or disable this feature that may +known_false_positives: + Administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A registry modification in Windows auto update configuration on $dest$ risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml index ff68181b94..9129b422fd 100644 --- a/detections/endpoint/windows_modify_registry_usewuserver.yml +++ b/detections/endpoint/windows_modify_registry_usewuserver.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry USeWuServer id: c427bafb-0b2c-4b18-ad85-c03c6fed9e75 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Hunting data_source: -- Sysmon EventID 13 -description: The following analytic detects a suspicious modification to the Windows + - Sysmon EventID 13 +description: + The following analytic detects a suspicious modification to the Windows Update configuration registry key "UseWUServer." It leverages data from the Endpoint.Registry data model to identify changes where the registry value is set to "0x00000001." This activity is significant because it is commonly used by adversaries, including @@ -15,36 +16,39 @@ description: The following analytic detects a suspicious modification to the Win zero-day vulnerabilities. If confirmed malicious, this modification could allow attackers to evade defenses, persist on the target host, and deploy additional malicious payloads. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\UseWUServer" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_usewuserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: administrators may enable or disable this feature that may +known_false_positives: + administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_utilize_progids.yml b/detections/endpoint/windows_modify_registry_utilize_progids.yml index e555a5a77f..8cfc59d5df 100644 --- a/detections/endpoint/windows_modify_registry_utilize_progids.yml +++ b/detections/endpoint/windows_modify_registry_utilize_progids.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry Utilize ProgIDs id: 64fa82dd-fd11-472a-9e94-c221fffa591d -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: Anomaly status: production -description: The following analytic detects modifications to the Windows Registry +description: + The following analytic detects modifications to the Windows Registry specifically targeting Programmatic Identifier associations to bypass User Account Control (UAC) Windows OS feature. ValleyRAT may create or alter registry entries to targetted progIDs like `.pwn` files with malicious processes, allowing it to @@ -16,60 +17,63 @@ description: The following analytic detects modifications to the Windows Registr analysts to identify potential threats like ValleyRAT execution attempts. Early detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\ms-settings\\CurVer\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_utilize_progids_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers -- https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A possible ValleyRAT Registry modification in [$dest$]. risk_objects: - - field: user - type: user - score: 49 - - field: dest - type: system - score: 49 + - field: user + type: user + score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - ValleyRAT + - ValleyRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml index 5175b182e2..c210c9a573 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry ValleyRAT C2 Config id: ac59298a-8d81-4c02-8c9b-ffdac993891f -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: TTP status: production -description: "The following analytic detects modifications to theregistry related\ +description: + "The following analytic detects modifications to theregistry related\ \ to ValleyRAT C2 configuration. Specifically, it monitors changes in registry\ \ keys where ValleyRAT saves the IP address and port information of its command-and-control\ \ (C2) server. This activity is a key indicator of ValleyRAT attempting to establish\ @@ -16,7 +17,8 @@ description: "The following analytic detects modifications to theregistry relate \ and investigate the associated threats. Early detection of these changes helps\ \ prevent further exploitation and limits the malware\u2019s ability to exfiltrate\ \ data or control infected systems." -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Console\\IpDateInfo" AND Registry.registry_value_data="Binary Data") OR (Registry.registry_path= "*\\Console\\SelfPath" AND Registry.registry_value_data="*.exe") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -24,52 +26,54 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_c2_config_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A registry modification related to ValleyRAT on [$dest$] risk_objects: - - field: user - type: user - score: 90 - - field: dest - type: system - score: 90 + - field: user + type: user + score: 90 + - field: dest + type: system + score: 90 threat_objects: [] tags: analytic_story: - - ValleyRAT + - ValleyRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml index 913c572d24..88c4397f92 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry ValleyRat PWN Reg Entry id: 6947c44e-be1f-4dd9-b198-bc42be5be196 -version: 7 -date: '2024-12-16' +version: 8 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: TTP status: production -description: The following analytic detects modifications to the Windows Registry +description: + The following analytic detects modifications to the Windows Registry specifically targeting `.pwn` file associations related to the ValleyRAT malware. ValleyRAT may create or alter registry entries to associate `.pwn` files with malicious processes, allowing it to execute harmful scripts or commands when these files are @@ -15,59 +16,62 @@ description: The following analytic detects modifications to the Windows Registr this detection enables security analysts to identify potential ValleyRAT infection attempts. Early detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*.pwn\\Shell\\Open\\command" OR Registry.registry_value_data = ".pwn") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_pwn_reg_entry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A possible ValleyRAT Registry modification in [$dest$]. risk_objects: - - field: user - type: user - score: 90 - - field: dest - type: system - score: 90 + - field: user + type: user + score: 90 + - field: dest + type: system + score: 90 threat_objects: [] tags: analytic_story: - - ValleyRAT + - ValleyRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 02b792d50b..6f73c081c0 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry With MD5 Reg Key Name id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Sysmon EventID 13 -description: The following analytic detects potentially malicious registry modifications + - Sysmon EventID 13 +description: + The following analytic detects potentially malicious registry modifications characterized by MD5-like registry key names. It leverages the Endpoint data model to identify registry entries under the SOFTWARE path with 32-character hexadecimal names, a technique often used by NjRAT malware for fileless storage of keylogs and @@ -15,7 +16,8 @@ description: The following analytic detects potentially malicious registry modif or similar malware, which can lead to unauthorized data access and persistent threats within the environment. If confirmed malicious, attackers could maintain persistence and exfiltrate sensitive information. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path @@ -28,47 +30,49 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_with_md5_reg_key_name_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. known_false_positives: unknown references: -- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A md5 registry value name $registry_value_name$ is created on $dest$ risk_objects: - - field: dest - type: system - score: 36 + - field: dest + type: system + score: 36 threat_objects: [] tags: analytic_story: - - NjRAT + - NjRAT asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml index c28ee4daa0..08f8560fa5 100644 --- a/detections/endpoint/windows_modify_registry_wuserver.yml +++ b/detections/endpoint/windows_modify_registry_wuserver.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry WuServer id: a02ad386-e26d-44ce-aa97-6a46cee31439 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Hunting data_source: -- Sysmon EventID 13 -description: The following analytic detects suspicious modifications to the Windows + - Sysmon EventID 13 +description: + The following analytic detects suspicious modifications to the Windows Update Server (WUServer) registry settings. It leverages data from the Endpoint.Registry data model to identify changes in the registry path associated with Windows Update configurations. This activity is significant because adversaries, including malware @@ -15,36 +16,39 @@ description: The following analytic detects suspicious modifications to the Wind payloads. If confirmed malicious, this registry modification could allow attackers to evade defenses, potentially leading to further system compromise and persistent unauthorized access. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_wuserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Administrators may enable or disable this feature that may +known_false_positives: + Administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml index 4896a0a1b3..145fb004f7 100644 --- a/detections/endpoint/windows_modify_registry_wustatusserver.yml +++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml @@ -1,13 +1,14 @@ name: Windows Modify Registry wuStatusServer id: 073e69d0-68b2-4142-aa90-a7ee6f590676 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Hunting data_source: -- Sysmon EventID 13 -description: The following analytic identifies suspicious modifications to the Windows + - Sysmon EventID 13 +description: + The following analytic identifies suspicious modifications to the Windows Update configuration registry, specifically targeting the WUStatusServer key. It leverages data from the Endpoint datamodel to detect changes in the registry path associated with Windows Update settings. This activity is significant as it is commonly @@ -15,36 +16,39 @@ description: The following analytic identifies suspicious modifications to the W and deploy additional payloads. If confirmed malicious, this modification could allow attackers to evade defenses, potentially leading to further system compromise and persistent unauthorized access. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUStatusServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_wustatusserver_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: administrators may enable or disable this feature that may +known_false_positives: + administrators may enable or disable this feature that may cause some false positive. references: -- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 tags: analytic_story: - - RedLine Stealer + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 35edca0366..9dd34be412 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -1,11 +1,12 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 9 -date: '2024-12-08' +version: 10 +date: '2025-04-22' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects suspicious modifications to the Windows +description: + The following analytic detects suspicious modifications to the Windows registry keys related to file compression color and information tips. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "ShowCompColor" and "ShowInfoTip" values under the "Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" @@ -14,8 +15,9 @@ description: The following analytic detects suspicious modifications to the Wind elements. If confirmed malicious, this could signify an attempt to manipulate file visibility and deceive users, potentially aiding in further malicious activities. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path @@ -23,51 +25,53 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: unknown references: -- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Data Destruction - - Windows Defense Evasion Tactics - - Windows Registry Abuse - - Hermetic Wiper + - Data Destruction + - Windows Defense Evasion Tactics + - Windows Registry Abuse + - Hermetic Wiper asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 5560dc4fa8..0fef996e02 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -1,11 +1,12 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 -version: 9 -date: '2025-04-17' +version: 8 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the execution of msiexec.exe with the +description: + The following analytic detects the execution of msiexec.exe with the /y switch parameter, which enables the loading of DLLRegisterServer. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and parent-child process relationships. This activity is @@ -14,10 +15,11 @@ description: The following analytic detects the execution of msiexec.exe with th this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*/y*", "*-y*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -35,55 +38,58 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: This analytic will need to be tuned for your environment based +known_false_positives: + This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed. references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows System Binary Proxy Execution MSIExec - - Water Gamayun + - Windows System Binary Proxy Execution MSIExec + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml index ade8a5d6e3..adb2ad97a5 100644 --- a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml +++ b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml @@ -1,15 +1,16 @@ name: Windows MsiExec HideWindow Rundll32 Execution id: 9683271d-92e4-43b5-a907-1983bfb9f7fd -version: 8 -date: '2025-04-17' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -description: The following analytic detects the execution of the msiexec.exe process + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +description: + The following analytic detects the execution of the msiexec.exe process with the /HideWindow and rundll32 command-line parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant because it is a known tactic @@ -17,7 +18,8 @@ description: The following analytic detects the execution of the msiexec.exe pro processes. If confirmed malicious, this behavior could allow an attacker to download additional payloads, execute malicious code, or establish communication with remote servers, thereby evading detection and maintaining persistence. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = msiexec.exe Processes.process = "* /HideWindow *" Processes.process = "* rundll32*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_hidewindow_rundll32_execution_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,48 +39,51 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Other possible 3rd party msi software installers use this technique +known_false_positives: + Other possible 3rd party msi software installers use this technique as part of its installation process. references: -- https://twitter.com/Max_Mal_/status/1736392741758611607 -- https://twitter.com/1ZRR4H/status/1735944522075386332 + - https://twitter.com/Max_Mal_/status/1736392741758611607 + - https://twitter.com/1ZRR4H/status/1735944522075386332 drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: a msiexec parent process with /hidewindow rundll32 process commandline + message: + a msiexec parent process with /hidewindow rundll32 process commandline on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Qakbot - - Water Gamayun + - Qakbot + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 0993062cb7..b1679fde89 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -1,11 +1,12 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda -version: 9 -date: '2025-04-17' +version: 8 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the use of msiexec.exe with an HTTP or +description: + The following analytic detects the use of msiexec.exe with an HTTP or HTTPS URL in the command line, indicating a remote file download attempt. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant as @@ -13,10 +14,11 @@ description: The following analytic detects the use of msiexec.exe with an HTTP from a remote server. If confirmed malicious, this could lead to unauthorized code execution, system compromise, or further malware deployment within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*http://*", "*https://*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid @@ -25,7 +27,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -34,55 +37,58 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives may be present, filter by destination or parent +known_false_positives: + False positives may be present, filter by destination or parent process as needed. references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows System Binary Proxy Execution MSIExec - - Water Gamayun + - Windows System Binary Proxy Execution MSIExec + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index 1edf4fac8b..ef90b82190 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -1,11 +1,12 @@ name: Windows MSIExec Spawn Discovery Command id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee -version: 10 -date: '2025-04-17' +version: 9 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects MSIExec spawning multiple discovery commands, +description: + The following analytic detects MSIExec spawning multiple discovery commands, such as Cmd.exe or PowerShell.exe. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where MSIExec is the parent process. This activity is significant because MSIExec typically does @@ -14,10 +15,11 @@ description: The following analytic detects MSIExec spawning multiple discovery system information, potentially leading to further exploitation or lateral movement within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe", "pwsh.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_spawn_discovery_command_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -36,57 +39,60 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives will be present with MSIExec spawning Cmd or +known_false_positives: + False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query. references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified + message: + An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands. risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - - Windows System Binary Proxy Execution MSIExec - - Medusa Ransomware - - Water Gamayun + - Windows System Binary Proxy Execution MSIExec + - Medusa Ransomware + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1218.007 + - T1218.007 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_inprocserver32_added.yml b/detections/endpoint/windows_new_inprocserver32_added.yml index ac2d4ce5ad..3f5d60bc3b 100644 --- a/detections/endpoint/windows_new_inprocserver32_added.yml +++ b/detections/endpoint/windows_new_inprocserver32_added.yml @@ -1,13 +1,14 @@ name: Windows New InProcServer32 Added id: 0fa86e31-0f73-4ec7-9ca3-dc88e117f1db -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-04-22' author: Michael Haag, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: Hunting status: production -description: The following analytic detects the addition of new InProcServer32 registry +description: + The following analytic detects the addition of new InProcServer32 registry keys on Windows endpoints. It leverages data from the Endpoint.Registry datamodel to identify changes in registry paths associated with InProcServer32. This activity is significant because malware often uses this mechanism to achieve persistence @@ -15,35 +16,37 @@ description: The following analytic detects the addition of new InProcServer32 r harmful DLL. If confirmed malicious, this could allow an attacker to persist in the environment or execute arbitrary code, posing a significant threat to system integrity and security. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: + '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.dest Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_inprocserver32_added_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. -known_false_positives: False positives are expected. Filtering will be needed to properly +known_false_positives: + False positives are expected. Filtering will be needed to properly reduce legitimate applications from the results. references: -- https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/ + - https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/ tags: analytic_story: - - Outlook RCE CVE-2024-21378 + - Outlook RCE CVE-2024-21378 asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint cve: - - CVE-2024-21378 + - CVE-2024-21378 tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index c45090b83e..44f6bbe726 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -1,13 +1,14 @@ name: Windows Outlook WebView Registry Modification id: 6e1ad5d4-d9af-496a-96ec-f31c11cd09f2 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-04-22' author: Michael Haag, Splunk data_source: -- Sysmon EventID 13 + - Sysmon EventID 13 type: Anomaly status: production -description: The following analytic identifies modifications to specific Outlook registry +description: + The following analytic identifies modifications to specific Outlook registry values related to WebView and Today features. It detects when a URL is set in these registry locations, which could indicate attempts to manipulate Outlook's web-based components. The analytic focuses on changes to the "URL" value within Outlook's @@ -16,7 +17,8 @@ description: The following analytic identifies modifications to specific Outlook If successful, this technique could lead to phishing attempts, data theft, or serve as a stepping stone for further compromise of the user's email client and potentially sensitive information. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_value_name) +search: + '| tstats `security_content_summariesonly` count values(Registry.registry_value_name) as registry_value_name values(Registry.registry_value_data) as registry_value_data min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path="*\\Software\\Microsoft\\Office\\*\\Outlook\\WebView\\*" @@ -26,7 +28,8 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_outlook_webview_registry_modification_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -35,47 +38,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives may occur if legitimate Outlook processes are +known_false_positives: + False positives may occur if legitimate Outlook processes are modified. references: -- https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 -- https://github.com/trustedsec/specula/wiki + - https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 + - https://github.com/trustedsec/specula/wiki drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Modification of Outlook WebView registry values on $dest$. risk_objects: - - field: dest - type: system - score: 100 + - field: dest + type: system + score: 100 threat_objects: [] tags: analytic_story: - - Suspicious Windows Registry Activities + - Suspicious Windows Registry Activities asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint cve: [] tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index a522ea3a70..810324ebeb 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -1,11 +1,12 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c -version: 8 -date: '2025-04-17' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: Anomaly -description: The following analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` +description: + The following analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate @@ -13,58 +14,63 @@ description: The following analytic detects the use of the PowerShell cmdlet `ex malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network. data_source: -- Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*") + - Powershell Script Block Logging 4104 +search: + '`powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_export_pfxcertificate_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable +how_to_implement: + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: It is possible administrators or scripts may run these commands, +known_false_positives: + It is possible administrators or scripts may run these commands, filtering may be required. references: -- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj -- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj + - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A PowerShell Cmdlet related to exporting a PFX Certificate was ran on $dest$, + message: + A PowerShell Cmdlet related to exporting a PFX Certificate was ran on $dest$, attempting to export a certificate. risk_objects: - - field: dest - type: system - score: 36 + - field: dest + type: system + score: 36 threat_objects: [] tags: analytic_story: - - Windows Certificate Services - - Water Gamayun + - Windows Certificate Services + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1552.004 - - T1649 + - T1552.004 + - T1649 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index f534a2c2dc..0fc96cd91b 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,11 +1,12 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 9 -date: '2025-04-17' +version: 7 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious remote thread execution in +description: + The following analytic detects suspicious remote thread execution in processes such as Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware like Qakbot. This detection leverages Sysmon EventCode 8 to identify remote thread creation in specific target processes. This activity is significant @@ -14,8 +15,9 @@ description: The following analytic detects suspicious remote thread execution i this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence on the compromised host. data_source: -- Sysmon EventID 8 -search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", + - Sysmon EventID 8 +search: + '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe","*\\cmd.exe", "*\\powershell.exe") | stats count min(_time) as firstTime max(_time) as lastTime @@ -25,56 +27,59 @@ search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", " parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_remote_thread_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data +how_to_implement: + To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of sysmon. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ + - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg + - https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: process $SourceImage$ create a remote thread to process $TargetImage$ on + message: + process $SourceImage$ create a remote thread to process $TargetImage$ on host $dest$ risk_objects: - - field: dest - type: system - score: 64 + - field: dest + type: system + score: 64 threat_objects: - - field: SourceImage - type: process + - field: SourceImage + type: process tags: analytic_story: - - Qakbot - - Graceful Wipe Out Attack - - Warzone RAT - - Earth Alux - - Water Gamayun + - Qakbot + - Graceful Wipe Out Attack + - Warzone RAT + - Earth Alux + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1055.002 + - T1055.002 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml index e07cecb37e..9ed57c80d7 100644 --- a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml +++ b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml @@ -1,13 +1,14 @@ name: Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr id: feb43b86-8c38-46cd-865e-20ce8a96c26c -version: 7 -date: '2025-04-17' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Windows Event Log Security 4698 + - Windows Event Log Security 4698 type: TTP status: production -description: The following analytic detects the creation or modification of Windows +description: + The following analytic detects the creation or modification of Windows Scheduled Tasks related to CompMgmtLauncher or Eventvwr. These legitimate system utilities, used for launching the Computer Management Console and Event Viewer, can be abused by attackers to execute malicious payloads under the guise of normal @@ -15,55 +16,58 @@ description: The following analytic detects the creation or modification of Wind or elevate privileges without raising suspicion. This detection helps security analysts identify unusual or unauthorized scheduled tasks involving these executables, allowing for timely investigation and remediation of potential threats. -search: '`wineventlog_security` EventCode=4698 TaskContent = "*<Command>C:\\Windows\\System32\\CompMgmtLauncher.exe</Command>*" +search: + '`wineventlog_security` EventCode=4698 TaskContent = "*<Command>C:\\Windows\\System32\\CompMgmtLauncher.exe</Command>*" OR TaskContent = "*<Command>C:\\Windows\\System32\\zh-CN\\eventvwr.msc</Command>*" OR TaskContent = "*<Command>C:\\Windows\\System32\\eventvwr.msc</Command>*" | stats count min(_time) as firstTime max(_time) as lastTime by dest action EventData_Xml TaskContent TaskName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required. known_false_positives: unknown references: -- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape -- https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers + - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape + - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A schedule task created for CompMgmtLauncher or Eventvwr on [$dest$]. risk_objects: - - field: dest - type: system - score: 64 + - field: dest + type: system + score: 64 threat_objects: [] tags: analytic_story: - - ValleyRAT - - Water Gamayun + - ValleyRAT + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1053 + - T1053 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/valleyrat_schedtask/valleyrat_schedtask.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/valleyrat_schedtask/valleyrat_schedtask.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index 28d0c0adc6..b95bc42c46 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -1,69 +1,74 @@ name: Windows Screen Capture Via Powershell id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170 -version: 7 -date: '2025-04-17' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP data_source: -- Powershell Script Block Logging 4104 -description: The following analytic detects the execution of a PowerShell script designed + - Powershell Script Block Logging 4104 +description: + The following analytic detects the execution of a PowerShell script designed to capture screen images on a host. It leverages PowerShell Script Block Logging to identify specific script block text patterns associated with screen capture activities. This behavior is significant as it may indicate an attempt to exfiltrate sensitive information by capturing desktop screenshots. If confirmed malicious, this activity could allow an attacker to gather visual data from the compromised system, potentially leading to data breaches or further exploitation. -search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" +search: + '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" AND ScriptBlockText = "*.CopyFromScreen*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_screen_capture_via_powershell_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable +how_to_implement: + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: unknown references: -- https://twitter.com/_CERT_UA/status/1620781684257091584 -- https://cert.gov.ua/article/3761104 + - https://twitter.com/_CERT_UA/status/1620781684257091584 + - https://cert.gov.ua/article/3761104 drilldown_searches: -- name: View the detection results for - "$Computer$" - search: '%original_detection_search% | search Computer = "$Computer$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$Computer$" + search: '%original_detection_search% | search Computer = "$Computer$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$Computer$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A PowerShell script was identified possibly performing screen captures + message: + A PowerShell script was identified possibly performing screen captures on $dest$. risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - Winter Vivern - - Water Gamayun + - Winter Vivern + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1113 + - T1113 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index 6845aae0ae..16554fffee 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -1,13 +1,14 @@ name: Windows Snake Malware Registry Modification wav OpenWithProgIds id: 13cf8b79-805d-443c-bf52-f55bd7610dfd -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-04-22' author: Michael Haag, Splunk status: production type: TTP data_source: -- Sysmon EventID 13 -description: The following analytic identifies modifications to the registry path + - Sysmon EventID 13 +description: + The following analytic identifies modifications to the registry path .wav\\OpenWithProgIds, associated with the Snake Malware campaign. It leverages data from the Endpoint.Registry datamodel to detect changes in this specific registry location. This activity is significant because Snake's WerFault.exe uses this registry @@ -15,7 +16,8 @@ description: The following analytic identifies modifications to the registry pat IV, and paths for its kernel driver and loader. If confirmed malicious, this could allow the attacker to load and execute Snake's kernel driver, leading to potential system compromise and persistent access. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) +search: + '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive @@ -23,53 +25,57 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_snake_malware_registry_modification_wav_openwithprogids_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present and will require tuning based +known_false_positives: + False positives may be present and will require tuning based on program Ids in large organizations. references: -- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: A registry modification related to Snake Malware has been identified on + message: + A registry modification related to Snake Malware has been identified on $dest$. risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Snake Malware + - Snake Malware asset_type: Endpoint atomic_guid: - - 8318ad20-0488-4a64-98f4-72525a012f6b + - 8318ad20-0488-4a64-98f4-72525a012f6b mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snappybee_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml index 98f2114f7b..8e846bdee3 100644 --- a/detections/endpoint/windows_snappybee_create_test_registry.yml +++ b/detections/endpoint/windows_snappybee_create_test_registry.yml @@ -1,11 +1,12 @@ name: Windows SnappyBee Create Test Registry id: 80402396-d78a-4c6e-ade5-7697ea670adf -version: 2 -date: '2025-03-27' +version: 3 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects modifications to the Windows registry +description: + The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration @@ -15,62 +16,66 @@ description: The following analytic detects modifications to the Windows registr or suspicious command-line activity, as they may indicate malware or unauthorized software behavior. data_source: -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 13 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snappybee_create_test_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information +how_to_implement: + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators and third party software may create this registry +known_false_positives: + Administrators and third party software may create this registry entry. references: -- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html + - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: a Test registry Entry [$registry_path$] was created on [$dest$]. risk_objects: - - field: dest - type: system - score: 60 - - field: user - type: user - score: 60 + - field: dest + type: system + score: 60 + - field: user + type: user + score: 60 threat_objects: [] tags: analytic_story: - - Salt Typhoon - - China-Nexus Threat Activity - - SnappyBee + - Salt Typhoon + - China-Nexus Threat Activity + - SnappyBee asset_type: Endpoint mitre_attack_id: - - T1112 + - T1112 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/test_registry/test_reg.log - sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - source: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/test_registry/test_reg.log + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index a9a96d5faa..3427585121 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,11 +1,12 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 12 -date: '2025-04-17' +version: 10 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic identifies processes running from file paths not +description: + The following analytic identifies processes running from file paths not typically associated with legitimate software. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional @@ -14,10 +15,11 @@ description: The following analytic identifies processes running from file paths controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", @@ -31,7 +33,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_process_file_path_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -40,92 +43,95 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators may allow execution of specific binaries in +known_false_positives: + Administrators may allow execution of specific binaries in non-standard paths. Filter as needed. references: -- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -- https://twitter.com/pr0xylife/status/1590394227758104576 -- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ + - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://twitter.com/pr0xylife/status/1590394227758104576 + - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat + - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: Suspicious process $process_name$ running from a suspicious process path- + message: + Suspicious process $process_name$ running from a suspicious process path- $process_path$ on host- $dest$ risk_objects: - - field: dest - type: system - score: 60 + - field: dest + type: system + score: 60 threat_objects: - - field: process_path - type: process_name + - field: process_path + type: process_name tags: analytic_story: - - SystemBC - - China-Nexus Threat Activity - - Remcos - - LockBit Ransomware - - AsyncRAT - - DarkCrystal RAT - - DarkGate Malware - - ValleyRAT - - PlugX - - Data Destruction - - Qakbot - - CISA AA23-347A - - Hermetic Wiper - - Volt Typhoon - - Double Zero Destructor - - AgentTesla - - Trickbot - - Meduza Stealer - - Phemedrone Stealer - - SnappyBee - - Azorult - - WhisperGate - - Warzone RAT - - Swift Slicer - - Rhysida Ransomware - - Brute Ratel C4 - - Prestige Ransomware - - BlackByte Ransomware - - Graceful Wipe Out Attack - - Chaos Ransomware - - Handala Wiper - - RedLine Stealer - - Salt Typhoon - - XMRig - - MoonPeak - - Industroyer2 - - Amadey - - IcedID - - Earth Alux - - Water Gamayun + - SystemBC + - China-Nexus Threat Activity + - Remcos + - LockBit Ransomware + - AsyncRAT + - DarkCrystal RAT + - DarkGate Malware + - ValleyRAT + - PlugX + - Data Destruction + - Qakbot + - CISA AA23-347A + - Hermetic Wiper + - Volt Typhoon + - Double Zero Destructor + - AgentTesla + - Trickbot + - Meduza Stealer + - Phemedrone Stealer + - SnappyBee + - Azorult + - WhisperGate + - Warzone RAT + - Swift Slicer + - Rhysida Ransomware + - Brute Ratel C4 + - Prestige Ransomware + - BlackByte Ransomware + - Graceful Wipe Out Attack + - Chaos Ransomware + - Handala Wiper + - RedLine Stealer + - Salt Typhoon + - XMRig + - MoonPeak + - Industroyer2 + - Amadey + - IcedID + - Earth Alux + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1543 - - T1036.005 + - T1543 + - T1036.005 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml index fcec63ad77..0139f2d364 100644 --- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml +++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml @@ -1,11 +1,12 @@ name: Windows System Network Config Discovery Display DNS id: e24f0a0e-41a9-419f-9999-eacab15efc36 -version: 7 -date: '2025-04-17' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies the execution of the "ipconfig /displaydns" +description: + The following analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. Monitoring this activity is significant @@ -14,10 +15,11 @@ description: The following analytic identifies the execution of the "ipconfig /d attackers to map the network, identify DNS servers, and potentially facilitate further network-based attacks or lateral movement. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="ipconfig.exe" OR Processes.original_file_name = "ipconfig.exe" AND Processes.process = "*/displaydns*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process @@ -27,7 +29,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_network_config_discovery_display_dns_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -38,47 +41,48 @@ how_to_implement: The detection is based on data that originates from Endpoint D names and speed up the data modeling process. known_false_positives: unknown references: -- https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns + - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS + - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: process $process_name$ with commandline $process$ is executed on $dest$ risk_objects: - - field: dest - type: system - score: 9 + - field: dest + type: system + score: 9 threat_objects: [] tags: analytic_story: - - Medusa Ransomware - - Windows Post-Exploitation - - Prestige Ransomware - - Water Gamayun + - Medusa Ransomware + - Windows Post-Exploitation + - Prestige Ransomware + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1016 + - T1016 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index da47b3a098..b1b8bec02f 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,13 +1,14 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: 11 +version: 10 date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly data_source: -- Sysmon EventID 7 -description: The following analytic detects the creation of potentially malicious + - Sysmon EventID 7 +description: + The following analytic detects the creation of potentially malicious unsigned DLLs in the c:\windows\system32 or c:\windows\syswow64 folders. It leverages Sysmon EventCode 7 logs to identify unsigned DLLs with unavailable signatures loaded in these critical directories. This activity is significant as it may indicate a @@ -15,61 +16,65 @@ description: The following analytic detects the creation of potentially maliciou and execute malicious code. If confirmed malicious, this could lead to privilege escalation, allowing the attacker to gain elevated privileges and further compromise the target system. -search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" +search: + '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: It is possible some Administrative utilities will load dismcore.dll +known_false_positives: + It is possible some Administrative utilities will load dismcore.dll outside of normal system paths, filter as needed. references: -- https://asec.ahnlab.com/en/17692/ -- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. + - https://asec.ahnlab.com/en/17692/ + - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: An unsigned dll module was loaded on $dest$ risk_objects: - - field: dest - type: system - score: 49 + - field: dest + type: system + score: 49 threat_objects: [] tags: analytic_story: - - China-Nexus Threat Activity - - Derusbi - - Warzone RAT - - Salt Typhoon - - NjRAT - - Earth Alux + - China-Nexus Threat Activity + - Derusbi + - Warzone RAT + - Salt Typhoon + - NjRAT + - Earth Alux asset_type: Endpoint mitre_attack_id: - - T1574.001 + - T1574.001 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 881dca0a54..acc502e342 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,13 +1,14 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: 11 +version: 10 date: '2025-04-22' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 7 + - Sysmon EventID 7 type: Anomaly status: production -description: The following analytic identifies potential DLL side-loading instances +description: + The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. It detects this activity by analyzing Sysmon logs for Event Code 7, where both the `Image` and `ImageLoaded` paths do not match system directories like `system32`, `syswow64`, and `programfiles`. @@ -15,7 +16,8 @@ description: The following analytic identifies potential DLL side-loading instan malicious code via legitimate processes. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to privilege escalation, persistence, and unauthorized access to sensitive information. -search: '`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false SignatureStatus +search: + '`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false SignatureStatus != Valid NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) NOT (ImageLoaded IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) | rex field=Image "(?.+\\\)" | rex field=ImageLoaded @@ -25,68 +27,71 @@ search: '`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false Signa process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_ms_dll_side_loading_filter`' -how_to_implement: The analytic is designed to be run against Sysmon event logs collected +how_to_implement: + The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into Splunk. The analytic searches for EventCode 7 where the Image is either SQLDumper.exe or SQLWriter.exe and the ImageLoaded is vcruntime140.dll. The search also filters out the legitimate loading of vcruntime140.dll from the System32 directory to reduce false positives. The analytic can be modified to include additional known good paths for vcruntime140.dll to further reduce false positives. -known_false_positives: False positives are possible if legitimate processes are loading +known_false_positives: + False positives are possible if legitimate processes are loading vcruntime140.dll from non-standard directories. It is recommended to investigate the context of the process loading vcruntime140.dll to determine if it is malicious or not. Modify the search to include additional known good paths for vcruntime140.dll to reduce false positives. references: -- https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties -- https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader + - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties + - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: An instance of $Image$ loading Unsigned $ImageLoaded$ was detected on $dest$. risk_objects: - - field: dest - type: system - score: 9 + - field: dest + type: system + score: 9 threat_objects: - - field: Image - type: file_name + - field: Image + type: file_name tags: analytic_story: - - China-Nexus Threat Activity - - Derusbi - - Salt Typhoon - - APT29 Diplomatic Deceptions with WINELOADER - - Earth Alux + - China-Nexus Threat Activity + - Derusbi + - Salt Typhoon + - APT29 Diplomatic Deceptions with WINELOADER + - Earth Alux group: - - APT29 - - Cozy Bear - - Midnight Blizzard + - APT29 + - Cozy Bear + - Midnight Blizzard asset_type: Endpoint mitre_attack_id: - - T1574.001 - - T1547 + - T1574.001 + - T1547 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint cve: [] tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 3e4d5f14a9..57fa9e531c 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -1,11 +1,12 @@ name: Windows WMI Impersonate Token id: cf192860-2d94-40db-9a51-c04a2e8a8f8b -version: 7 -date: '2025-04-17' +version: 6 +date: '2025-04-22' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects potential WMI token impersonation activities +description: + The following analytic detects potential WMI token impersonation activities in a process or command. It leverages Sysmon EventCode 10 to identify instances where `wmiprvse.exe` has a duplicate handle or full granted access in a target process. This behavior is significant as it is commonly used by malware like Qakbot for privilege @@ -13,8 +14,9 @@ description: The following analytic detects potential WMI token impersonation ac an attacker to gain elevated privileges, evade defenses, and maintain persistence within the environment. data_source: -- Sysmon EventID 10 -search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", + - Sysmon EventID 10 +search: + '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access @@ -22,54 +24,58 @@ search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_impersonate_token_filter`' -how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which +how_to_implement: + This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -known_false_positives: administrator may execute impersonate wmi object script for +known_false_positives: + administrator may execute impersonate wmi object script for auditing. Filter is needed. references: -- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md -- https://www.joesandbox.com/analysis/278341/0/html + - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md + - https://www.joesandbox.com/analysis/278341/0/html drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ + message: + wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ to $TargetImage$ process on $dest$ risk_objects: - - field: dest - type: system - score: 25 + - field: dest + type: system + score: 25 threat_objects: [] tags: analytic_story: - - Qakbot - - Water Gamayun + - Qakbot + - Water Gamayun asset_type: Endpoint mitre_attack_id: - - T1047 + - T1047 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog From 5158549d8bf65e66829d340c833d34b37c6f6a79 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 13:32:12 -0700 Subject: [PATCH 17/21] updating dataset --- detections/endpoint/delete_shadowcopy_with_powershell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index ab07874e2d..bc264e1c60 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -70,6 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog From 8240ed3c6e6ca6742bb4a448efaa91a5825ee2ef Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 24 Apr 2025 10:34:30 -0500 Subject: [PATCH 18/21] Remove duplicate filter macro --- detections/endpoint/windows_adfind_exe.yml | 104 +++++++++++---------- 1 file changed, 55 insertions(+), 49 deletions(-) diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index c78db66802..e3cd712efc 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -5,7 +5,8 @@ date: '2024-11-13' author: Jose Hernandez, Bhavin Patel, Splunk status: production type: TTP -description: The following analytic identifies the execution of `adfind.exe` with +description: + The following analytic identifies the execution of `adfind.exe` with specific command-line arguments related to Active Directory queries. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant because @@ -14,10 +15,11 @@ description: The following analytic identifies the execution of `adfind.exe` wit allow attackers to map the AD environment, facilitating further attacks such as privilege escalation or lateral movement. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*-gcb *" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*")) @@ -27,8 +29,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_adfind_exe_filter`| `windows_adfind_exe_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection + | `windows_adfind_exe_filter`' +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -37,61 +40,64 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: ADfind is a command-line tool for AD administration and management +known_false_positives: + ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro. references: -- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption -- https://www.joeware.net/freetools/tools/adfind/index.htm -- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ + - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption + - https://www.joeware.net/freetools/tools/adfind/index.htm + - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ drilldown_searches: -- name: View the detection results for - "$user$" - search: '%original_detection_search% | search user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: Windows AdFind Exe detected with command-line arguments associated with + message: + Windows AdFind Exe detected with command-line arguments associated with Active Directory queries on machine - [dest] risk_objects: - - field: user - type: user - score: 25 + - field: user + type: user + score: 25 threat_objects: [] tags: analytic_story: - - Domain Trust Discovery - - IcedID - - NOBELIUM Group - - Graceful Wipe Out Attack - - BlackSuit Ransomware + - Domain Trust Discovery + - IcedID + - NOBELIUM Group + - Graceful Wipe Out Attack + - BlackSuit Ransomware asset_type: Endpoint atomic_guid: - - 736b4f53-f400-4c22-855d-1a6b5a551600 - - b95fd967-4e62-4109-b48d-265edfd28c3a - - e1ec8d20-509a-4b9a-b820-06c9b2da8eb7 - - 5e2938fb-f919-47b6-8b29-2f6a1f718e99 - - abf00f6c-9983-4d9a-afbc-6b1c6c6448e1 - - 51a98f96-0269-4e09-a10f-e307779a8b05 + - 736b4f53-f400-4c22-855d-1a6b5a551600 + - b95fd967-4e62-4109-b48d-265edfd28c3a + - e1ec8d20-509a-4b9a-b820-06c9b2da8eb7 + - 5e2938fb-f919-47b6-8b29-2f6a1f718e99 + - abf00f6c-9983-4d9a-afbc-6b1c6c6448e1 + - 51a98f96-0269-4e09-a10f-e307779a8b05 mitre_attack_id: - - T1018 + - T1018 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog From ba0577038ef3bacb0aa50d223f3e1ddc66893bb5 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 24 Apr 2025 10:41:10 -0500 Subject: [PATCH 19/21] bump version --- detections/endpoint/windows_adfind_exe.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index e3cd712efc..1774fe2ceb 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -1,7 +1,7 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f -version: 8 -date: '2024-11-13' +version: 9 +date: '2025-04-24' author: Jose Hernandez, Bhavin Patel, Splunk status: production type: TTP From 31e2c03b8df76ba5f9c3225ee3fa975bfcab7eca Mon Sep 17 00:00:00 2001 From: ljstella Date: Fri, 25 Apr 2025 08:44:50 -0500 Subject: [PATCH 20/21] Add where clause back --- ...excessive_number_of_taskhost_processes.yml | 79 ++++++++++--------- 1 file changed, 43 insertions(+), 36 deletions(-) diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 848b988bf1..475c7d71e8 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -5,7 +5,8 @@ date: '2024-11-13' author: Michael Hart status: production type: Anomaly -description: The following analytic identifies an excessive number of taskhost.exe +description: + The following analytic identifies an excessive number of taskhost.exe and taskhostex.exe processes running within a short time frame. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and their counts. This behavior is significant as it is commonly associated with post-exploitation @@ -14,10 +15,11 @@ description: The following analytic identifies an excessive number of taskhost.e activity could indicate an ongoing attack, allowing attackers to execute code, escalate privileges, or move laterally within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.action) as action + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: + '| tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id @@ -41,9 +43,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.action) as a values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(user) as user values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product values(process_name) - as process_name by _time, dest, firstTime, lastTime | `security_content_ctime(firstTime)` + as process_name by _time, dest, firstTime, lastTime | where taskhost_count > + 10 or taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection +how_to_implement: + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. @@ -52,46 +56,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators, administrative actions or certain applications +known_false_positives: + Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. references: -- https://attack.mitre.org/software/S0250/ + - https://attack.mitre.org/software/S0250/ drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: An excessive amount of taskhost.exe and taskhostex.exe was executed on + message: + An excessive amount of taskhost.exe and taskhostex.exe was executed on $dest$ indicative of suspicious behavior. risk_objects: - - field: dest - type: system - score: 56 + - field: dest + type: system + score: 56 threat_objects: [] tags: analytic_story: - - Meterpreter + - Meterpreter asset_type: Endpoint mitre_attack_id: - - T1059 + - T1059 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 511221ba1e0663f0002e22a41659ca26a731d5ff Mon Sep 17 00:00:00 2001 From: ljstella Date: Fri, 25 Apr 2025 08:58:58 -0500 Subject: [PATCH 21/21] version bump --- .../endpoint/excessive_number_of_taskhost_processes.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 475c7d71e8..afd814f56a 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -1,7 +1,7 @@ name: Excessive number of taskhost processes id: f443dac2-c7cf-11eb-ab51-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-04-25' author: Michael Hart status: production type: Anomaly