From 6c33dd0f6ca24499b2650652f99b29a661a2ac86 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 7 Feb 2025 11:06:55 +0100 Subject: [PATCH 01/48] headless_bee --- .../endpoint/detect_rare_executables.yml | 12 +++-- ...e_process_accessing_chrome_default_dir.yml | 19 ++++---- ...fox_process_access_firefox_profile_dir.yml | 30 ++++++------ .../registry_keys_used_for_persistence.yml | 46 ++++++++++--------- ...ss_token_manipulation_sedebugprivilege.yml | 17 +++---- ...ial_access_from_browser_password_store.yml | 14 +++--- ...ssword_stores_chrome_localstate_access.yml | 23 +++++----- ...ssword_stores_chrome_login_data_access.yml | 23 +++++----- ...uery_registry_browser_list_application.yml | 10 ++-- ...ws_service_creation_on_remote_endpoint.yml | 12 +++-- ..._service_creation_using_registry_entry.yml | 15 +++--- stories/snappybee.yml | 20 ++++++++ 12 files changed, 139 insertions(+), 102 deletions(-) create mode 100644 stories/snappybee.yml diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index b97ff44ccd..60255c6204 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -1,7 +1,7 @@ name: Detect Rare Executables id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac -version: 7 -date: '2024-11-13' +version: '8' +date: '2025-02-07' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -58,9 +58,12 @@ rba: threat_objects: [] tags: analytic_story: - - Unusual Processes + - SnappyBee - Rhysida Ransomware + - Nexus APT Threat Activity - Crypto Stealer + - Earth Estries + - Unusual Processes asset_type: Endpoint mitre_attack_id: - T1204 @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/rare_executables/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/rare_executables/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index fa4c8d036a..147c8bc14d 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,7 +1,7 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 6 -date: '2025-01-27' +version: '7' +date: '2025-02-07' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,19 +49,20 @@ rba: threat_objects: [] tags: analytic_story: + - SnappyBee + - Phemedrone Stealer - Snake Keylogger + - NjRAT - CISA AA23-347A - 3CX Supply Chain Attack - - Warzone RAT - - Remcos - - AgentTesla - - Phemedrone Stealer - FIN7 - - DarkGate Malware - - Nexus APT Threat Activity - Earth Estries - - NjRAT + - Warzone RAT + - Nexus APT Threat Activity + - DarkGate Malware + - Remcos - RedLine Stealer + - AgentTesla asset_type: Endpoint mitre_attack_id: - T1555 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index abc2b0fc09..eafc7dab0e 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,7 +1,7 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 5 -date: '2024-11-13' +version: '6' +date: '2025-02-07' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -48,18 +48,21 @@ rba: threat_objects: [] tags: analytic_story: - - Azorult - - Remcos - - NjRAT - - Warzone RAT - - 3CX Supply Chain Attack - - RedLine Stealer - - FIN7 - - DarkGate Malware - - AgentTesla - - CISA AA23-347A + - SnappyBee - Phemedrone Stealer - Snake Keylogger + - NjRAT + - CISA AA23-347A + - 3CX Supply Chain Attack + - Azorult + - Nexus APT Threat Activity + - Warzone RAT + - AgentTesla + - RedLine Stealer + - DarkGate Malware + - Remcos + - Earth Estries + - FIN7 asset_type: Endpoint mitre_attack_id: - T1555 @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 9f542cbcf2..5c01016af9 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 15 -date: '2025-01-27' +version: '16' +date: '2025-02-07' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -77,35 +77,37 @@ rba: threat_objects: [] tags: analytic_story: + - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + - MoonPeak + - Amadey + - RedLine Stealer + - Emotet Malware DHS Report TA18-201A - Chaos Ransomware - - Windows Persistence Techniques - - DHS Report TA18-074A - - Snake Keylogger - - CISA AA23-347A - WinDealer RAT - - Qakbot - Warzone RAT + - Nexus APT Threat Activity + - Earth Estries + - SnappyBee + - Windows Persistence Techniques + - Snake Keylogger + - Ransomware + - CISA AA23-347A + - DHS Report TA18-074A + - Windows Registry Abuse + - Sneaky Active Directory Persistence Tricks + - BlackSuit Ransomware + - Qakbot + - DarkGate Malware - IcedID + - Braodo Stealer + - Suspicious MSHTA Activity + - NjRAT + - AsyncRAT - Azorult - Suspicious Windows Registry Activities - - AsyncRAT - Derusbi - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - DarkGate Malware - - NjRAT - BlackByte Ransomware - - Ransomware - - MoonPeak - - BlackSuit Ransomware - - Emotet Malware DHS Report TA18-201A - - Sneaky Active Directory Persistence Tricks - - Amadey - Remcos - - Braodo Stealer - - Windows Registry Abuse - - Nexus APT Threat Activity - - Suspicious MSHTA Activity - - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 9f00ab5ca2..76ee09bc8f 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,7 +1,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: 10 -date: '2025-01-27' +version: '11' +date: '2025-02-07' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -56,16 +56,17 @@ rba: threat_objects: [] tags: analytic_story: - - Brute Ratel C4 - - PlugX - - AsyncRAT - - CISA AA23-347A - - WinDealer RAT + - SnappyBee - ValleyRAT + - Brute Ratel C4 + - WinDealer RAT + - Meduza Stealer + - CISA AA23-347A + - AsyncRAT - Derusbi + - PlugX - Nexus APT Threat Activity - DarkGate Malware - - Meduza Stealer - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index f3ad514e0c..fd9cf96237 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,7 +1,7 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 6 -date: '2024-12-10' +version: '7' +date: '2025-02-07' author: Teoderick Contreras, Bhavin Patel Splunk data_source: - Windows Event Log Security 4663 @@ -60,11 +60,14 @@ rba: threat_objects: [] tags: analytic_story: - - Snake Keylogger + - SnappyBee - MoonPeak - Braodo Stealer - - PXA Stealer + - Snake Keylogger - Meduza Stealer + - PXA Stealer + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1012 @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/snakey_keylogger_outlook_reg_access/snakekeylogger_4663.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/snakey_keylogger_outlook_reg_access/snakekeylogger_4663.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index c981720bb5..92a303a0cf 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 7 -date: '2025-01-27' +version: '8' +date: '2025-02-07' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,19 +51,20 @@ rba: threat_objects: [] tags: analytic_story: - - Snake Keylogger - - Amadey - - Warzone RAT - - PXA Stealer - - Braodo Stealer + - SnappyBee + - MoonPeak - Phemedrone Stealer + - Braodo Stealer + - Snake Keylogger + - Meduza Stealer + - NjRAT + - Amadey + - PXA Stealer + - Warzone RAT - Nexus APT Threat Activity - DarkGate Malware - - Meduza Stealer - - MoonPeak - - Earth Estries - - NjRAT - RedLine Stealer + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 5ed95dadf5..48bcd82e48 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 7 -date: '2025-01-27' +version: '8' +date: '2025-02-07' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,19 +52,20 @@ rba: threat_objects: [] tags: analytic_story: - - Snake Keylogger - - Amadey - - Warzone RAT - - PXA Stealer - - Braodo Stealer + - SnappyBee + - MoonPeak - Phemedrone Stealer + - Braodo Stealer + - Snake Keylogger + - Meduza Stealer + - NjRAT + - Amadey + - PXA Stealer + - Warzone RAT - Nexus APT Threat Activity - DarkGate Malware - - Meduza Stealer - - MoonPeak - - Earth Estries - - NjRAT - RedLine Stealer + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index 891570d753..2038fd726e 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -1,7 +1,7 @@ name: Windows Query Registry Browser List Application id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb -version: 4 -date: '2024-11-13' +version: '5' +date: '2025-02-07' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,7 +51,10 @@ rba: threat_objects: [] tags: analytic_story: + - SnappyBee - RedLine Stealer + - Earth Estries + - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1012 @@ -63,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_list/ar3_4663_redline_reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_list/ar3_4663_redline_reg.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 19ea16bb63..92bbbff40f 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -1,7 +1,7 @@ name: Windows Service Creation on Remote Endpoint id: e0eea4fa-4274-11ec-882b-3e22fbd008af -version: 5 -date: '2024-11-13' +version: '6' +date: '2025-02-07' author: Mauricio Velazco, Splunk status: production type: TTP @@ -62,8 +62,11 @@ rba: threat_objects: [] tags: analytic_story: - - Active Directory Lateral Movement + - SnappyBee - CISA AA23-347A + - Active Directory Lateral Movement + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1543 @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 58eaf22cd4..bc4c01ee46 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 11 -date: '2025-01-27' +version: '12' +date: '2025-02-07' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -53,16 +53,17 @@ rba: threat_objects: [] tags: analytic_story: - - Brute Ratel C4 - - PlugX + - SnappyBee - Windows Persistence Techniques + - Brute Ratel C4 - CISA AA23-347A - - Windows Registry Abuse - Suspicious Windows Registry Activities + - Nexus APT Threat Activity + - Derusbi + - PlugX + - Windows Registry Abuse - Active Directory Lateral Movement - Crypto Stealer - - Derusbi - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/stories/snappybee.yml b/stories/snappybee.yml new file mode 100644 index 0000000000..b47f0fc5ba --- /dev/null +++ b/stories/snappybee.yml @@ -0,0 +1,20 @@ +name: SnappyBee +id: 99f066e0-2492-45ed-acb4-a42abbd585fd +version: 1 +date: '2025-02-07' +author: Teoderick Contreras, Splunk +status: production +description: SnappyBee is a stealthy malware variant designed to exfiltrate sensitive data while evading traditional security measures. It primarily spreads through phishing emails, malicious attachments, and drive-by downloads. Once executed, SnappyBee establishes persistence by modifying system registries and injecting malicious code into legitimate processes. It employs advanced obfuscation techniques to avoid detection, including polymorphic encryption and sandbox evasion. The malware actively monitors user activities, capturing credentials, keystrokes, and network traffic before transmitting the stolen data to a remote command-and-control (C2) server. This analytic story is designed to detect possible mitre attack tatics and technique related to SnappyBee malware. +narrative: SnappyBee emerged as a highly evasive malware designed for data theft and espionage. Initially spotted in targeted phishing campaigns, it quickly gained notoriety for its stealth and adaptability. Cybersecurity researchers found that SnappyBee disguises itself as legitimate software, infecting systems through malicious email attachments, compromised websites, and software cracks. Once activated, it burrows deep into the system, modifying registries and injecting code into trusted processes to remain undetected. Advanced evasion techniques, such as polymorphic encryption and sandbox detection, make traditional signature-based security ineffective. SnappyBee’s primary goal is to steal credentials, keystrokes, and network data, transmitting them to remote attackers. Continuous monitoring and proactive threat intelligence remain crucial to counter this evolving cyber menace. +references: +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +tags: + category: + - Data Destruction + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From b185a3c1a9e80e1e93bc00305b78854798df7bc4 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 13:34:34 -0500 Subject: [PATCH 02/48] Add files via upload --- lookups/windows_suspicious_tasks.csv | 128 +++++++++++++++++++++++++++ lookups/windows_suspicious_tasks.yml | 15 ++++ 2 files changed, 143 insertions(+) create mode 100644 lookups/windows_suspicious_tasks.csv create mode 100644 lookups/windows_suspicious_tasks.yml diff --git a/lookups/windows_suspicious_tasks.csv b/lookups/windows_suspicious_tasks.csv new file mode 100644 index 0000000000..fdb712acae --- /dev/null +++ b/lookups/windows_suspicious_tasks.csv @@ -0,0 +1,128 @@ +task_name,task_command,task_arguments,tool,tool_category,tool_type,link,severity,comment,reference +,*powershell.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*wscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*cscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*cmd.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*sh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*ksh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*zsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*bash.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*scrcons.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*pwsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,powershell.exe,*-Command whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists +,powershell.exe,-encodedCommand *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists +,powershell.exe,-enc *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists +,cmd.exe,*/c whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists +\area41,C:\_Microsoft\Microsoft.exe,,CryptInject,Malware,offensive_tool,https://github.com/roadwy/DefenderYara/blob/9bbdb7f9fd3513ce30aa69cd1d88830e3cf596ca/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_PJ_MTB.yar#L36,critical,N/A,https://github.com/mthcht/awesome-lists +\OfficeServicesStatus,*wscript*\public\*,,ISMDoor,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/,high,N/A,https://github.com/mthcht/awesome-lists +\Business Aviation,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists +\Destination Branding,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists +\InetlSecurityAssistManager,*wscript *,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +,*wevtutil.exe,cl *,wevtutil,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,clearing event logs with wevtutil.exe,https://github.com/mthcht/awesome-lists +\GoogleUpdateTaskMachineUI,*update.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/,high,N/A,https://github.com/mthcht/awesome-lists +\Wow64 Subsystem,*programdata*mswow86.exe*,,NetSupport Manager,RAT,offensive_tool,https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/,medium,N/A,https://github.com/mthcht/awesome-lists +\copy,*powershell.exe*,*Copy-Item*\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\def,*powershell.exe*,*Get-MpPreference*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\FJ_load,*madHcCtrl.exe*,,Danabot,Infostealer,offensive_tool,https://securelist.com/tusk-infostealers-campaign/113367/,high,N/A,https://github.com/mthcht/awesome-lists +\shell,*Invoke-PowerShellTcpRun*,,Schtasks_latmov.bat,Lateral Movement,offensive_tool,https://github.com/S3cur3Th1sSh1t/Creds/blob/f71e780c51fdc2fdabe4e51831fa6289b1bede96/batch/Schtasks_latmov.bat#L2,critical,N/A,https://github.com/mthcht/awesome-lists +*StageProxyOps*,*HTTP-Server.ps1*,,HTTP-Server,Persistence,offensive_tool,https://github.com/NullArray/WinBins-Plus/blob/1e4af04ceaa8085b532757a1331113e919a20f4b/Scripts/persist.cmd#L2,critical,N/A,https://github.com/mthcht/awesome-lists +\GoogleUpdatesTaskMachineUI,*fireeye.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/,high,N/A,https://github.com/mthcht/awesome-lists +\MicrosoftEdgeUpdateTaskMachineMS,*EdgeBrowser.cmd*,,MeshAgent,RAT,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/awaken-likho-apt-new-implant-campaign_114101/content.txt#L831,high,N/A,https://github.com/mthcht/awesome-lists +\run1,*cmd.exe*,*/c *\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\SecurityAssist,*Certutil*,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +\mstask,*C:\temp\*,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists +\ReportHealth,*appdata*\srvHealth.exe*,,ISMInjector,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +,*\Windows\Debug*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the *\Windows\Debug folder,https://github.com/mthcht/awesome-lists +\MicrosoftEdgeUpdateTaskMachineUC,*\users\public\*,,autohotkey,keylogger,offensive_tool,https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/,high,N/A,https://github.com/mthcht/awesome-lists +,*\Users\public*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the Public user profile,https://github.com/mthcht/awesome-lists +,*\Users*\Downloads*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Downloads folder,https://github.com/mthcht/awesome-lists +,*\Users*\Documents*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Documents folder,https://github.com/mthcht/awesome-lists +,*\Users*\AppData\Roaming*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the roaming folder,https://github.com/mthcht/awesome-lists +,*\Users*\AppData\Local*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the appdata folder,https://github.com/mthcht/awesome-lists +\SystemFailureReporter,*\public\*,,SideTwist Backdoor (APT34),Malware,offensive_tool,https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/,critical,N/A,https://github.com/mthcht/awesome-lists +,*\ProgramData*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the ProgramData folder,https://github.com/mthcht/awesome-lists +\MEGA\MEGAsync Update Task*,*\MEGAupdater.exe,,MEGASync,Data Exfiltration,greyware_tool,https://mega.io/en/desktop,high,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/MEGAsync.csv +\WallPaperChangeApp,*\Autoit3\Autoit3.exe*,,OxtaRAT,Malware,offensive_tool,https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/,critical,N/A,https://github.com/mthcht/awesome-lists +,*\AppData\Local\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,high,task in the temp folder,https://github.com/mthcht/awesome-lists +\Microsoft_Auto_Scheduler,*\AppData\*,,Kube Ransomware,Ransomware,offensive_tool,https://x.com/ShanHolo/status/1880566701009563915/photo/1,high,N/A,https://github.com/mthcht/awesome-lists +,*:\Windows\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,executable from the temp folder,https://github.com/mthcht/awesome-lists +,*:\windows\system32\calc.exe,,POC,exploitation,greyware_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists +"\tMicNet Work40,",*.vbs*,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists +\yastcat,,,Wannamine,Cryptominer,offensive_tool,crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/,critical,Moonero miner - command SCHTASKS /create /RU System /SC DAILY /TN yastcat /f /TR %temp%\y1.bat &&SCHTASKS /run /TN yastcat,https://github.com/mthcht/awesome-lists +\OneNote 4726,,,Unkown,Malware,offensive_tool,https://x.com/Gi7w0rm/status/1864307803914981837,medium,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll,,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists +\dongs,,,suspicious names,exploitation,offensive_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists +\StopVMMSandKillVMWP,,,StopVMMSandKillVMWP script,Defense evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452267692728516,high,schtasks /create /tn StopVMMSandKillVMWP /tr 'powershell.exe -Command get-service -name vmms | stop-service -force ; taskkill /f /im vmwp.exe' /sc minute /mo 30 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists +\SSH Key Exchange,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv +\SSH Server,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv +\MeterpeterC2,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/bin/SchTasks.ps1#L83,critical,SchTasks.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv +\RedPillTask,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/redpill.ps1#L743,critical,redpill.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv +\SQLC2AgentPS*,,,PowerUpSQL,C2,offensive_tool,https://github.com/NetSPI/PowerUpSQL/blob/a83cad211983290bf38708e6e237cacbfe023e32/scripts/pending/SQLC2.ps1#L958,critical,N/A,https://github.com/mthcht/awesome-lists +My Startup Task,,,Powershell-Scripts-for-Hackers-and-Pentesters,Persistence,offensive_tool,https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters/blob/788e89e9584b4b43f982721d59c06c77c0b3b566/PS-020.md?plain=1#L20,medium,N/A,https://github.com/mthcht/awesome-lists +,,*Set-MpPreference -DisableRealtimeMonitoring *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,disabling Defender Real time monitoring,https://github.com/mthcht/awesome-lists +\OneDrive Security,,,Nitrogen,Malware,offensive_tool,https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/,high,N/A,https://github.com/mthcht/awesome-lists +\Demovale,,,Nightdoor,Malware,offensive_tool,lhttps://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/www_welivesecurity_com/en_eset-research_evasive-panda-leverages-monlam-festival-target-tibetans/content.txt#L269C143-L269C152,high,N/A,https://github.com/mthcht/awesome-lists +\8766714F94DD,,,more_eggs,Malware,offensive_tool,https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/n=,high,N/A,https://github.com/mthcht/awesome-lists +\Loki,,,LokiLocker,Ransomware,offensive_tool,https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware,critical,command observed schtasks /CREATE /SC ONLOGON /TN Loki /TR *,https://github.com/mthcht/awesome-lists +\LimeRAT-Admin,,,Lime-RAT,Malware,offensive_tool,https://github.com/NYAN-x-CAT/Lime-RAT/blob/87e189781c0aef0e84cabe2f8c2e7d8f5143e594/Project/Client/C_Installation.vb#L76,critical,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/Lime-RAT.csv +\NFUBffk,,,LemonDuck,Malware,offensive_tool,https://notes.netbytesec.com/2024/10/lemonduck-unleashes-cryptomining.html,high,N/A,https://github.com/mthcht/awesome-lists +\K0adic,,,koadic,C2,offensive_tool,https://github.com/Averroes/koadic/blob/97886ed570f31efff09d1e06c4a7ece2d9b6bd27/data/implant/persist/schtasks.js#L4C21-L4C27,critical,N/A,https://github.com/mthcht/awesome-lists +\Feedback_API_VS_Services_Client,,,Keyzetsu clipper variant,Malware,offensive_tool,https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/,medium,N/A,https://github.com/mthcht/awesome-lists +\Tater,,,Invoke-Tater,Privilege Escalation,offensive_tool,https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/data/module_source/privesc/Invoke-Tater.ps1#L101,critical,PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit from @breenmachine and @foxglovesec,https://github.com/mthcht/awesome-lists +\\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Speech\\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Defender\\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Defender\\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Application Experience\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Application Experience\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Speech\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Defender\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Defender\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Error Reporting\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Error Reporting\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsUpdate\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\InfrSiRfucture Technologies,,,Gootloader,Malware,offensive_tool,https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/,critical,N/A,https://github.com/mthcht/awesome-lists +\SynchronizeTimeZone,,,frp,Data Exfiltration,offensive_tool,https://www.aha.org/system/files/media/file/2021/05/fbi-flash-tlp-white-apt-actors-exploiting-fortinet-vulnerabilities-to-gain-access-for-malicious-activity-5-27-21.pdf,high,APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity - creating specific scheduled task for exfiltration,https://github.com/mthcht/awesome-lists +\CursorSvc,,,Fentanyl Stealer,Malware,offensive_tool,https://github.com/dekrypted/Fentanyl/blob/2b4a008934f21df4eed7b90fb3019d3395f7c909/fenty.py#L699C53-L699C62,critical,Similar to Bandit Stealer,https://github.com/mthcht/awesome-lists +\DisableBitdefender-*,,,Dispossesor,Ransomware,offensive_tool,https://vx-underground.org/Archive/Dispossessor%20Leaks,high,N/A,https://github.com/mthcht/awesome-lists +\DHARMA,,,Dharma,Ransomware,offensive_tool,https://www.joesandbox.com/analysis/860608/0/lighthtml,critical,command observed schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe*,https://github.com/mthcht/awesome-lists +\Sorry,,,Cryptominer,Cryptominer,offensive_tool,https://x.com/cglyer/status/1001463072672886785,high,schtasks /create /tn 'Sorry' /tr C:\Windows\Temp\taskhost.exe /sc daily /mo 2 /st 22:00:00 /f4,https://x.com/cglyer/status/1001463072672886785 +\shadowdev,,,CobaltStrike,C2,offensive_tool,https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations,critical,cmd.exe /c schtasks /create /sc minute /mo 1 /tn shadowdev /tr C:\\ProgramData\\S\u0443sH\u0435\u0430ls\\T\u0430s\u0441host.exe,https://github.com/mthcht/awesome-lists +\ClearEventLogs,,,Cleareventlog script,Defense Evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452304606810175,high,schtasks /create /tn ClearEventLogs /tr 'powershell.exe -Command wevtutil el | foreach { wevtutil cl $_ }' /sc daily /st 03:00 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists +\SC Scheduled Scan,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists +\UpdatMachine,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists +\drogon,,,BadRabbit,Malware,offensive_tool,https://www.vmray.com/analyses/bad-rabbit-ransomware-flash-analysis/report/overview.html,critical,schtasks /Create /SC once /TN drogon /RU SYSTEM /TR 'C:\Windows\system32\shutdown.exe /r /t 0 /f' /ST 02:34:00,https://github.com/mthcht/awesome-lists +\BaiduUpdateTask1,,,BADNEWS,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/,high,N/A,https://github.com/mthcht/awesome-lists +\AutoRDPwn,,,AutoRDPwn,C2,offensive_tool,https://github.com/JoelGMSec/AutoRDPwn/blob/839d6afbd2cfa64b01a188b4e09a3e079c9c81d3/AutoRDPwn.ps1#L678,critical,N/A,https://github.com/mthcht/awesome-lists +\thepiratMicrosoftEdgeUpdateTask,,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists +\kbnvmmmhjo,,,Agent Tesla,Malware,offensive_tool,https://isc.sans.edu/diary/PowerPoint+attachments+Agent+Tesla+and+code+reuse+in+malware/28154,critical,N/A,https://github.com/mthcht/awesome-lists \ No newline at end of file diff --git a/lookups/windows_suspicious_tasks.yml b/lookups/windows_suspicious_tasks.yml new file mode 100644 index 0000000000..68cc6d0fee --- /dev/null +++ b/lookups/windows_suspicious_tasks.yml @@ -0,0 +1,15 @@ +name: windows_suspicious_tasks +date: 2025-02-07 +version: 1 +id: 928cba69-be80-4601-9b0d-3ec81f714338 +author: Steven Dick +lookup_type: csv +description: A list of suspicious Windows Scheduled Task names and locations +default_match: false +match_type: +- WILDCARD(task_name) +- WILDCARD(task_command) +- WILDCARD(task_arguments) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false \ No newline at end of file From bb6cd1f747acf907cbf647b2af8f274e8510d121 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 13:36:09 -0500 Subject: [PATCH 03/48] Add files via upload --- ...scheduled_task_with_suspicious_command.yml | 76 +++++++++++++++++++ ...nt_scheduled_task_with_suspicious_name.yml | 76 +++++++++++++++++++ 2 files changed, 152 insertions(+) create mode 100644 detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml create mode 100644 detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml new file mode 100644 index 0000000000..cfc7e4f617 --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml @@ -0,0 +1,76 @@ +name: WinEvent Scheduled Task with Suspicious Command +id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 +version: 1 +date: '2025-02-07' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment. +data_source: +- Windows Event Log Security 4698 +- Windows Event Log Security 4700 +- Windows Event Log Security 4702 +search: |- + `wineventlog_security` EventCode IN (4698,4700,4702) + | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) + | xmlkv TaskContent + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, Task_Name, Command, Enabled, Hidden, EventCode + | lookup windows_suspicious_tasks task_command as Command + | where tool == "shell command use" OR tool == "suspicious paths" + | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `winevent_scheduled_task_with_suspicious_command_filter` +how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ic3.gov/CSA/2023/231213.pdf +- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ +- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate schedule tasks on $dest$ + search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A suspicious windows scheduled task named [$Task_Name$] was detected on $dest$, this may be an indicator of [$tool$] + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: Command + type: signature +tags: + analytic_story: + - Scheduled Tasks + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1053.005 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml new file mode 100644 index 0000000000..c8bfd9e0f0 --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml @@ -0,0 +1,76 @@ +name: WinEvent Scheduled Task with Suspicious Name +id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e +version: 1 +date: '2025-02-07' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment. +data_source: +- Windows Event Log Security 4698 +- Windows Event Log Security 4700 +- Windows Event Log Security 4702 +search: |- + `wineventlog_security` EventCode IN (4698,4700,4702) + | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) + | xmlkv TaskContent + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Task_Name, Command, Enabled, Hidden,Caller_User_Name, EventCode + | lookup windows_suspicious_tasks task_name as Task_Name + | where isnotnull(tool_type) + | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `winevent_scheduled_task_with_suspicious_name_filter` +how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ic3.gov/CSA/2023/231213.pdf +- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ +- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate schedule tasks on $dest$ + search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND Task_Name = "$Task_Name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A windows scheduled task was created with known suspicious task name [$Task_Name$] on $dest$, this may be a [$tool$] indicator + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: Command + type: signature +tags: + analytic_story: + - Scheduled Tasks + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1053.005 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file From 70f0d68506726293ef093c6f4f8942a1740c7c2f Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 14:01:13 -0500 Subject: [PATCH 04/48] Update winevent_scheduled_task_with_suspicious_name.yml --- .../winevent_scheduled_task_with_suspicious_name.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml index c8bfd9e0f0..2b13e85f31 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml @@ -30,11 +30,11 @@ references: - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate schedule tasks on $dest$ @@ -73,4 +73,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From b007e91c6e9bc3b05f1ea0e235f44d943bd22f65 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 14:01:48 -0500 Subject: [PATCH 05/48] Update winevent_scheduled_task_with_suspicious_command.yml --- .../winevent_scheduled_task_with_suspicious_command.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml index cfc7e4f617..02ee078fc7 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml @@ -30,11 +30,11 @@ references: - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate schedule tasks on $dest$ @@ -73,4 +73,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From 2f02cb930f865c9f69ea11450c9ba5fd813181e8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 12 Feb 2025 10:21:24 +0100 Subject: [PATCH 06/48] headless_bee --- ..._or_script_creation_in_suspicious_path.yml | 22 +-- ...tables_or_script_creation_in_temp_path.yml | 116 ++++++++++++++++ .../windows_suspicious_process_file_path.yml | 125 ++++++++++++++++++ ..._dll_side_loading_in_same_process_path.yml | 23 ++-- 4 files changed, 264 insertions(+), 22 deletions(-) create mode 100644 detections/endpoint/executables_or_script_creation_in_temp_path.yml create mode 100644 detections/endpoint/windows_suspicious_process_file_path.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index ead8a42979..726e5bbf76 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 10 -date: '2025-01-27' +version: 11 +date: '2025-02-11' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,15 +15,14 @@ description: The following analytic identifies the creation of executables or sc a significant security threat. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as - file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", - "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", - "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", - "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", - "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*") +search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") + AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", + "*\\Windows\\repair\\*", "*\\PerfLogs\\*", "*\\programdata\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*")) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from @@ -101,6 +100,7 @@ tags: - Rhysida Ransomware - RedLine Stealer - Volt Typhoon + - SnappyBee asset_type: Endpoint mitre_attack_id: - T1036 @@ -112,6 +112,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml new file mode 100644 index 0000000000..09e497bd9e --- /dev/null +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -0,0 +1,116 @@ +name: Executables Or Script Creation In Temp Path +id: e0422b71-2c05-4f32-8754-01fb415f49c9 +version: 11 +date: '2025-02-11' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies the creation of executables or scripts + in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem + data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created + in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is + significant as adversaries often use these paths to evade detection and maintain + persistence. If confirmed malicious, this behavior could allow attackers to execute + unauthorized code, escalate privileges, or persist within the environment, posing + a significant security threat. +data_source: +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") + AND Filesystem.file_path IN ("*\\temp\\*") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `executables_or_script_creation_in_temp_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in the paths + specified. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious executable or scripts with file name $file_name$, $file_path$ + and process_id $process_id$ executed in temp file path in Windows by $user$ + risk_objects: + - field: user + type: user + score: 20 + threat_objects: + - field: file_name + type: file_name +tags: + analytic_story: + - Chaos Ransomware + - Trickbot + - Snake Keylogger + - CISA AA23-347A + - Industroyer2 + - WinDealer RAT + - Qakbot + - Warzone RAT + - IcedID + - ValleyRAT + - Azorult + - Handala Wiper + - LockBit Ransomware + - Meduza Stealer + - Brute Ratel C4 + - AsyncRAT + - AcidPour + - Derusbi + - DarkGate Malware + - Graceful Wipe Out Attack + - NjRAT + - WhisperGate + - Data Destruction + - BlackByte Ransomware + - AgentTesla + - Swift Slicer + - Crypto Stealer + - Hermetic Wiper + - MoonPeak + - Double Zero Destructor + - XMRig + - PlugX + - Amadey + - DarkCrystal RAT + - Remcos + - Nexus APT Threat Activity + - Earth Estries + - Rhysida Ransomware + - RedLine Stealer + - Volt Typhoon + - SnappyBee + asset_type: Endpoint + mitre_attack_id: + - T1036 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml new file mode 100644 index 0000000000..73deea9dab --- /dev/null +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -0,0 +1,125 @@ +name: Windows Suspicious Process File Path +id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 +version: 8 +date: '2025-02-11' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic identifies processes running from file paths not + typically associated with legitimate software. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on specific process paths within the Endpoint + data model. This activity is significant because adversaries often use unconventional + file paths to execute malicious code without requiring administrative privileges. + If confirmed malicious, this behavior could indicate an attempt to bypass security + controls, leading to unauthorized software execution, potential system compromise, + and further malicious activities within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes + where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*", "*\\programdata\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_process_file_path_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators may allow execution of specific binaries in + non-standard paths. Filter as needed. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious process $process_name$ running from a suspicious process path- + $process_path$ on host- $dest$ + risk_objects: + - field: dest + type: system + score: 60 + threat_objects: + - field: process_path + type: process_name +tags: + analytic_story: + - Double Zero Destructor + - Graceful Wipe Out Attack + - AsyncRAT + - WhisperGate + - Prestige Ransomware + - DarkGate Malware + - AgentTesla + - Brute Ratel C4 + - RedLine Stealer + - Rhysida Ransomware + - Swift Slicer + - IcedID + - DarkCrystal RAT + - Chaos Ransomware + - PlugX + - Industroyer2 + - Azorult + - Remcos + - XMRig + - Qakbot + - Volt Typhoon + - Hermetic Wiper + - Warzone RAT + - Trickbot + - Amadey + - BlackByte Ransomware + - LockBit Ransomware + - CISA AA23-347A + - Data Destruction + - Phemedrone Stealer + - Handala Wiper + - MoonPeak + - ValleyRAT + - Meduza Stealer + - Nexus APT Threat Activity + - Earth Estries + - SnappyBee + asset_type: Endpoint + mitre_attack_id: + - T1543 + - T1036 + - T1036.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index 08803a7cd9..c52e884222 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 6 -date: '2025-01-27' +version: 7 +date: '2025-02-11' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -15,15 +15,15 @@ description: This detection identifies unsigned DLLs loaded through DLL side-loa potential security breaches. Regular security assessments, thorough monitoring, and implementing security best practices are essential in safeguarding systems from such threats. -search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN - ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) - NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program - Files*")) | rex field=Image "(?.+\\\)" | rex field=ImageLoaded - "(?.+\\\)" | where ImageFolderPath = ImageLoadedFolderPath - | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid - ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company - Description Product Signed SignatureStatus | rename Computer as dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_in_same_process_path_filter`' +search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) ImageLoaded = *.dll + | rex field=Image "(?.+\\\)" + | rex field=ImageLoaded "(?.+\\\)" + | where ImageFolderPath = ImageLoadedFolderPath + | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company Description Product Signed SignatureStatus + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_unsigned_dll_side_loading_in_same_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -59,6 +59,7 @@ tags: - Nexus APT Threat Activity - DarkGate Malware - Earth Estries + - SnappyBee asset_type: Endpoint mitre_attack_id: - T1574.002 From d7b400dcb0cf984f8d6b9a2378c33d80400caef0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 11:29:25 +0100 Subject: [PATCH 07/48] headless_bee --- .../windows_anonymous_pipe_activity.yml | 63 ++++++++++++++++ .../endpoint/windows_create_test_registry.yml | 66 +++++++++++++++++ ...ows_svchost_exe_parent_process_anomaly.yml | 72 +++++++++++++++++++ ...swow64_process_run_system32_executable.yml | 72 +++++++++++++++++++ 4 files changed, 273 insertions(+) create mode 100644 detections/endpoint/windows_anonymous_pipe_activity.yml create mode 100644 detections/endpoint/windows_create_test_registry.yml create mode 100644 detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml create mode 100644 detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml new file mode 100644 index 0000000000..916a5a90d0 --- /dev/null +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -0,0 +1,63 @@ +name: Windows Anonymous Pipe Activity +id: ee301e1e-cd81-4011-a911-e5f049b9e3d5 +version: 1 +date: '2025-02-11' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques. +data_source: +- __UPDATE__ zero or more data_sources +search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) + | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature Image process_id process_guid EventType + | rename Image as process_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_anonymous_pipe_activity_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and pipename from your endpoints. If you are using Sysmon, + you must have at least version 6.0.4 of the Sysmon TA. . +known_false_positives: Automation tool might use anonymous pipe for task orchestration or process communication. +references: +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An anonymous Pipe Channel activity on [$dest$]. + risk_objects: + - field: dest + type: system + score: 30 + - field: user + type: user +tags: + analytic_story: + - SnappyBee + - Nexus APT Threat Activity + - Earth Estries + asset_type: Endpoint + mitre_attack_id: + - T1559 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1559/anonymous_pipe/anonymouspipe.log + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog diff --git a/detections/endpoint/windows_create_test_registry.yml b/detections/endpoint/windows_create_test_registry.yml new file mode 100644 index 0000000000..c6d4dce25f --- /dev/null +++ b/detections/endpoint/windows_create_test_registry.yml @@ -0,0 +1,66 @@ +name: Windows Create Test Registry +id: 80402396-d78a-4c6e-ade5-7697ea670adf +version: 1 +date: '2025-02-11' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for persistence, privilege escalation, or system manipulation. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior. +data_source: +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" + BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_create_test_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: Administrators and third party software may create this registry entry. +references: +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: a Test registry Entry [$registry_path$] was created on [$dest$]. + risk_objects: + - field: dest + type: system + score: 60 + - field: user + type: user + score: 60 +tags: + analytic_story: + - SnappyBee + - Nexus APT Threat Activity + - Earth Estries + asset_type: Endpoint + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/test_registry/test_reg.log + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml new file mode 100644 index 0000000000..9a2ad50310 --- /dev/null +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -0,0 +1,72 @@ +name: Windows Svchost.exe Parent Process Anomaly +id: 1d38e5e9-2ff8-4c47-872c-bf1657cefab5 +version: 1 +date: '2025-02-11' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects an anomaly where a svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows services and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown + by Processes.parent_process_name Processes.parent_process_path Processes.parent_process Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_svchost_exe_parent_process_anomaly_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Windows Update or other Windows Installer processes may launch their own svchost.exe processes that are not directly spawned by services.exe in certain edge cases (e.g., during patches or updates). +references: +- https://attack.mitre.org/techniques/T1036/009/ +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A svchost.exe process was spawned by an unexpected parent process [$parent_process_name$] instead of services.exe on [$dest$]. + risk_objects: + - field: dest + type: system + score: 50 + - field: user + type: user + score: 50 +tags: + analytic_story: + - SnappyBee + - Nexus APT Threat Activity + - Earth Estries + asset_type: Endpoint + mitre_attack_id: + - T1036.009 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/susp_svchost_proc.log + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml new file mode 100644 index 0000000000..021526d755 --- /dev/null +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -0,0 +1,72 @@ +name: Windows Unusual SysWOW64 Process Run System32 Executable +id: e4602172-db86-4315-86df-da66fb40bcde +version: 1 +date: '2025-02-11' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects an unusual process execution pattern where a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. In a typical Windows environment, 32-bit processes under SysWOW64 should primarily interact with 32-bit binaries within the same directory. However, an execution flow where a 32-bit process spawns a 64-bit binary from System32 can indicate potential process injection, privilege escalation, evasion techniques, or unauthorized execution hijacking. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_path = "*\\Windows\\SysWOW64\\*" AND Processes.process = "*windows\\system32\\*" + by Processes.parent_process_name Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_unusual_syswow64_process_run_system32_executable_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: some legitimate system processes, software updaters, or compatibility tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual parent processes should be investigated for potential malware activity, persistence mechanisms, or execution flow hijacking. +references: +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: a 32 bit process execute 64 bit executable on [$dest$]. + risk_objects: + - field: dest + type: system + score: 40 + - field: process_path + type: process_name + score: 40 +tags: + analytic_story: + - Nexus APT Threat Activity + - DarkGate Malware + - Earth Estries + asset_type: Endpoint + mitre_attack_id: + - T1036.009 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/32bit_spawn_64bit.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog From 7a8678f19d8c7848d5980dcc0a88a85ae27073ff Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 11:38:25 +0100 Subject: [PATCH 08/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 916a5a90d0..2c41aad665 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -7,7 +7,8 @@ status: production type: Anomaly description: The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques. data_source: -- __UPDATE__ zero or more data_sources +- Sysmon EventID 17 +- Sysmon EventID 18 search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature Image process_id process_guid EventType | rename Image as process_name From 7ce610f1a4cf63879c8dc347be109f2493187109 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 11:46:44 +0100 Subject: [PATCH 09/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 3 +++ detections/endpoint/windows_create_test_registry.yml | 1 + .../endpoint/windows_svchost_exe_parent_process_anomaly.yml | 5 +++++ ...dows_unusual_syswow64_process_run_system32_executable.yml | 2 +- 4 files changed, 10 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 2c41aad665..1089d5148a 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -43,6 +43,9 @@ rba: score: 30 - field: user type: user + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - SnappyBee diff --git a/detections/endpoint/windows_create_test_registry.yml b/detections/endpoint/windows_create_test_registry.yml index c6d4dce25f..d05697e58f 100644 --- a/detections/endpoint/windows_create_test_registry.yml +++ b/detections/endpoint/windows_create_test_registry.yml @@ -45,6 +45,7 @@ rba: - field: user type: user score: 60 + threat_objects: [] tags: analytic_story: - SnappyBee diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index 9a2ad50310..5fdc61cdf6 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -51,6 +51,11 @@ rba: - field: user type: user score: 50 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - SnappyBee diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml index 021526d755..bcee3f088a 100644 --- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -48,9 +48,9 @@ rba: - field: dest type: system score: 40 + threat_objects: - field: process_path type: process_name - score: 40 tags: analytic_story: - Nexus APT Threat Activity From 07df5675ddedbe218d192ccb26d7a41ddf9e06e1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 11:49:27 +0100 Subject: [PATCH 10/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 1 + detections/endpoint/windows_create_test_registry.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 1089d5148a..3308b56c70 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -43,6 +43,7 @@ rba: score: 30 - field: user type: user + score: 30 threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/windows_create_test_registry.yml b/detections/endpoint/windows_create_test_registry.yml index d05697e58f..e28b23fadd 100644 --- a/detections/endpoint/windows_create_test_registry.yml +++ b/detections/endpoint/windows_create_test_registry.yml @@ -45,7 +45,7 @@ rba: - field: user type: user score: 60 - threat_objects: [] + threat_objects: [] tags: analytic_story: - SnappyBee From 6f4026bc7deb48320972f5225b9398e02c860147 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 12:41:02 +0100 Subject: [PATCH 11/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 3308b56c70..1cc77db19e 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -10,8 +10,8 @@ data_source: - Sysmon EventID 17 - Sysmon EventID 18 search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) - | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature Image process_id process_guid EventType - | rename Image as process_name + | rename Image as process_name + | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature process_name process_id process_guid EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`' From bd0419701009a496cf1c88f26e394bc27df44954 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 12:43:10 +0100 Subject: [PATCH 12/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 1cc77db19e..6ed398ba44 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 17 - Sysmon EventID 18 search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) - | rename Image as process_name + | rename Image as process_name | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature process_name process_id process_guid EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 2d336796fc9ed4f55ae191781922d923d6385691 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 12:49:05 +0100 Subject: [PATCH 13/48] headless_bee --- .../endpoint/windows_svchost_exe_parent_process_anomaly.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index 5fdc61cdf6..3dba44623a 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -9,7 +9,8 @@ description: The following analytic detects an anomaly where a svchost.exe proce data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown by Processes.parent_process_name Processes.parent_process_path Processes.parent_process Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` From fecfefee7631a8043eed7fd91763300dc8f2f72c Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 13:12:40 +0100 Subject: [PATCH 14/48] headless_bee --- .../endpoint/windows_svchost_exe_parent_process_anomaly.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index 3dba44623a..fdb0e2decb 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -55,8 +55,6 @@ rba: threat_objects: - field: parent_process_name type: parent_process_name - - field: process_name - type: process_name tags: analytic_story: - SnappyBee From 59189f49459f474d2e44f3fb690ea344b5c06f4e Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 13:39:53 +0100 Subject: [PATCH 15/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 6ed398ba44..308c0fe4df 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -10,8 +10,7 @@ data_source: - Sysmon EventID 17 - Sysmon EventID 18 search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) - | rename Image as process_name - | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature process_name process_id process_guid EventType + | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature Image EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`' @@ -44,9 +43,7 @@ rba: - field: user type: user score: 30 - threat_objects: - - field: process_name - type: process_name + threat_objects: [] tags: analytic_story: - SnappyBee From 831743d550857c3dcb07593543c589c4e6120b67 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 13 Feb 2025 14:06:29 +0100 Subject: [PATCH 16/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 308c0fe4df..88fbde1c4f 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -9,8 +9,8 @@ description: The following analytic detects the creation or connection of anonym data_source: - Sysmon EventID 17 - Sysmon EventID 18 -search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) - | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature Image EventType +search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) + | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName process_id process_guid Image EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`' From e2ea10c2d266c606bfae5caf0931cfcd0e52c604 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 14 Feb 2025 14:15:20 +0100 Subject: [PATCH 17/48] headless_bee --- detections/endpoint/windows_anonymous_pipe_activity.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 88fbde1c4f..13005f9a71 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 17 - Sysmon EventID 18 search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*")) - | stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName process_id process_guid Image EventType + | stats min(_time) as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid ProcessId Image EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`' @@ -40,9 +40,6 @@ rba: - field: dest type: system score: 30 - - field: user - type: user - score: 30 threat_objects: [] tags: analytic_story: From d1d24fc46c224e0fe9a0c1792bf801fd6f166814 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 08:58:40 -0500 Subject: [PATCH 18/48] Update and rename winevent_scheduled_task_with_suspicious_command.yml to windows_scheduled_task_with_suspicious_command.yml Rename to align with other detections --- ...yml => windows_scheduled_task_with_suspicious_command.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{winevent_scheduled_task_with_suspicious_command.yml => windows_scheduled_task_with_suspicious_command.yml} (95%) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml similarity index 95% rename from detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml rename to detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 02ee078fc7..007015b297 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -1,4 +1,4 @@ -name: WinEvent Scheduled Task with Suspicious Command +name: Windows Scheduled Task with Suspicious Command id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 version: 1 date: '2025-02-07' @@ -20,7 +20,7 @@ search: |- | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `winevent_scheduled_task_with_suspicious_command_filter` + | `windows_scheduled_task_with_suspicious_command_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. references: From 0ca3c1d5b97cbceb2b04436f872ae3d137d54f8e Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 08:59:12 -0500 Subject: [PATCH 19/48] Update and rename winevent_scheduled_task_with_suspicious_name.yml to windows_scheduled_task_with_suspicious_name.yml --- ...me.yml => windows_scheduled_task_with_suspicious_name.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{winevent_scheduled_task_with_suspicious_name.yml => windows_scheduled_task_with_suspicious_name.yml} (95%) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml similarity index 95% rename from detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml rename to detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index 2b13e85f31..bb4c11c224 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -1,4 +1,4 @@ -name: WinEvent Scheduled Task with Suspicious Name +name: Windows Scheduled Task with Suspicious Name id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e version: 1 date: '2025-02-07' @@ -20,7 +20,7 @@ search: |- | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `winevent_scheduled_task_with_suspicious_name_filter` + | `windows_scheduled_task_with_suspicious_name_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. references: From 68f3d88ba2c69877297b1db16da25621e3cd6205 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 09:10:01 -0500 Subject: [PATCH 20/48] Update windows_scheduled_task_with_suspicious_command.yml --- .../endpoint/windows_scheduled_task_with_suspicious_command.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 007015b297..a1b6c330ce 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -62,7 +62,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1053.005 - - T1053 product: - Splunk Enterprise - Splunk Enterprise Security From 6055d2605de3e51f2aabab92dcf4c3400e669f3c Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 09:10:20 -0500 Subject: [PATCH 21/48] Update windows_scheduled_task_with_suspicious_name.yml --- .../endpoint/windows_scheduled_task_with_suspicious_name.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index bb4c11c224..e1231d4fe8 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -62,7 +62,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1053.005 - - T1053 product: - Splunk Enterprise - Splunk Enterprise Security From e23ed50fc60b805655ee977128cad2dfea6e815f Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Fri, 14 Feb 2025 19:53:37 +0000 Subject: [PATCH 22/48] O365 Suspicious Mailbox Rule Created --- .../o365_suspicious_mailbox_rule_created.yml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 detections/cloud/o365_suspicious_mailbox_rule_created.yml diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml new file mode 100644 index 0000000000..83f3c63bce --- /dev/null +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -0,0 +1,57 @@ +name: O365 Suspicious Mailbox Rule Created +id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 +version: 1 +date: '2025-02-14' +author: 0xC0FFEEEE +type: TTP +status: production +enabled_by_default: true +description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. + This may indicate that an attacker has gained access to the account. +search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* + as * | eval temp=mvzip(Name,Value, "") | fields - Name Value | mvexpand temp + | eval temp_name=mvindex(split(temp,""),0), temp_value=mvindex(split(temp,""),1) + | eval {temp_name}=temp_value | stats values(Name) as Name, values(MarkAsRead) as + MarkAsRead, values(MoveToFolder) as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name + | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1, + 0) | eval read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, + "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score + | where suspicious_score>2 | `o365_suspicious_mailbox_rule_created_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest + Office 365 management activity events. +known_false_positives: Short rule names may trigger false positives. Adjust + the entropy and length thresholds as needed. +references: +- https://attack.mitre.org/techniques/T1564/008/ +drilldown_searches: +- name: View the detection results + search: '%original_detection_search%' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A suspicious mailbox rule was created by $user$ + risk_objects: + - field: user + type: user + score: 25 +tags: + analytic_story: + - Office 365 Account Takeover + asset_type: O365 Tenant + mitre_attack_id: + - T1564.008 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log + sourcetype: o365:management:activity + source: o365 From b4783e0319c7c35244fb40cf1d4b4d40cec44fec Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Wed, 19 Feb 2025 07:52:12 +0000 Subject: [PATCH 23/48] remove enabled_by_default --- detections/cloud/o365_suspicious_mailbox_rule_created.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml index 83f3c63bce..ce6873bcf0 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -5,7 +5,6 @@ date: '2025-02-14' author: 0xC0FFEEEE type: TTP status: production -enabled_by_default: true description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account. search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* From f9c28ccdb334d9d9c92a422e1037f0386703d3e6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 19 Feb 2025 12:33:51 -0800 Subject: [PATCH 24/48] minor changes to ensure CI testing works --- detections/cloud/o365_suspicious_mailbox_rule_created.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml index ce6873bcf0..6168775f9f 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -2,7 +2,7 @@ name: O365 Suspicious Mailbox Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 version: 1 date: '2025-02-14' -author: 0xC0FFEEEE +author: '0xC0FFEEEE, Github Community' type: TTP status: production description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. @@ -37,6 +37,7 @@ rba: - field: user type: user score: 25 + threat_objects: [] tags: analytic_story: - Office 365 Account Takeover From 569d453b4928d329ee1e95a882c19b169d4ba19e Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 19 Feb 2025 16:55:30 -0500 Subject: [PATCH 25/48] Update windows_scheduled_task_with_suspicious_command.yml Task_Name to TaskName swap --- .../windows_scheduled_task_with_suspicious_command.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index a1b6c330ce..a935ff3610 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -14,10 +14,10 @@ search: |- `wineventlog_security` EventCode IN (4698,4700,4702) | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent - | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, Task_Name, Command, Enabled, Hidden, EventCode + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode | lookup windows_suspicious_tasks task_command as Command | where tool == "shell command use" OR tool == "suspicious paths" - | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode + | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_suspicious_command_filter` @@ -42,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A suspicious windows scheduled task named [$Task_Name$] was detected on $dest$, this may be an indicator of [$tool$] + message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$] risk_objects: - field: dest type: system From fe46608339fcfeb8e0a71baf8d7883386c8bc165 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 19 Feb 2025 16:57:14 -0500 Subject: [PATCH 26/48] Update windows_scheduled_task_with_suspicious_name.yml Task_Name to TaskName --- .../windows_scheduled_task_with_suspicious_name.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index e1231d4fe8..9c039ab87b 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -14,10 +14,10 @@ search: |- `wineventlog_security` EventCode IN (4698,4700,4702) | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent - | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Task_Name, Command, Enabled, Hidden,Caller_User_Name, EventCode - | lookup windows_suspicious_tasks task_name as Task_Name + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode + | lookup windows_suspicious_tasks task_name as TaskName | where isnotnull(tool_type) - | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer + | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_suspicious_name_filter` @@ -38,11 +38,11 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate schedule tasks on $dest$ - search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND Task_Name = "$Task_Name$"' + search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A windows scheduled task was created with known suspicious task name [$Task_Name$] on $dest$, this may be a [$tool$] indicator + message: A windows scheduled task was created with known suspicious task name [$TaskName$] on $dest$, this may be a [$tool$] indicator risk_objects: - field: dest type: system From 7e9f15047457077150e6ef7dcbc9abe90c0e185d Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Wed, 19 Feb 2025 22:17:11 +0000 Subject: [PATCH 27/48] add url toolbox requirement --- detections/cloud/o365_suspicious_mailbox_rule_created.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml index 6168775f9f..925030c0b1 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -17,7 +17,8 @@ search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score | where suspicious_score>2 | `o365_suspicious_mailbox_rule_created_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest - Office 365 management activity events. + Office 365 management activity events. You also need to have the Splunk TA URL + Toolbox (https://splunkbase.splunk.com/app/2734/) installed. known_false_positives: Short rule names may trigger false positives. Adjust the entropy and length thresholds as needed. references: From 4e6b095129fd6bf5815e0377f2c3f97cadff3c67 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Thu, 20 Feb 2025 18:19:32 +0100 Subject: [PATCH 28/48] Update detections/endpoint/executables_or_script_creation_in_temp_path.yml Co-authored-by: Nasreddine Bencherchali --- .../endpoint/executables_or_script_creation_in_temp_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 09e497bd9e..69da4719ff 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -48,8 +48,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious executable or scripts with file name $file_name$, $file_path$ - and process_id $process_id$ executed in temp file path in Windows by $user$ + message: Potentially suspicious executable or script with file name $file_name$, $file_path$ + and process_id $process_id$ was created in temporary folder by $user$ risk_objects: - field: user type: user From 26cb0921d4a1e7aa90759ea3b44e08f3a017a605 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Thu, 20 Feb 2025 18:19:42 +0100 Subject: [PATCH 29/48] Update detections/endpoint/windows_anonymous_pipe_activity.yml Co-authored-by: Nasreddine Bencherchali --- detections/endpoint/windows_anonymous_pipe_activity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index 13005f9a71..e3f239c332 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -4,7 +4,7 @@ version: 1 date: '2025-02-11' author: Teoderick Contreras, Splunk status: production -type: Anomaly +type: Hunting description: The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques. data_source: - Sysmon EventID 17 From 2e9bc8698347b63e1b1d3231c55e83e427273882 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Thu, 20 Feb 2025 18:20:13 +0100 Subject: [PATCH 30/48] Update detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml Co-authored-by: Nasreddine Bencherchali --- .../endpoint/windows_svchost_exe_parent_process_anomaly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index fdb0e2decb..7b51147449 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -5,7 +5,7 @@ date: '2025-02-11' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects an anomaly where a svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows services and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity. +description: The following analytic detects an anomaly where an svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows service DLLs, and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 From 1eb8731869fdcac3fd4bb71d6b217076c5a8d676 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Thu, 20 Feb 2025 18:20:23 +0100 Subject: [PATCH 31/48] Update detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml Co-authored-by: Nasreddine Bencherchali --- .../endpoint/windows_svchost_exe_parent_process_anomaly.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index 7b51147449..cd7653e996 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -44,7 +44,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A svchost.exe process was spawned by an unexpected parent process [$parent_process_name$] instead of services.exe on [$dest$]. + message: An svchost.exe process was spawned by an unexpected parent process [$parent_process_name$] instead of services.exe on [$dest$]. risk_objects: - field: dest type: system From 265cd83413f32f51bd76ca2f0083106195b8e7f3 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Fri, 21 Feb 2025 13:26:44 +0100 Subject: [PATCH 32/48] headless_bee --- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- .../executables_or_script_creation_in_temp_path.yml | 2 +- detections/endpoint/windows_anonymous_pipe_activity.yml | 7 ------- ...stry.yml => windows_snappybee_create_test_registry.yml} | 6 +++--- .../windows_svchost_exe_parent_process_anomaly.yml | 4 +++- 5 files changed, 8 insertions(+), 13 deletions(-) rename detections/endpoint/{windows_create_test_registry.yml => windows_snappybee_create_test_registry.yml} (85%) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 726e5bbf76..1948f9a1cf 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -18,7 +18,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", - "*\\Windows\\repair\\*", "*\\PerfLogs\\*", "*\\programdata\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*")) + "*\\Windows\\repair\\*", "*\\PerfLogs\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*")) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 69da4719ff..9e59e81768 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -17,7 +17,7 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") - AND Filesystem.file_path IN ("*\\temp\\*") + AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*:\\Windows\\Temp\\*", "*:\\Temp*") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index e3f239c332..e0eac5c8c4 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -34,13 +34,6 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: - message: An anonymous Pipe Channel activity on [$dest$]. - risk_objects: - - field: dest - type: system - score: 30 - threat_objects: [] tags: analytic_story: - SnappyBee diff --git a/detections/endpoint/windows_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml similarity index 85% rename from detections/endpoint/windows_create_test_registry.yml rename to detections/endpoint/windows_snappybee_create_test_registry.yml index e28b23fadd..107ce74646 100644 --- a/detections/endpoint/windows_create_test_registry.yml +++ b/detections/endpoint/windows_snappybee_create_test_registry.yml @@ -1,11 +1,11 @@ -name: Windows Create Test Registry +name: Windows SnappyBee Create Test Registry id: 80402396-d78a-4c6e-ade5-7697ea670adf version: 1 date: '2025-02-11' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for persistence, privilege escalation, or system manipulation. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior. +description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration file, or system mark compromised. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior. data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry @@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_create_test_registry_filter`' + | `windows_snappybee_create_test_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index cd7653e996..d04ec4ac62 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -10,7 +10,9 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown + where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown + AND Processes.parent_process_path != "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe" + AND Processes.parent_process_path != "C:\\Program Files\\Windows Defender\\MsMpEng.exe" by Processes.parent_process_name Processes.parent_process_path Processes.parent_process Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` From f05c6278a21e5ad26828561b36251ee96894f747 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Fri, 21 Feb 2025 14:04:06 +0100 Subject: [PATCH 33/48] headless_bee --- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 1948f9a1cf..fc1bb90dfe 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -112,6 +112,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog From 7939d2fa83912c6aa431f9b94a4defdd6ebdfd5a Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Mon, 24 Feb 2025 11:52:22 +0100 Subject: [PATCH 34/48] headless_bee --- .../endpoint/any_powershell_downloadfile.yml | 26 +++++------ .../endpoint/detect_rare_executables.yml | 2 +- detections/endpoint/detect_renamed_psexec.yml | 22 +++++----- detections/endpoint/detect_renamed_winrar.yml | 14 +++--- ..._or_script_creation_in_suspicious_path.yml | 2 +- ...tables_or_script_creation_in_temp_path.yml | 2 +- ...file_permission_modification_via_chmod.yml | 16 +++---- ..._auditd_nopasswd_entry_in_sudoers_file.yml | 10 ++--- ...td_possible_access_to_credential_files.yml | 10 ++--- ...auditd_possible_access_to_sudoers_file.yml | 10 ++--- ...ux_auditd_preload_hijack_library_calls.yml | 10 ++--- ...x_common_process_for_elevation_control.yml | 10 ++--- ...x_file_creation_in_init_boot_directory.yml | 10 ++--- .../linux_iptables_firewall_modification.yml | 12 ++--- .../linux_nopasswd_entry_in_sudoers_file.yml | 14 +++--- ...ux_possible_access_to_credential_files.yml | 10 ++--- .../linux_possible_access_to_sudoers_file.yml | 14 +++--- .../linux_preload_hijack_library_calls.yml | 14 +++--- .../linux_sudoers_tmp_file_creation.yml | 14 +++--- ...hell_process___execution_policy_bypass.yml | 14 +++--- ...e_process_accessing_chrome_default_dir.yml | 2 +- ...fox_process_access_firefox_profile_dir.yml | 2 +- .../endpoint/powershell_4104_hunting.yml | 24 +++++----- .../registry_keys_used_for_persistence.yml | 2 +- .../remote_process_instantiation_via_wmi.yml | 9 ++-- ...eduled_task_deleted_or_created_via_cmd.yml | 44 +++++++++---------- ...ious_regsvr32_register_suspicious_path.yml | 16 +++---- ...s_scheduled_task_from_public_directory.yml | 28 ++++++------ ...ss_token_manipulation_sedebugprivilege.yml | 2 +- .../windows_anonymous_pipe_activity.yml | 2 +- ...windows_archive_collected_data_via_rar.yml | 10 ++--- ...ssword_stores_chrome_localstate_access.yml | 2 +- ...ssword_stores_chrome_login_data_access.yml | 2 +- ...ndows_curl_download_to_suspicious_path.yml | 9 ++-- ...uery_registry_browser_list_application.yml | 2 +- ...ws_replication_through_removable_media.yml | 9 ++-- ...ws_service_creation_on_remote_endpoint.yml | 2 +- ..._service_creation_using_registry_entry.yml | 2 +- ...windows_snappybee_create_test_registry.yml | 2 +- .../windows_suspicious_process_file_path.yml | 2 +- ...ows_svchost_exe_parent_process_anomaly.yml | 2 +- .../windows_unsigned_dll_side_loading.yml | 7 +-- ..._dll_side_loading_in_same_process_path.yml | 2 +- .../windows_unsigned_ms_dll_side_loading.yml | 7 +-- ...swow64_process_run_system32_executable.yml | 2 +- ..._scheduled_task_created_to_spawn_shell.yml | 26 +++++------ ...eduled_task_created_within_public_path.yml | 36 +++++++-------- .../detect_large_outbound_icmp_packets.yml | 7 +-- stories/china_nexus_threat_activity.yml | 22 ++++++++++ stories/nexus_apt_threat_activity.yml | 21 --------- 50 files changed, 274 insertions(+), 267 deletions(-) create mode 100644 stories/china_nexus_threat_activity.yml delete mode 100644 stories/nexus_apt_threat_activity.yml diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 65a6733058..ecde18edbe 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,7 +1,7 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: 11 -date: '2025-02-10' +version: '12' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: TTP @@ -71,18 +71,19 @@ rba: type: process_name tags: analytic_story: - - Data Destruction - Ingress Tool Transfer - - DarkCrystal RAT - - PXA Stealer - - Braodo Stealer - - Phemedrone Stealer - - Log4Shell CVE-2021-44228 - - Malicious PowerShell - - Hermetic Wiper + - China-Nexus Threat Activity - Crypto Stealer - - Nexus APT Threat Activity + - Hermetic Wiper + - DarkCrystal RAT + - Malicious PowerShell - Earth Estries + - Phemedrone Stealer + - Braodo Stealer + - PXA Stealer + - Nexus APT Threat Activity + - Data Destruction + - Log4Shell CVE-2021-44228 asset_type: Endpoint cve: - CVE-2021-44228 @@ -97,7 +98,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index 60255c6204..a19ca4ff86 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -60,7 +60,7 @@ tags: analytic_story: - SnappyBee - Rhysida Ransomware - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Crypto Stealer - Earth Estries - Unusual Processes diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 27479f9d15..b182aba8d4 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,7 +1,7 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 11 -date: '2025-02-10' +version: '12' +date: '2025-02-24' author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production type: Hunting @@ -39,18 +39,19 @@ references: - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ tags: analytic_story: + - China-Nexus Threat Activity - BlackByte Ransomware - - DHS Report TA18-074A - - DarkSide Ransomware - - SamSam Ransomware - - CISA AA22-320A - HAFNIUM Group - - Sandworm Tools + - DHS Report TA18-074A + - CISA AA22-320A + - DarkSide Ransomware - Active Directory Lateral Movement - - Nexus APT Threat Activity - DarkGate Malware - - Earth Estries + - Sandworm Tools - Rhysida Ransomware + - Nexus APT Threat Activity + - Earth Estries + - SamSam Ransomware asset_type: Endpoint mitre_attack_id: - T1569.002 @@ -62,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 5c146b775f..c1d68de9f1 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -1,7 +1,7 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 9 -date: '2025-02-10' +version: '10' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: Hunting @@ -38,10 +38,11 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md tags: analytic_story: - - Collection and Staging - - Earth Estries - - Nexus APT Threat Activity + - China-Nexus Threat Activity - CISA AA22-277A + - Collection and Staging + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1560.001 @@ -53,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index fc1bb90dfe..fe61bbabe6 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -95,7 +95,7 @@ tags: - Amadey - DarkCrystal RAT - Remcos - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries - Rhysida Ransomware - RedLine Stealer diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 9e59e81768..048578c69d 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -94,7 +94,7 @@ tags: - Amadey - DarkCrystal RAT - Remcos - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries - Rhysida Ransomware - RedLine Stealer diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index 7ce6b582fc..4b1c37d6fd 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -1,8 +1,8 @@ name: Linux Auditd File Permission Modification Via Chmod id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 -version: 7 -date: '2025-02-10' -author: Teoderick Contreras, Splunk, Ivar Nygård +version: '8' +date: '2025-02-24' +author: "Teoderick Contreras, Splunk, Ivar Nyg\xE5rd" status: production type: Anomaly description: The following analytic detects suspicious file permission modifications @@ -58,11 +58,12 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Privilege Escalation - - Linux Living Off The Land - - Compromised Linux Host + - China-Nexus Threat Activity - Linux Persistence Techniques - XorDDos + - Linux Privilege Escalation + - Compromised Linux Host + - Linux Living Off The Land - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint @@ -76,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 2470ddfe8f..1e04a0c022 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b -version: 5 -date: '2025-02-10' +version: '6' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,9 +57,10 @@ rba: threat_objects: [] tags: analytic_story: + - China-Nexus Threat Activity + - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Linux Persistence Techniques - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint @@ -73,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 62158c07f3..c18a158fab 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 -version: 5 -date: '2025-02-10' +version: '6' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -59,9 +59,10 @@ rba: threat_objects: [] tags: analytic_story: + - China-Nexus Threat Activity + - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Linux Persistence Techniques - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint @@ -75,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index ce58e5dae8..100f27d690 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 -version: 5 -date: '2025-02-10' +version: '6' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -56,9 +56,10 @@ rba: threat_objects: [] tags: analytic_story: + - China-Nexus Threat Activity + - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Linux Persistence Techniques - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index 8eb1a95ce2..5aade0e41b 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 -version: 5 -date: '2025-02-10' +version: '6' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,9 +57,10 @@ rba: threat_objects: [] tags: analytic_story: + - China-Nexus Threat Activity + - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Linux Persistence Techniques - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint @@ -73,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index 221f4c30c6..b5c698c6d5 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -1,7 +1,7 @@ name: Linux Common Process For Elevation Control id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -44,9 +44,10 @@ references: - https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml tags: analytic_story: + - China-Nexus Threat Activity + - Linux Persistence Techniques - Linux Privilege Escalation - Linux Living Off The Land - - Linux Persistence Techniques - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint @@ -60,7 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 05900fd9fa..8c97b26dc2 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -1,7 +1,7 @@ name: Linux File Creation In Init Boot Directory id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -version: 7 -date: '2025-02-10' +version: '8' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,10 +49,11 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Privilege Escalation + - China-Nexus Threat Activity - Backdoor Pingpong - Linux Persistence Techniques - XorDDos + - Linux Privilege Escalation - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: @@ -65,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 395f7c7c45..961ca11c19 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 8 -date: '2025-02-10' +version: '9' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -66,10 +66,11 @@ rba: threat_objects: [] tags: analytic_story: - - Sandworm Tools + - China-Nexus Threat Activity - Backdoor Pingpong - - Nexus APT Threat Activity - Cyclops Blink + - Sandworm Tools + - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1562.004 @@ -81,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 42d8d99f84..83ff35031f 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux NOPASSWD Entry In Sudoers File id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,10 +58,11 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Privilege Escalation - - Earth Estries - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Linux Persistence Techniques + - Linux Privilege Escalation + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -73,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index 9bbbe61f67..b9c427b519 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Credential Files id: 16107e0e-71fc-11ec-b862-acde48001122 -version: 7 -date: '2025-02-10' +version: '8' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,9 +57,10 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Privilege Escalation + - China-Nexus Threat Activity - Linux Persistence Techniques - XorDDos + - Linux Privilege Escalation - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint @@ -73,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index 92ff1b6f97..005a8e172f 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Sudoers File id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,10 +57,11 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Privilege Escalation - - Earth Estries - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Linux Persistence Techniques + - Linux Privilege Escalation + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index 051c3c042d..6e9968e904 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Preload Hijack Library Calls id: cbe2ca30-631e-11ec-8670-acde48001122 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,10 +57,11 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Privilege Escalation - - Earth Estries - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Linux Persistence Techniques + - Linux Privilege Escalation + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.006 @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index cd67ed8058..df9d9a6933 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Sudoers Tmp File Creation id: be254a5c-63e7-11ec-89da-acde48001122 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,10 +51,11 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Privilege Escalation - - Earth Estries - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Linux Persistence Techniques + - Linux Privilege Escalation + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index ecc670ddcd..351bf4e982 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,7 +1,7 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: 10 -date: '2025-02-10' +version: '11' +date: '2025-02-24' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: Anomaly @@ -60,11 +60,12 @@ rba: threat_objects: [] tags: analytic_story: - - DHS Report TA18-074A - - AsyncRAT - - DarkCrystal RAT + - China-Nexus Threat Activity - HAFNIUM Group + - DHS Report TA18-074A + - DarkCrystal RAT - Nexus APT Threat Activity + - AsyncRAT - Earth Estries - Volt Typhoon asset_type: Endpoint @@ -78,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 1e39d1e1f8..8e927a7a6b 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -58,7 +58,7 @@ tags: - FIN7 - Earth Estries - Warzone RAT - - Nexus APT Threat Activity + - China-Nexus Threat Activity - DarkGate Malware - Remcos - RedLine Stealer diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 66508ecda2..c9e182d0f7 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -55,7 +55,7 @@ tags: - CISA AA23-347A - 3CX Supply Chain Attack - Azorult - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Warzone RAT - AgentTesla - RedLine Stealer diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index e4c1ddafe7..b8e189bc3c 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 11 -date: '2025-02-10' +version: '12' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: Hunting @@ -59,19 +59,20 @@ references: - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ tags: analytic_story: - - Data Destruction + - China-Nexus Threat Activity + - CISA AA24-241A + - Nexus APT Threat Activity + - Malicious PowerShell - Flax Typhoon - CISA AA23-347A - - Braodo Stealer - - Cleo File Transfer Software - - Malicious PowerShell - - Hermetic Wiper - DarkGate Malware - - Lumma Stealer - - Nexus APT Threat Activity - Earth Estries + - Cleo File Transfer Software + - Braodo Stealer + - Lumma Stealer - Rhysida Ransomware - - CISA AA24-241A + - Data Destruction + - Hermetic Wiper asset_type: Endpoint mitre_attack_id: - T1059.001 @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 6d0fe9d720..8628b1ba88 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -84,7 +84,7 @@ tags: - Chaos Ransomware - WinDealer RAT - Warzone RAT - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries - SnappyBee - Windows Persistence Techniques diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 45d08b0f06..3706bbda7a 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: 11 -date: '2025-01-27' +version: '12' +date: '2025-02-24' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: TTP @@ -65,10 +65,11 @@ rba: threat_objects: [] tags: analytic_story: - - CISA AA23-347A + - China-Nexus Threat Activity - Ransomware - - Suspicious WMI Use - Active Directory Lateral Movement + - CISA AA23-347A + - Suspicious WMI Use - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 5090e71991..d185457d0e 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,7 +1,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c -version: 12 -date: '2025-02-10' +version: '13' +date: '2025-02-24' author: Bhavin Patel, Splunk status: production type: TTP @@ -66,32 +66,33 @@ rba: threat_objects: [] tags: analytic_story: - - Windows Persistence Techniques - DHS Report TA18-074A - Trickbot - - CISA AA23-347A - - Qakbot - - Azorult - - ShrinkLocker - - AsyncRAT - - Phemedrone Stealer - - NjRAT - - Prestige Ransomware - - Scheduled Tasks - - AgentTesla - - MoonPeak - NOBELIUM Group - - Living Off The Land - - CISA AA22-257A + - Prestige Ransomware + - Earth Estries + - ShrinkLocker + - NjRAT - CISA AA24-241A - - Amadey - DarkCrystal RAT - Sandworm Tools - - Winter Vivern + - Living Off The Land - Nexus APT Threat Activity - - Earth Estries - - Rhysida Ransomware + - AsyncRAT + - Scheduled Tasks + - AgentTesla + - Windows Persistence Techniques - RedLine Stealer + - Rhysida Ransomware + - Winter Vivern + - China-Nexus Threat Activity + - Qakbot + - CISA AA22-257A + - MoonPeak + - CISA AA23-347A + - Phemedrone Stealer + - Azorult + - Amadey asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -103,7 +104,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 598771f5eb..25f610fcba 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,7 +1,7 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: 12 -date: '2025-02-10' +version: '13' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: TTP @@ -73,13 +73,14 @@ rba: type: process_name tags: analytic_story: + - China-Nexus Threat Activity + - IcedID - Qakbot + - Derusbi + - Living Off The Land + - Nexus APT Threat Activity - Earth Estries - Suspicious Regsvr32 Activity - - IcedID - - Derusbi - - Nexus APT Threat Activity - - Living Off The Land asset_type: Endpoint mitre_attack_id: - T1218.010 @@ -91,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 8e78c248d6..a6d87b4074 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -1,7 +1,7 @@ name: Suspicious Scheduled Task from Public Directory id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: Anomaly @@ -65,19 +65,20 @@ rba: threat_objects: [] tags: analytic_story: - - Windows Persistence Techniques - - CISA AA23-347A - - Ransomware - - DarkCrystal RAT - - Scheduled Tasks - - Azorult + - China-Nexus Threat Activity - Crypto Stealer - - Nexus APT Threat Activity - - Living Off The Land + - Ransomware - MoonPeak - - Ryuk Ransomware - - Earth Estries + - DarkCrystal RAT - CISA AA24-241A + - CISA AA23-347A + - Windows Persistence Techniques + - Living Off The Land + - Nexus APT Threat Activity + - Azorult + - Ryuk Ransomware + - Scheduled Tasks + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -89,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 9bacc10183..e35b05c208 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -65,7 +65,7 @@ tags: - AsyncRAT - Derusbi - PlugX - - Nexus APT Threat Activity + - China-Nexus Threat Activity - DarkGate Malware - Earth Estries asset_type: Endpoint diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml index e0eac5c8c4..1102c6ffa3 100644 --- a/detections/endpoint/windows_anonymous_pipe_activity.yml +++ b/detections/endpoint/windows_anonymous_pipe_activity.yml @@ -37,7 +37,7 @@ drilldown_searches: tags: analytic_story: - SnappyBee - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml index 7a1bc686a4..7b2fcb5e62 100644 --- a/detections/endpoint/windows_archive_collected_data_via_rar.yml +++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml @@ -1,7 +1,7 @@ name: Windows Archive Collected Data via Rar id: 2015de95-fe91-413d-9d62-2fe011b67e82 -version: 6 -date: '2025-02-10' +version: '7' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -61,9 +61,10 @@ rba: threat_objects: [] tags: analytic_story: + - DarkGate Malware + - China-Nexus Threat Activity - Earth Estries - Nexus APT Threat Activity - - DarkGate Malware asset_type: Endpoint mitre_attack_id: - T1560.001 @@ -75,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 92a303a0cf..299c24b138 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -61,7 +61,7 @@ tags: - Amadey - PXA Stealer - Warzone RAT - - Nexus APT Threat Activity + - China-Nexus Threat Activity - DarkGate Malware - RedLine Stealer - Earth Estries diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 48bcd82e48..4464a24721 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -62,7 +62,7 @@ tags: - Amadey - PXA Stealer - Warzone RAT - - Nexus APT Threat Activity + - China-Nexus Threat Activity - DarkGate Malware - RedLine Stealer - Earth Estries diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index fc5ad0009f..e38b89ded7 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,7 +1,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: 8 -date: '2025-01-27' +version: '9' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: TTP @@ -71,11 +71,12 @@ rba: tags: analytic_story: - Ingress Tool Transfer - - Forest Blizzard + - China-Nexus Threat Activity - IcedID - Nexus APT Threat Activity - - Compromised Windows Host + - Forest Blizzard - Earth Estries + - Compromised Windows Host asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml index 2038fd726e..1672d23bfe 100644 --- a/detections/endpoint/windows_query_registry_browser_list_application.yml +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -54,7 +54,7 @@ tags: - SnappyBee - RedLine Stealer - Earth Estries - - Nexus APT Threat Activity + - China-Nexus Threat Activity asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 7817d86c25..fc49bd7b92 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,7 +1,7 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 -version: 7 -date: '2025-01-27' +version: '8' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: TTP @@ -60,12 +60,13 @@ rba: type: file_name tags: analytic_story: - - PlugX + - NjRAT + - China-Nexus Threat Activity - Chaos Ransomware - Derusbi + - PlugX - Nexus APT Threat Activity - Earth Estries - - NjRAT asset_type: Endpoint mitre_attack_id: - T1091 diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 5a734268d8..1a143a424a 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -65,7 +65,7 @@ tags: - SnappyBee - CISA AA23-347A - Active Directory Lateral Movement - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 00dc756023..fb96ae4e10 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -57,7 +57,7 @@ tags: - Brute Ratel C4 - CISA AA23-347A - Suspicious Windows Registry Activities - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Derusbi - PlugX - Windows Registry Abuse diff --git a/detections/endpoint/windows_snappybee_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml index 107ce74646..2854203d3f 100644 --- a/detections/endpoint/windows_snappybee_create_test_registry.yml +++ b/detections/endpoint/windows_snappybee_create_test_registry.yml @@ -49,7 +49,7 @@ rba: tags: analytic_story: - SnappyBee - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 79b151ff2c..f2862efdbb 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -103,7 +103,7 @@ tags: - MoonPeak - ValleyRAT - Meduza Stealer - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries - SnappyBee asset_type: Endpoint diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index d04ec4ac62..8714046ce3 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -60,7 +60,7 @@ rba: tags: analytic_story: - SnappyBee - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index f6c7a56920..7034140a74 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: 7 -date: '2025-01-27' +version: '8' +date: '2025-02-24' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,10 +52,11 @@ rba: tags: analytic_story: - Warzone RAT + - NjRAT + - China-Nexus Threat Activity - Derusbi - Nexus APT Threat Activity - Earth Estries - - NjRAT asset_type: Endpoint mitre_attack_id: - T1574.002 diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index 8a48c65978..b49c48ff8a 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -56,7 +56,7 @@ tags: analytic_story: - PlugX - Derusbi - - Nexus APT Threat Activity + - China-Nexus Threat Activity - DarkGate Malware - Earth Estries - SnappyBee diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index add7f13b4d..bf38badfc3 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: 7 -date: '2025-01-27' +version: '8' +date: '2025-02-24' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -64,9 +64,10 @@ rba: type: file_name tags: analytic_story: + - China-Nexus Threat Activity - Derusbi - - APT29 Diplomatic Deceptions with WINELOADER - Nexus APT Threat Activity + - APT29 Diplomatic Deceptions with WINELOADER - Earth Estries group: - APT29 diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml index bcee3f088a..87beb38b68 100644 --- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -53,7 +53,7 @@ rba: type: process_name tags: analytic_story: - - Nexus APT Threat Activity + - China-Nexus Threat Activity - DarkGate Malware - Earth Estries asset_type: Endpoint diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 36d6515acc..9f9217f4bd 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created to Spawn Shell id: 203ef0ea-9bd8-11eb-8201-acde48001122 -version: 9 -date: '2025-02-10' +version: '10' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: TTP @@ -54,16 +54,17 @@ rba: threat_objects: [] tags: analytic_story: - - Windows Persistence Techniques - - Ransomware - - Windows Error Reporting Service Elevation of Privilege Vulnerability - - Scheduled Tasks - - Winter Vivern - - Nexus APT Threat Activity - - Compromised Windows Host - - Ryuk Ransomware - - Earth Estries + - China-Nexus Threat Activity - CISA AA22-257A + - Windows Error Reporting Service Elevation of Privilege Vulnerability + - Compromised Windows Host + - Ransomware + - Windows Persistence Techniques + - Nexus APT Threat Activity + - Ryuk Ransomware + - Scheduled Tasks + - Earth Estries + - Winter Vivern asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -75,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index b7a530c00d..756ab1465d 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created Within Public Path id: 5d9c6eee-988c-11eb-8253-acde48001122 -version: 9 -date: '2025-02-10' +version: '10' +date: '2025-02-24' author: Michael Haag, Splunk status: production type: TTP @@ -54,22 +54,23 @@ rba: threat_objects: [] tags: analytic_story: - - Data Destruction - - Windows Persistence Techniques - - AsyncRAT - - Industroyer2 - - CISA AA23-347A - - Ransomware - - Prestige Ransomware - - Scheduled Tasks + - China-Nexus Threat Activity - IcedID - - Winter Vivern - - Active Directory Lateral Movement - - Nexus APT Threat Activity - - Compromised Windows Host - - Ryuk Ransomware - - Earth Estries - CISA AA22-257A + - Compromised Windows Host + - Ransomware + - Nexus APT Threat Activity + - Active Directory Lateral Movement + - CISA AA23-347A + - Windows Persistence Techniques + - Earth Estries + - Prestige Ransomware + - Industroyer2 + - Ryuk Ransomware + - AsyncRAT + - Scheduled Tasks + - Data Destruction + - Winter Vivern asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -81,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index 9fa1a7f4b5..0e1657e876 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -1,7 +1,7 @@ name: Detect Large Outbound ICMP Packets id: e9c102de-4d43-42a7-b1c8-8062ea297419 -version: 9 -date: '2025-01-27' +version: '10' +date: '2025-02-24' author: Rico Valdez, Dean Luxton, Splunk status: production type: TTP @@ -66,9 +66,10 @@ rba: threat_objects: [] tags: analytic_story: + - Command And Control + - China-Nexus Threat Activity - Backdoor Pingpong - Nexus APT Threat Activity - - Command And Control asset_type: Endpoint mitre_attack_id: - T1095 diff --git a/stories/china_nexus_threat_activity.yml b/stories/china_nexus_threat_activity.yml new file mode 100644 index 0000000000..740f595dde --- /dev/null +++ b/stories/china_nexus_threat_activity.yml @@ -0,0 +1,22 @@ +name: China-Nexus Threat Activity +id: 43f8062d-4da0-4f48-8cad-6a20e108961b +version: 2 +date: '2025-02-24' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, Chinese state-nexus adversaries known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. +narrative: Chinese state-nexus threat group are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. +references: +- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/ +- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink +- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf +- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf +- https://www.crowdstrike.com/adversaries/envoy-panda/ +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/nexus_apt_threat_activity.yml b/stories/nexus_apt_threat_activity.yml deleted file mode 100644 index bd6aed1350..0000000000 --- a/stories/nexus_apt_threat_activity.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: Nexus APT Threat Activity -id: 43f8062d-4da0-4f48-8cad-6a20e108961b -version: 1 -date: '2025-01-27' -author: Teoderick Contreras, Splunk -status: production -description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, an advanced persistent threat (APT) group known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. -narrative: Chinese state-nexus threat actors are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. -references: -- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/ -- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink -- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf -- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf -tags: - category: - - Malware - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file From 1f3fb62796b3883ace6133fa20c5d7af6d8d47ba Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Mon, 24 Feb 2025 12:08:52 +0100 Subject: [PATCH 35/48] headless_bee --- detections/endpoint/any_powershell_downloadfile.yml | 1 - detections/endpoint/detect_renamed_psexec.yml | 1 - detections/endpoint/detect_renamed_winrar.yml | 1 - .../linux_auditd_file_permission_modification_via_chmod.yml | 1 - .../linux_auditd_nopasswd_entry_in_sudoers_file.yml | 1 - .../endpoint/linux_auditd_preload_hijack_library_calls.yml | 1 - .../endpoint/linux_common_process_for_elevation_control.yml | 1 - .../endpoint/linux_file_creation_in_init_boot_directory.yml | 1 - .../endpoint/linux_iptables_firewall_modification.yml | 1 - .../endpoint/linux_nopasswd_entry_in_sudoers_file.yml | 1 - .../endpoint/linux_possible_access_to_sudoers_file.yml | 1 - detections/endpoint/linux_preload_hijack_library_calls.yml | 1 - detections/endpoint/linux_sudoers_tmp_file_creation.yml | 1 - ...licious_powershell_process___execution_policy_bypass.yml | 1 - detections/endpoint/powershell_4104_hunting.yml | 1 - .../endpoint/remote_process_instantiation_via_wmi.yml | 1 - .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml | 1 - .../suspicious_regsvr32_register_suspicious_path.yml | 1 - .../suspicious_scheduled_task_from_public_directory.yml | 1 - .../endpoint/windows_archive_collected_data_via_rar.yml | 1 - ...indows_credential_access_from_browser_password_store.yml | 6 +++--- .../endpoint/windows_curl_download_to_suspicious_path.yml | 1 - .../windows_replication_through_removable_media.yml | 1 - ...windows_service_created_with_suspicious_service_path.yml | 6 +++--- detections/endpoint/windows_unsigned_dll_side_loading.yml | 1 - .../winevent_scheduled_task_created_to_spawn_shell.yml | 1 - detections/network/detect_large_outbound_icmp_packets.yml | 1 - 27 files changed, 6 insertions(+), 31 deletions(-) diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index ecde18edbe..0cee497f25 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -81,7 +81,6 @@ tags: - Phemedrone Stealer - Braodo Stealer - PXA Stealer - - Nexus APT Threat Activity - Data Destruction - Log4Shell CVE-2021-44228 asset_type: Endpoint diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index b182aba8d4..9e1fbafe91 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -49,7 +49,6 @@ tags: - DarkGate Malware - Sandworm Tools - Rhysida Ransomware - - Nexus APT Threat Activity - Earth Estries - SamSam Ransomware asset_type: Endpoint diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index c1d68de9f1..f676b4c7db 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -41,7 +41,6 @@ tags: - China-Nexus Threat Activity - CISA AA22-277A - Collection and Staging - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index 4b1c37d6fd..4551e56231 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -64,7 +64,6 @@ tags: - Linux Privilege Escalation - Compromised Linux Host - Linux Living Off The Land - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 1e04a0c022..b501c3dd04 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -61,7 +61,6 @@ tags: - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index 5aade0e41b..d2d82902be 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -61,7 +61,6 @@ tags: - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index b5c698c6d5..b823b6e94c 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -48,7 +48,6 @@ tags: - Linux Persistence Techniques - Linux Privilege Escalation - Linux Living Off The Land - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 8c97b26dc2..143c90cbbc 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -54,7 +54,6 @@ tags: - Linux Persistence Techniques - XorDDos - Linux Privilege Escalation - - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1037.004 diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 961ca11c19..9b1d5a8d69 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -70,7 +70,6 @@ tags: - Backdoor Pingpong - Cyclops Blink - Sandworm Tools - - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1562.004 diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 83ff35031f..90563b48db 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -61,7 +61,6 @@ tags: - China-Nexus Threat Activity - Linux Persistence Techniques - Linux Privilege Escalation - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index 005a8e172f..b9936bb72e 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -60,7 +60,6 @@ tags: - China-Nexus Threat Activity - Linux Persistence Techniques - Linux Privilege Escalation - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index 6e9968e904..1d2059864e 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -60,7 +60,6 @@ tags: - China-Nexus Threat Activity - Linux Persistence Techniques - Linux Privilege Escalation - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index df9d9a6933..ca24f2680e 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -54,7 +54,6 @@ tags: - China-Nexus Threat Activity - Linux Persistence Techniques - Linux Privilege Escalation - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 351bf4e982..5051787f4a 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -64,7 +64,6 @@ tags: - HAFNIUM Group - DHS Report TA18-074A - DarkCrystal RAT - - Nexus APT Threat Activity - AsyncRAT - Earth Estries - Volt Typhoon diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index b8e189bc3c..d4a20fcd06 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -61,7 +61,6 @@ tags: analytic_story: - China-Nexus Threat Activity - CISA AA24-241A - - Nexus APT Threat Activity - Malicious PowerShell - Flax Typhoon - CISA AA23-347A diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 3706bbda7a..677dae13f9 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -70,7 +70,6 @@ tags: - Active Directory Lateral Movement - CISA AA23-347A - Suspicious WMI Use - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index d185457d0e..f8dd98ccb9 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -77,7 +77,6 @@ tags: - DarkCrystal RAT - Sandworm Tools - Living Off The Land - - Nexus APT Threat Activity - AsyncRAT - Scheduled Tasks - AgentTesla diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 25f610fcba..f4e90ec9b2 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -78,7 +78,6 @@ tags: - Qakbot - Derusbi - Living Off The Land - - Nexus APT Threat Activity - Earth Estries - Suspicious Regsvr32 Activity asset_type: Endpoint diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index a6d87b4074..2f4d734922 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -74,7 +74,6 @@ tags: - CISA AA23-347A - Windows Persistence Techniques - Living Off The Land - - Nexus APT Threat Activity - Azorult - Ryuk Ransomware - Scheduled Tasks diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml index 7b2fcb5e62..cfda3ba9cf 100644 --- a/detections/endpoint/windows_archive_collected_data_via_rar.yml +++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml @@ -64,7 +64,6 @@ tags: - DarkGate Malware - China-Nexus Threat Activity - Earth Estries - - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1560.001 diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index fd9cf96237..61810fbdd1 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,7 +1,7 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: '7' -date: '2025-02-07' +version: '8' +date: '2025-02-24' author: Teoderick Contreras, Bhavin Patel Splunk data_source: - Windows Event Log Security 4663 @@ -66,7 +66,7 @@ tags: - Snake Keylogger - Meduza Stealer - PXA Stealer - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index e38b89ded7..aa27afdfc7 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -73,7 +73,6 @@ tags: - Ingress Tool Transfer - China-Nexus Threat Activity - IcedID - - Nexus APT Threat Activity - Forest Blizzard - Earth Estries - Compromised Windows Host diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index fc49bd7b92..3d1e836554 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -65,7 +65,6 @@ tags: - Chaos Ransomware - Derusbi - PlugX - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index d87ac0bdb8..f61bc5b52d 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,7 +1,7 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: 12 -date: '2025-02-10' +version: 13 +date: '2025-02-24' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -62,7 +62,7 @@ tags: - Crypto Stealer - Active Directory Lateral Movement - Derusbi - - Nexus APT Threat Activity + - China-Nexus Threat Activity - Snake Malware - Clop Ransomware - Earth Estries diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 7034140a74..579b67e6d4 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -55,7 +55,6 @@ tags: - NjRAT - China-Nexus Threat Activity - Derusbi - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 9f9217f4bd..eb98f737e4 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -60,7 +60,6 @@ tags: - Compromised Windows Host - Ransomware - Windows Persistence Techniques - - Nexus APT Threat Activity - Ryuk Ransomware - Scheduled Tasks - Earth Estries diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index 0e1657e876..082b43da4b 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -69,7 +69,6 @@ tags: - Command And Control - China-Nexus Threat Activity - Backdoor Pingpong - - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1095 From 6fd0a468088000878c7c0da9d7a07915086a58ab Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Mon, 24 Feb 2025 12:15:57 +0100 Subject: [PATCH 36/48] headless_bee --- .../linux_auditd_possible_access_to_credential_files.yml | 1 - .../endpoint/linux_auditd_possible_access_to_sudoers_file.yml | 1 - .../endpoint/linux_possible_access_to_credential_files.yml | 1 - detections/endpoint/windows_unsigned_ms_dll_side_loading.yml | 1 - .../winevent_scheduled_task_created_within_public_path.yml | 1 - 5 files changed, 5 deletions(-) diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index c18a158fab..06d677037f 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -63,7 +63,6 @@ tags: - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 100f27d690..d1fc778c68 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -60,7 +60,6 @@ tags: - Linux Persistence Techniques - Linux Privilege Escalation - Compromised Linux Host - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index b9c427b519..14a2fe0df1 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -61,7 +61,6 @@ tags: - Linux Persistence Techniques - XorDDos - Linux Privilege Escalation - - Nexus APT Threat Activity - Earth Estries asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index bf38badfc3..621a904a38 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -66,7 +66,6 @@ tags: analytic_story: - China-Nexus Threat Activity - Derusbi - - Nexus APT Threat Activity - APT29 Diplomatic Deceptions with WINELOADER - Earth Estries group: diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 756ab1465d..f464f02690 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -59,7 +59,6 @@ tags: - CISA AA22-257A - Compromised Windows Host - Ransomware - - Nexus APT Threat Activity - Active Directory Lateral Movement - CISA AA23-347A - Windows Persistence Techniques From 10d1435990c162c230cac85bbca110ec6a0ac6d5 Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Tue, 25 Feb 2025 22:04:49 +0000 Subject: [PATCH 37/48] Update detection name --- ...created.yml => o365_bec_email_hiding_rule_created.yml} | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) rename detections/cloud/{o365_suspicious_mailbox_rule_created.yml => o365_bec_email_hiding_rule_created.yml} (86%) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml similarity index 86% rename from detections/cloud/o365_suspicious_mailbox_rule_created.yml rename to detections/cloud/o365_bec_email_hiding_rule_created.yml index 925030c0b1..54dffb8b87 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -1,11 +1,11 @@ -name: O365 Suspicious Mailbox Rule Created +name: O365 BEC Email Hiding Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 version: 1 date: '2025-02-14' author: '0xC0FFEEEE, Github Community' type: TTP status: production -description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. +description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account. search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* as * | eval temp=mvzip(Name,Value, "") | fields - Name Value | mvexpand temp @@ -15,7 +15,7 @@ search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1, 0) | eval read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score - | where suspicious_score>2 | `o365_suspicious_mailbox_rule_created_filter`' + | where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. @@ -33,7 +33,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A suspicious mailbox rule was created by $user$ + message: Potential BEC mailbox rule was created by $user$ risk_objects: - field: user type: user From 95863b4ca1e2ea9dbb5b5794ad0e9d12e047b300 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Wed, 26 Feb 2025 09:37:07 +0100 Subject: [PATCH 38/48] headless_bee --- .../deprecated/nexus_apt_threat_activity.yml | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 stories/deprecated/nexus_apt_threat_activity.yml diff --git a/stories/deprecated/nexus_apt_threat_activity.yml b/stories/deprecated/nexus_apt_threat_activity.yml new file mode 100644 index 0000000000..bd6aed1350 --- /dev/null +++ b/stories/deprecated/nexus_apt_threat_activity.yml @@ -0,0 +1,21 @@ +name: Nexus APT Threat Activity +id: 43f8062d-4da0-4f48-8cad-6a20e108961b +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, an advanced persistent threat (APT) group known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. +narrative: Chinese state-nexus threat actors are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. +references: +- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/ +- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink +- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf +- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From c4446dace091bbe444ef3184677a0d22badd5f38 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Wed, 26 Feb 2025 09:39:40 +0100 Subject: [PATCH 39/48] headless_bee --- stories/china_nexus_threat_activity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/china_nexus_threat_activity.yml b/stories/china_nexus_threat_activity.yml index 740f595dde..0ec9d0e5e3 100644 --- a/stories/china_nexus_threat_activity.yml +++ b/stories/china_nexus_threat_activity.yml @@ -1,5 +1,5 @@ name: China-Nexus Threat Activity -id: 43f8062d-4da0-4f48-8cad-6a20e108961b +id: 8d15cd0b-0e23-45b1-bb8d-397817b06cc5 version: 2 date: '2025-02-24' author: Teoderick Contreras, Splunk From 90b0ee1fb66b0e44a452b89b5685c0ab77d8e1a9 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Wed, 26 Feb 2025 09:44:49 +0100 Subject: [PATCH 40/48] headless_bee --- .../windows_service_creation_using_registry_entry.yml | 4 ++-- ...windows_unsigned_dll_side_loading_in_same_process_path.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index fb96ae4e10..e3acea777d 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: '12' -date: '2025-02-07' +version: '13' +date: '2025-02-26' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index b49c48ff8a..70f996521b 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 7 -date: '2025-02-11' +version: 8 +date: '2025-02-26' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 From 9d23cc4bf0189f0130da335e2d4ead6d14899659 Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Thu, 27 Feb 2025 07:35:08 +0000 Subject: [PATCH 41/48] simplify SPL & add threat object --- .../cloud/o365_bec_email_hiding_rule_created.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index 54dffb8b87..fdd0710400 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -7,13 +7,11 @@ type: TTP status: production description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account. -search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* - as * | eval temp=mvzip(Name,Value, "") | fields - Name Value | mvexpand temp - | eval temp_name=mvindex(split(temp,""),0), temp_value=mvindex(split(temp,""),1) - | eval {temp_name}=temp_value | stats values(Name) as Name, values(MarkAsRead) as - MarkAsRead, values(MoveToFolder) as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name - | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1, - 0) | eval read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, +search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | + stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder) + as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name | eval + entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval + read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score | where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest @@ -38,7 +36,9 @@ rba: - field: user type: user score: 25 - threat_objects: [] + threat_objects: + - field: Name + type: signature tags: analytic_story: - Office 365 Account Takeover From 219763b3ebb59ac9d53472f2d2ad1977650c7d1a Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Thu, 27 Feb 2025 10:38:22 +0100 Subject: [PATCH 42/48] headless_bee --- stories/china_nexus_threat_activity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/china_nexus_threat_activity.yml b/stories/china_nexus_threat_activity.yml index 0ec9d0e5e3..8e6f22041b 100644 --- a/stories/china_nexus_threat_activity.yml +++ b/stories/china_nexus_threat_activity.yml @@ -5,7 +5,7 @@ date: '2025-02-24' author: Teoderick Contreras, Splunk status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, Chinese state-nexus adversaries known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. -narrative: Chinese state-nexus threat group are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. +narrative: As described by Crowdstrike, Chinese state-nexus threat group or adversary are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. references: - https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/ - https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink From d5feba1042182ad2a34a6c4a91ad19a834f1a9fb Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 11 Mar 2025 13:22:04 -0700 Subject: [PATCH 43/48] drilldown update- minor --- detections/cloud/o365_bec_email_hiding_rule_created.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index fdd0710400..51e7cd1c9a 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -22,8 +22,8 @@ known_false_positives: Short rule names may trigger false positives. Adjust references: - https://attack.mitre.org/techniques/T1564/008/ drilldown_searches: -- name: View the detection results - search: '%original_detection_search%' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search dest = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for $user$ From 8295f6139b569140edc77ea4fc1b6e09469768d8 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 11 Mar 2025 22:56:06 -0400 Subject: [PATCH 44/48] Add files via upload --- data_sources/windows_event_log_security_4700.yml | 16 ++++++++++++++++ data_sources/windows_event_log_security_4702.yml | 16 ++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 data_sources/windows_event_log_security_4700.yml create mode 100644 data_sources/windows_event_log_security_4702.yml diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml new file mode 100644 index 0000000000..39bc4c1033 --- /dev/null +++ b/data_sources/windows_event_log_security_4700.yml @@ -0,0 +1,16 @@ +name: Windows Event Log Security 4700 +id: 22184889-0f07-46b9-b25f-8a55a9ad63 +version: 1 +date: '2025-03-11' +author: Steven Dick +description: Data source object for Windows Event Log Security 4700 +source: XmlWinEventLog:Security +sourcetype: xmlwineventlog +separator: EventID +supported_TA: +- name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 9.0.1 +fields: +- EventID +example_log: ' 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe ' diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml new file mode 100644 index 0000000000..b6056ee988 --- /dev/null +++ b/data_sources/windows_event_log_security_4702.yml @@ -0,0 +1,16 @@ +name: Windows Event Log Security 4702 +id: 167e378e-3675-4042-b611-d3bfb6d2abc7 +version: 1 +date: '2025-03-11' +author: Steven Dick +description: Data source object for Windows Event Log Security 4702 +source: XmlWinEventLog:Security +sourcetype: xmlwineventlog +separator: EventID +supported_TA: +- name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 9.0.1 +fields: +- EventID +example_log: ' 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe ' From 5060b8cefdb87f93f72b12a6f5d2968a4dc4278f Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 11 Mar 2025 22:59:08 -0400 Subject: [PATCH 45/48] Update windows_event_log_security_4700.yml --- data_sources/windows_event_log_security_4700.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 39bc4c1033..56b76ecfdf 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -1,5 +1,5 @@ name: Windows Event Log Security 4700 -id: 22184889-0f07-46b9-b25f-8a55a9ad63 +id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde version: 1 date: '2025-03-11' author: Steven Dick From 5df06bdbcf9342cf4fdb37ded0631bfec43f9f83 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 12 Mar 2025 16:21:38 -0700 Subject: [PATCH 46/48] remove programdata from path Co-authored-by: Nasreddine Bencherchali --- detections/endpoint/windows_suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index f2862efdbb..f9a483cc09 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -20,7 +20,7 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*", "*\\programdata\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) + where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` From 603fe5324840660351d9c816d79695bac79ad046 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Thu, 13 Mar 2025 10:12:03 +0100 Subject: [PATCH 47/48] headless_bee --- ...ndows_process_file_path_in_programdata.yml | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 detections/endpoint/windows_process_file_path_in_programdata.yml diff --git a/detections/endpoint/windows_process_file_path_in_programdata.yml b/detections/endpoint/windows_process_file_path_in_programdata.yml new file mode 100644 index 0000000000..1331c111a8 --- /dev/null +++ b/detections/endpoint/windows_process_file_path_in_programdata.yml @@ -0,0 +1,77 @@ +name: Windows Process File Path in ProgramData +id: 237016fa-d8e6-47b4-80f9-70c4d42c72c0 +version: 1 +date: '2025-03-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies processes running from file paths within the ProgramData directory, a common location abused by adversaries for executing malicious code while evading detection. Threat actors often drop and execute payloads from this directory to bypass security controls, as it typically has write permissions for standard users. While this behavior can indicate malware execution or persistence techniques, it is important to note that some legitimate software, installers, and update mechanisms also run from ProgramData, leading to potential false positives. Security teams should validate detections by correlating with other indicators, such as unusual parent processes, unsigned binaries, or anomalous network activity. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes + where Processes.process_path = "*:\\programdata\\*" + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_file_path_in_programdata_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators may allow execution of specific binaries in + non-standard paths. Filter as needed. +references: +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious process $process_name$ running from a process path- + $process_path$ on host- $dest$ + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: + - field: parent_process_name + type: parent_process_name +tags: + analytic_story: + - China-Nexus Threat Activity + - Earth Estries + - SnappyBee + asset_type: Endpoint + mitre_attack_id: + - T1036.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.005/process_in_programdata/exec_programdata.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog From e21fe10f8358d25f05be2a4348de3b3aff7578db Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 13 Mar 2025 14:20:17 +0100 Subject: [PATCH 48/48] Update and rename windows_process_file_path_in_programdata.yml to windows_process_execution_from_programdata.yml --- ...a.yml => windows_process_execution_from_programdata.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename detections/endpoint/{windows_process_file_path_in_programdata.yml => windows_process_execution_from_programdata.yml} (96%) diff --git a/detections/endpoint/windows_process_file_path_in_programdata.yml b/detections/endpoint/windows_process_execution_from_programdata.yml similarity index 96% rename from detections/endpoint/windows_process_file_path_in_programdata.yml rename to detections/endpoint/windows_process_execution_from_programdata.yml index 1331c111a8..075bd21a58 100644 --- a/detections/endpoint/windows_process_file_path_in_programdata.yml +++ b/detections/endpoint/windows_process_execution_from_programdata.yml @@ -1,4 +1,4 @@ -name: Windows Process File Path in ProgramData +name: Windows Process Execution From ProgramData id: 237016fa-d8e6-47b4-80f9-70c4d42c72c0 version: 1 date: '2025-03-13' @@ -13,12 +13,12 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_path = "*:\\programdata\\*" + where Processes.process_path = "*:\\ProgramData\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_process_file_path_in_programdata_filter`' + | `windows_process_execution_from_programdata_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search,