silver sparrow

detections/endpoint/suspicious_plistbuddy_usage.yml

@@ -0,0 +1,48 @@
+name: Suspicious PlistBuddy Usage
+id: c3194009-e0eb-4f84-87a9-4070f8688f00
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow,
+  the following commands were executed:
+ 
+  
+  1. PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist\
+
+  1. PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist\
+  
+  Upon triage, capture the .plist file being written to disk and review for further indicators. Contain the endpoint and triage further.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  In addition, OSQuery must be installed and configured to pick up process events (info
+  at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
+type: batch
+datamodel: []
+references:
+- https://redcanary.com/blog/clipping-silver-sparrows-wings/
+- https://marcosantadev.com/manage-plist-files-plistbuddy/
+author: Michael Haag, Splunk
+search: ' |  `suspicious_plistbuddy_usage_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+tags:
+  analytic_story:
+  - Silver Sparrow
+  mitre_attack_id:
+  - T1543.001
+  kill_chain_phases:
+  - Actions on Objectives
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.001/atomic-red-team/windows-sysmon.log

stories/silver_sparrow.yml

@@ -18,7 +18,26 @@ narrative: 'Silver Sparrow works is a dropper and uses typical persistence mecha
   1. Identify the process name sqlite3 executing with a command line argument of: LSQuarantine (1)\
 
   1. Monitor for the process curl executing with command line arguments or network connections to s3.amazonaws.com. (1)
-  Multiple macOS malware families utilize this method to download from S3 buckets for distribution.'
+  Multiple macOS malware families utilize this method to download from S3 buckets for distribution.
+  
+  If suspected Silver Sparrow, determine if the following known files reside on disk and perform containment as needed:\
+  
+  * ~/Library/Application Support/agent_updater/agent.sh (v1 script that executes every hour)\
+
+  * ~/Library/Launchagents/agent.plist (v1 persistence mechanism)\
+
+  * ~/Library/Launchagents/init_agent.plist (v1 persistence mechanism)\
+
+  * ~/Library/Application Support/verx_updater/verx.sh (v2 script that executes every hour)\
+
+  * /tmp/verx (file containing final v2 payload if distributed)\
+
+  * ~/Library/Launchagents/verx.plist (v2 persistence mechanism)\
+
+  * ~/Library/Launchagents/init_verx.plist\
+  
+  Additional indicators and behaviors with the references.'
+
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
 - https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/