Merge pull request #2336 from splunk/hijack

HijackThis

detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml

@@ -1,18 +1,18 @@
 name: Linux Persistence and Privilege Escalation Risk Behavior
 id: ad5ac21b-3b1e-492c-8e19-ea5d5e8e5cf1
-version: 1
-date: '2022-07-20'
+version: 2
+date: '2022-08-26'
 author: Michael Haag, Splunk
 type: Correlation
 datamodel:
 - Risk
 description: The following correlation is specific to Linux persistence and privilege escalation tactics and is tied to two analytic stories and any Linux analytic tied to persistence and privilege escalation.
   These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where (All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques") OR source = "*Linux*") All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source All_Risk.description
+search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where (All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques") OR source = "*Linux*") All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source 
   | `drop_dm_object_name(All_Risk)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
-  | stats values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object 
+  | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type
   | where distinct_detection_name >= 4
   | `linux_persistence_and_privilege_escalation_risk_behavior_filter`'
 how_to_implement: Ensure Linux anomaly and TTP analytics are enabled. TTP may be set to Notables for point detections, anomaly should not be notables but risk generators. The correlation relies on more than x amount of distict detection names generated before generating a notable. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment.

detections/endpoint/living_off_the_land.yml

@@ -1,18 +1,18 @@
 name: Living Off The Land
 id: 1be30d80-3a39-4df9-9102-64a467b24abc
-version: 1
-date: '2022-07-08'
+version: 2
+date: '2022-08-19'
 author: Michael Haag, Splunk
 type: Correlation
 datamodel:
   - Risk
 description: The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source 
+search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source 
   | `drop_dm_object_name(All_Risk)` 
+  | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type
+  | where source_count >= 5
   | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | stats  values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object
-  | where distinct_detection_name >= 2
+  | `security_content_ctime(lastTime)`
   | `living_off_the_land_filter`'
 how_to_implement: To implement this correlation search a user needs to enable all
   detections in the Living Off The Land Analytic Story and confirm it is generating risk events.

detections/endpoint/log4shell_cve_2021_44228_exploitation.yml

@@ -1,7 +1,7 @@
 name: Log4Shell CVE-2021-44228 Exploitation
 id: 9be30d80-3a39-4df9-9102-64a467b24eac
-version: 1
-date: '2022-01-26'
+version: 2
+date: '2022-08-26'
 author: Jose Hernandez, Splunk
 type: Correlation
 datamodel:
@@ -21,14 +21,10 @@ description: This correlation find exploitation of Log4Shell CVE-2021-44228 agai
   search finds exploitation. If we get a notable from this correlation search the
   best way to triage it is by investigating the affected systems against Log4Shell
   exploitation using Splunk SOAR playbooks.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell
-  CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic
-  source | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | stats values(risk_object) as affected_systems  values(source)
-  as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime)
-  as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic)
-  as distinct_tactics | where distinct_tactics >= 2 | `log4shell_cve_2021_44228_exploitation_filter`'
+search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source 
+  | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type | where distinct_tactics >= 2 
+  | `log4shell_cve_2021_44228_exploitation_filter`'
 how_to_implement: To implement this correlation search a user needs to enable all
   detections in the Log4Shell Analytic Story and confirm it is generation risk events.
   A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain

detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml

@@ -0,0 +1,62 @@
+name: Windows Autostart Execution LSASS Driver Registry Modification
+id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a
+version: 1
+date: '2022-08-22'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the abuse of two undocumented registry keys that allow for a DLL to load into lsass.exe to potentially capture credentials. Upon successful modification of \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt or \CurrentControlSet\Services\NTDS\LsaDbExtPt, a DLL either remote or local will be set as the value and load up into lsass.exe. Based on POC code a text file may be written to disk with credentials.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path IN ("*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt","*\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt") 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest Registry.process_guid
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_autostart_execution_lsass_driver_registry_modification_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present on recent Windows Operating Systems. Filtering may be required based on process_name. In addition, look for non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by adding Endpoint.processes process_name to query to identify the process making the modification.
+references:
+  - https://blog.xpnsec.com/exploring-mimikatz-part-1/
+  - https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib
+tags:
+  analytic_story:
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
+  mitre_attack_id:
+  - T1547.008
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_dll_search_order_hijacking_hunt.yml

@@ -0,0 +1,80 @@
+name: Windows DLL Search Order Hijacking Hunt
+id: 79c7d0fc-60c7-41be-a616-ccda752efe89
+version: 1
+date: '2022-08-18'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic is an experimental query built against a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) which maps the module load (ImageLoaded) to process_name. 
+  This analytic will deprecate once this is fixed.
+  This hunting analytic identifies known libraries in Windows that may be used in a DLL search order hijack or DLL Sideloading setting. This may require recompiling the DLL, moving the DLL or moving the vulnerable process. The query looks for any running out of system32 or syswow64. Some libraries natively run out of other application paths and will need to be added to the exclusion as needed.
+  The lookup is comprised of Microsoft native libraries identified within the Hijacklibs.net project. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime values(Processes.process_name) as process_name from datamodel=Endpoint.Processes where Processes.dest!=unknown
+  Processes.user!=unknown NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*"))  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process_path   
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Processes)` 
+  | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary = True
+  | rename parent_process_name as "Process Name" process_name AS ImageLoaded process_path AS Module_Path
+  | `windows_dll_search_order_hijacking_hunt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. This may only with with Sysmon data and the Sysmon TA. Your mileage may vary.
+known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed.
+references:
+  - https://hijacklibs.net
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform DLL search order hijacking.
+  mitre_attack_id:
+  - T1574.001
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process_name
+  - Processes.process_name 
+  - Processes.process_path   
+  risk_score: 1
+  security_domain: endpoint

detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml

@@ -0,0 +1,70 @@
+name: Windows DLL Search Order Hijacking Hunt with Sysmon
+id: 79c7d1fc-64c7-91be-a616-ccda752efe81
+version: 1
+date: '2022-08-18'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic is an experimental query built against a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) which maps the module load (ImageLoaded) to process_name. 
+  This analytic will deprecate once this is fixed.
+  This hunting analytic identifies known libraries in Windows that may be used in a DLL search order hijack or DLL Sideloading setting. This may require recompiling the DLL, moving the DLL or moving the vulnerable process. The query looks for any running out of system32 or syswow64. Some libraries natively run out of other application paths and will need to be added to the exclusion as needed.
+  The lookup is comprised of Microsoft native libraries identified within the Hijacklibs.net project. 
+search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*")) 
+  | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary = True | rename Computer as dest process_name AS ImageLoaded process_path AS Module_Path
+  | stats values(parent_process_name) count by _time dest ImageLoaded Module_Path
+  | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed.
+references:
+  - https://hijacklibs.net
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+  impact: 10
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ loading $process_name$ was identified on endpoint $dest$.
+  mitre_attack_id:
+  - T1574.001
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - dest 
+  - ImageLoaded
+  - Module_Path  
+  risk_score: 1
+  security_domain: endpoint

detections/endpoint/windows_possible_credential_dumping.yml

@@ -1,7 +1,7 @@
 name: Windows Possible Credential Dumping
 id: e4723b92-7266-11ec-af45-acde48001122
-version: 2
-date: '2022-01-27'
+version: 3
+date: '2022-08-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -23,12 +23,8 @@ description: 'The following analytic is an enhanced version of two previous anal
   The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
   For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory,
   used to execute this module which is related to lsass dumping.'
-search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000",
-  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438",
-  "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess,
-  SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest |
-  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`'
+search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, Computer, SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  | `windows_possible_credential_dumping_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -42,6 +38,7 @@ references:
 - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
 - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
+- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1
 tags:
   analytic_story:
   - Credential Dumping

detections/endpoint/windows_remote_access_software_hunt.yml

@@ -0,0 +1,72 @@
+name: Windows Remote Access Software Hunt
+id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a
+version: 1
+date: '2022-08-22'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic is meant to help organizations understand what remote access software is being used in the environment. When reviewing this hunt, confirm the software identified is authorized to be utilized. Based on fidelity, create a new analytic for specific utilities banned within the organization.
+  Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` 
+  | lookup remote_access_software remote_utility AS process_name OUTPUT isutility 
+  | search isutility = True 
+  | `windows_remote_access_software_hunt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be found. Filter as needed and create higher fidelity analytics based off banned remote access software.
+references:
+  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command and Control
+  - Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 10
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
+  impact: 10
+  kill_chain_phases:
+  - Command & Control
+  message: The following Remote Access Software $process_name$ was identified on $dest$.
+  mitre_attack_id:
+  - T1219
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 1
+  security_domain: endpoint

lookups/hijacklibs.csv

@@ -0,0 +1,403 @@
+library,islibrary
+outllib.dll,TRUE
+iviewers.dll,TRUE
+hha.dll,TRUE
+aclui.dll,TRUE
+xwtpw32.dll,TRUE
+xwizards.dll,TRUE
+xpsservices.dll,TRUE
+xolehlp.dll,TRUE
+xmllite.dll,TRUE
+wwapi.dll,TRUE
+wwancfg.dll,TRUE
+wtsapi32.dll,TRUE
+wsmsvc.dll,TRUE
+wshelper.dll,TRUE
+wshbth.dll,TRUE
+wscapi.dll,TRUE
+wpdshext.dll,TRUE
+wofutil.dll,TRUE
+wmsgapi.dll,TRUE
+wmpdui.dll,TRUE
+wmiutils.dll,TRUE
+wmidcom.dll,TRUE
+wmiclnt.dll,TRUE
+wlidprov.dll,TRUE
+wldp.dll,TRUE
+wlbsctrl.dll,TRUE
+wlancfg.dll,TRUE
+wlanapi.dll,TRUE
+wkscli.dll,TRUE
+winsync.dll,TRUE
+winsta.dll,TRUE
+winsqlite3.dll,TRUE
+winscard.dll,TRUE
+winrnr.dll,TRUE
+winnsi.dll,TRUE
+winmm.dll,TRUE
+winmde.dll,TRUE
+winipsec.dll,TRUE
+wininet.dll,TRUE
+winhttp.dll,TRUE
+windowsudk.shellcommon.dll,TRUE
+windowsperformancerecordercontrol.dll,TRUE
+windowscodecsext.dll,TRUE
+windowscodecs.dll,TRUE
+windows.ui.immersive.dll,TRUE
+windows.storage.search.dll,TRUE
+windows.storage.dll,TRUE
+winbrand.dll,TRUE
+winbio.dll,TRUE
+wimgapi.dll,TRUE
+whhelper.dll,TRUE
+wevtapi.dll,TRUE
+wer.dll,TRUE
+wecapi.dll,TRUE
+webservices.dll,TRUE
+wdscore.dll,TRUE
+wdi.dll,TRUE
+wcnnetsh.dll,TRUE
+wcmapi.dll,TRUE
+wbemsvc.dll,TRUE
+wbemprox.dll,TRUE
+vsstrace.dll,TRUE
+vssapi.dll,TRUE
+virtdisk.dll,TRUE
+version.dll,TRUE
+vdsutil.dll,TRUE
+vaultcli.dll,TRUE
+uxtheme.dll,TRUE
+uxinit.dll,TRUE
+utildll.dll,TRUE
+userenv.dll,TRUE
+urlmon.dll,TRUE
+upshared.dll,TRUE
+updatepolicy.dll,TRUE
+unattend.dll,TRUE
+umpdc.dll,TRUE
+uiribbon.dll,TRUE
+uireng.dll,TRUE
+uiautomationcore.dll,TRUE
+uianimation.dll,TRUE
+twinui.appcore.dll,TRUE
+twinapi.dll,TRUE
+twext.dll,TRUE
+ttdrecord.dll,TRUE
+tsworkspace.dll,TRUE
+tquery.dll,TRUE
+tpmcoreprovisioning.dll,TRUE
+timesync.dll,TRUE
+tdh.dll,TRUE
+tbs.dll,TRUE
+tapi32.dll,TRUE
+systemsettingsthresholdadminflowui.dll,TRUE
+sxshared.dll,TRUE
+structuredquery.dll,TRUE
+staterepository.core.dll,TRUE
+ssshim.dll,TRUE
+sspicli.dll,TRUE
+ssp_isv.exe_rsaenh.dll,TRUE
+ssp.exe_rsaenh.dll,TRUE
+srvcli.dll,TRUE
+srpapi.dll,TRUE
+srmtrace.dll,TRUE
+srcore.dll,TRUE
+srclient.dll,TRUE
+sppcext.dll,TRUE
+sppc.dll,TRUE
+spp.dll,TRUE
+spectrumsyncclient.dll,TRUE
+snmpapi.dll,TRUE
+slc.dll,TRUE
+shell32.dll,TRUE
+security.dll,TRUE
+secur32.dll,TRUE
+schedcli.dll,TRUE
+scecli.dll,TRUE
+scansetting.dll,TRUE
+sas.dll,TRUE
+sapi_onecore.dll,TRUE
+samlib.dll,TRUE
+samcli.dll,TRUE
+rtworkq.dll,TRUE
+rtutils.dll,TRUE
+rsaenh.dll,TRUE
+rpcnsh.dll,TRUE
+rmclient.dll,TRUE
+resutils.dll,TRUE
+resetengine.dll,TRUE
+reseteng.dll,TRUE
+regapi.dll,TRUE
+reagent.dll,TRUE
+rasmontr.dll,TRUE
+rasman.dll,TRUE
+rasgcw.dll,TRUE
+rasdlg.dll,TRUE
+rasapi32.dll,TRUE
+radcui.dll,TRUE
+puiapi.dll,TRUE
+prvdmofcomp.dll,TRUE
+proximityservicepal.dll,TRUE
+proximitycommon.dll,TRUE
+propsys.dll,TRUE
+profapi.dll,TRUE
+prntvpt.dll,TRUE
+printui.dll,TRUE
+powrprof.dll,TRUE
+polstore.dll,TRUE
+policymanager.dll,TRUE
+pnrpnsp.dll,TRUE
+playsndsrv.dll,TRUE
+pla.dll,TRUE
+pkeyhelper.dll,TRUE
+peerdistsh.dll,TRUE
+pdh.dll,TRUE
+pcaui.dll,TRUE
+p9np.dll,TRUE
+p2pnetsh.dll,TRUE
+p2p.dll,TRUE
+osuninst.dll,TRUE
+osksupport.dll,TRUE
+osbaseln.dll,TRUE
+opcservices.dll,TRUE
+onex.dll,TRUE
+omadmapi.dll,TRUE
+oleacc.dll,TRUE
+oci.dll,TRUE
+ntshrui.dll,TRUE
+ntmarta.dll,TRUE
+ntlmshared.dll,TRUE
+ntlanman.dll,TRUE
+ntdsapi.dll,TRUE
+nshwfp.dll,TRUE
+nshipsec.dll,TRUE
+nshhttp.dll,TRUE
+npmproxy.dll,TRUE
+nlansp_c.dll,TRUE
+nlaapi.dll,TRUE
+ninput.dll,TRUE
+newdev.dll,TRUE
+networkexplorer.dll,TRUE
+netutils.dll,TRUE
+nettrace.dll,TRUE
+netshell.dll,TRUE
+netsetupapi.dll,TRUE
+netprovfw.dll,TRUE
+netprofm.dll,TRUE
+netplwiz.dll,TRUE
+netjoin.dll,TRUE
+netiohlp.dll,TRUE
+netid.dll,TRUE
+netapi32.dll,TRUE
+ndfapi.dll,TRUE
+ncrypt.dll,TRUE
+napinsp.dll,TRUE
+mtxclu.dll,TRUE
+msxml3.dll,TRUE
+mswsock.dll,TRUE
+mswb7.dll,TRUE
+msvcp110_win.dll,TRUE
+msutb.dll,TRUE
+mstracer.dll,TRUE
+msiso.dll,TRUE
+msi.dll,TRUE
+msftedit.dll,TRUE
+msdtctm.dll,TRUE
+msdrm.dll,TRUE
+msctfmonitor.dll,TRUE
+msctf.dll,TRUE
+mscoree.dll,TRUE
+mscms.dll,TRUE
+msacm32.dll,TRUE
+mrmcorer.dll,TRUE
+mpsvc.dll,TRUE
+mprapi.dll,TRUE
+mpr.dll,TRUE
+mpclient.dll,TRUE
+mobilenetworking.dll,TRUE
+mmdevapi.dll,TRUE
+mlang.dll,TRUE
+miutils.dll,TRUE
+mintdh.dll,TRUE
+midimap.dll,TRUE
+mi.dll,TRUE
+mfplat.dll,TRUE
+mfcore.dll,TRUE
+mfc42u.dll,TRUE
+mdmdiagnostics.dll,TRUE
+mbaexmlparser.dll,TRUE
+mapistub.dll,TRUE
+maintenanceui.dll,TRUE
+magnification.dll,TRUE
+lrwizdll.dll,TRUE
+lpksetupproxyserv.dll,TRUE
+logoncontroller.dll,TRUE
+logoncli.dll,TRUE
+lockhostingframework.dll,TRUE
+loadperf.dll,TRUE
+linkinfo.dll,TRUE
+licensingdiagspp.dll,TRUE
+licensemanagerapi.dll,TRUE
+ktmw32.dll,TRUE
+ksuser.dll,TRUE
+kdstub.dll,TRUE
+joinutil.dll,TRUE
+iumsdk.dll,TRUE
+iumbase.dll,TRUE
+isv.exe_rsaenh.dll,TRUE
+iscsium.dll,TRUE
+iscsidsc.dll,TRUE
+iri.dll,TRUE
+iphlpapi.dll,TRUE
+inproclogger.dll,TRUE
+ifsutil.dll,TRUE
+ifmon.dll,TRUE
+iertutil.dll,TRUE
+iedkcs32.dll,TRUE
+ieadvpack.dll,TRUE
+idstore.dll,TRUE
+icmp.dll,TRUE
+httpapi.dll,TRUE
+hnetmon.dll,TRUE
+hid.dll,TRUE
+gpapi.dll,TRUE
+getuname.dll,TRUE
+fxstiff.dll,TRUE
+fxsst.dll,TRUE
+fxsapi.dll,TRUE
+fwpuclnt.dll,TRUE
+fwpolicyiomgr.dll,TRUE
+fwcfg.dll,TRUE
+fwbase.dll,TRUE
+fvewiz.dll,TRUE
+fveskybackup.dll,TRUE
+fveapi.dll,TRUE
+framedynos.dll,TRUE
+fltlib.dll,TRUE
+flightsettings.dll,TRUE
+firewallapi.dll,TRUE
+fhsvcctl.dll,TRUE
+fhcfg.dll,TRUE
+feclient.dll,TRUE
+fddevquery.dll,TRUE
+faultrep.dll,TRUE
+fastprox.dll,TRUE
+explorerframe.dll,TRUE
+execmodelproxy.dll,TRUE
+esent.dll,TRUE
+efsutil.dll,TRUE
+efsadu.dll,TRUE
+edputil.dll,TRUE
+edgeiso.dll,TRUE
+eappprxy.dll,TRUE
+eappcfg.dll,TRUE
+dynamoapi.dll,TRUE
+dxva2.dll,TRUE
+dxgi.dll,TRUE
+dxcore.dll,TRUE
+dwrite.dll,TRUE
+dwmcore.dll,TRUE
+dwmapi.dll,TRUE
+dusmapi.dll,TRUE
+duser.dll,TRUE
+dui70.dll,TRUE
+dsrole.dll,TRUE
+dsreg.dll,TRUE
+dsprop.dll,TRUE
+dsparse.dll,TRUE
+dsclient.dll,TRUE
+drvstore.dll,TRUE
+drprov.dll,TRUE
+dpx.dll,TRUE
+dot3cfg.dll,TRUE
+dot3api.dll,TRUE
+dnsapi.dll,TRUE
+dmxmlhelputils.dll,TRUE
+dmpushproxy.dll,TRUE
+dmprocessxmlfiltered.dll,TRUE
+dmoleaututils.dll,TRUE
+dmiso8601utils.dll,TRUE
+dmenterprisediagnostics.dll,TRUE
+dmenrollengine.dll,TRUE
+dmcommandlineutils.dll,TRUE
+dmcmnutils.dll,TRUE
+dmcfgutils.dll,TRUE
+dismcore.dll,TRUE
+dismapi.dll,TRUE
+directmanipulation.dll,TRUE
+dhcpcsvc6.dll,TRUE
+dhcpcsvc.dll,TRUE
+dhcpcmonitor.dll,TRUE
+devrtl.dll,TRUE
+devobj.dll,TRUE
+devicepairing.dll,TRUE
+devicecredential.dll,TRUE
+deviceassociation.dll,TRUE
+desktopshellext.dll,TRUE
+defragproxy.dll,TRUE
+dcomp.dll,TRUE
+dcntel.dll,TRUE
+dbghelp.dll,TRUE
+dbgcore.dll,TRUE
+davclnt.dll,TRUE
+dataexchange.dll,TRUE
+d3dcompiler_47.dll,TRUE
+d3d9.dll,TRUE
+d3d12.dll,TRUE
+d3d11.dll,TRUE
+d3d10warp.dll,TRUE
+d3d10core.dll,TRUE
+d3d10_1core.dll,TRUE
+d3d10_1.dll,TRUE
+d3d10.dll,TRUE
+d2d1.dll,TRUE
+cscui.dll,TRUE
+cscobj.dll,TRUE
+cscapi.dll,TRUE
+cryptxml.dll,TRUE
+cryptui.dll,TRUE
+cryptsp.dll,TRUE
+cryptdll.dll,TRUE
+cryptbase.dll,TRUE
+credui.dll,TRUE
+coreuicomponents.dll,TRUE
+coremessaging.dll,TRUE
+coredplus.dll,TRUE
+connect.dll,TRUE
+configmanager2.dll,TRUE
+comdlg32.dll,TRUE
+colorui.dll,TRUE
+coloradapterclient.dll,TRUE
+cmutil.dll,TRUE
+cmpbk32.dll,TRUE
+clusapi.dll,TRUE
+clipc.dll,TRUE
+cldapi.dll,TRUE
+certenroll.dll,TRUE
+certcli.dll,TRUE
+cabview.dll,TRUE
+cabinet.dll,TRUE
+bootux.dll,TRUE
+bootmenuux.dll,TRUE
+bderepair.dll,TRUE
+bcrypt.dll,TRUE
+bcp47mrm.dll,TRUE
+bcp47langs.dll,TRUE
+bcd.dll,TRUE
+batmeter.dll,TRUE
+avrt.dll,TRUE
+authz.dll,TRUE
+authfwcfg.dll,TRUE
+auditpolcore.dll,TRUE
+audioses.dll,TRUE
+atl.dll,TRUE
+archiveint.dll,TRUE
+appxdeploymentclient.dll,TRUE
+appxalluserstore.dll,TRUE
+appvpolicy.dll,TRUE
+applicationframe.dll,TRUE
+apphelp.dll,TRUE
+aepic.dll,TRUE
+adsldpc.dll,TRUE
+activeds.dll,TRUE
+amsi.dll,TRUE

lookups/hijacklibs.yml

@@ -0,0 +1,7 @@
+description: A list of potentially abused libraries in Windows
+filename: hijacklibs.csv
+name: hijacklibs
+default_match: 'false'
+match_type: WILDCARD(library)
+min_matches: 1
+case_sensitive_match: 'false'

lookups/remote_access_software.csv

@@ -0,0 +1,52 @@
+remote_utility, description, isutility
+aweray_remote*.exe,AweRay (AweSun), TRUE
+aa_v*.exe, Ammyy Admin, TRUE
+AeroAdmin.exe, AeroAdmin, TRUE
+anydesk.exe, AnyDesk, TRUE
+AnyViewerSetup.exe, AnyViewer, TRUE
+RCClient.exe, AnyViewer, TRUE
+CService.exe, AnyViewer, TRUE
+atera_agent.exe, Atera, TRUE
+bomgar-scc.exe, BeyondTrust (Bomgar), TRUE
+bomgar-rdp.exe, BeyondTrust (Bomgar), TRUE
+screenconnect.clientservice.exe, ConnectWise Control, TRUE
+screenconnect.windowsclient.exe, ConnectWise Control, TRUE
+dwrcs.exe, Dameware, TRUE
+distant-desktop.exe, Distant Desktop, TRUE
+dwagsvc.exe, DW Service, TRUE
+g2comm.exe, GoToMyPC, TRUE
+g2fileh.exe, GoToMyPC, TRUE
+g2host.exe, GoToMyPC, TRUE
+g2mainh.exe, GoToMyPC, TRUE
+g2printh.exe, GoToMyPC, TRUE
+g2svc.exe, GoToMyPC, TRUE
+g2tray.exe, GoToMyPC, TRUE
+gopcsrv.exe, GoToMyPC, TRUE
+ROMServer.exe, LiteManager, TRUE 
+ROMFUSClient.exe, LiteManager, TRUE
+lmiignition.exe, LogMeIn, TRUE
+lmiguardiansvc.exe, LogMeIn, TRUE
+logmein*.exe, LogMeIn, TRUE
+awrem32.exe, PCAnywhere Client, TRUE
+awhost32.exe, PCAnywhere Server, TRUE
+PCMonitorManager.exe, Pulseway, TRUE
+pcmonitorsrv.exe, Pulseway, TRUE
+radmin3.exe, RAdmin, TRUE
+famitrfc.exe, RAdmin,  TRUE
+rutserv.exe, RemoteUtilities, TRUE
+smpcsetup.exe, ShowMyPC, TRUE
+showmypc*.exe, ShowMyPC, TRUE
+strwinclt.exe, Splashtop, TRUE
+supremo.exe, Supremo, TRUE
+supremohelper.exe, Supremo, TRUE
+supremosystem.exe, Supremo, TRUE
+teamviewer_desktop.exe, TeamViewer Desktop, TRUE
+teamviewer.exe, TeamViewer Service, TRUE
+teamviewer_service.exe, TeamViewer Service, TRUE
+winvnc.exe, VNC, TRUE
+vncviewer.exe, VNC, TRUE
+winvncsc.exe, VNC, TRUE
+winwvc.exe, VNC, TRUE
+Zaservice.exe, Zoho Assist, TRUE
+Zohours.exe, Zoho Assist, TRUE
+ZohoMeeting.exe, Zoho Assist, TRUE

lookups/remote_access_software.yml

@@ -0,0 +1,7 @@
+description: A list of Remote Access Software
+filename: remote_access_software.csv
+name: remote_access_software
+default_match: 'false'
+match_type: WILDCARD(remote_software)
+min_matches: 1
+case_sensitive_match: 'false'

tests/endpoint/windows_autostart_execution_lsass_driver_registry_modification.test.yml

@@ -0,0 +1,13 @@
+name: Windows Autostart Execution LSASS Driver Registry Modification Unit Test
+tests:
+- name: Windows Autostart Execution LSASS Driver Registry Modification
+  file: endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_dll_search_order_hijacking_hunt.test.yml

@@ -0,0 +1,13 @@
+name: Windows DLL Search Order Hijacking Hunt Unit Test
+tests:
+- name: Windows DLL Search Order Hijacking Hunt
+  file: endpoint/windows_dll_search_order_hijacking_hunt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.test.yml

@@ -0,0 +1,13 @@
+name: Windows DLL Search Order Hijacking Hunt with Sysmon Unit Test
+tests:
+- name: Windows DLL Search Order Hijacking Hunt with Sysmon
+  file: endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_remote_access_software_hunt.test.yml

@@ -0,0 +1,13 @@
+name: Windows Remote Access Software Hunt Unit Test
+tests:
+- name: Windows Remote Access Software Hunt
+  file: endpoint/windows_remote_access_software_hunt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true