Branch was auto-updated.

detections/endpoint/bits_job_persistence.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - BITS Jobs
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/bitsadmin_download_file.yml

@@ -41,6 +41,7 @@ tags:
   - Ingress Tool Transfer
   - BITS Jobs
   - DarkSide Ransomware
+  - Living Off The Land
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Ingress Tool Transfer
   - DarkSide Ransomware
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Ingress Tool Transfer
   - DarkSide Ransomware
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -25,6 +25,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Cloud Federated Credential Abuse
+  - Living Off The Land
   asset_type: Endpoint
   confidence: 70
   context:

detections/endpoint/certutil_with_decode_argument.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Deobfuscate-Decode Files or Information
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -34,6 +34,7 @@ tags:
   - Log4Shell CVE-2021-44228
   - WhisperGate
   - Hermetic Wiper
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/control_loading_from_world_writable_directory.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_html_help_renamed.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -40,6 +40,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -42,6 +42,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_mshta_renamed.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_regasm_spawning_a_process.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_regasm_with_network_connection.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_regsvcs_with_network_connection.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_regsvr32_application_control_bypass.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
   - Cobalt Strike
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/detect_rundll32_inline_hta_execution.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Suspicious MSHTA Activity
   - NOBELIUM Group
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/disable_schedule_task.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -26,6 +26,7 @@ tags:
   - Credential Dumping
   - Suspicious Rundll32 Activity
   - HAFNIUM Group
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/esentutl_sam_copy.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml

@@ -41,6 +41,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Living Off The Land
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Trickbot
   - IcedID
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/ntdsutil_export_ntds.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Windows Service Abuse
   - Windows Persistence Techniques
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml

@@ -33,6 +33,7 @@ tags:
   - Suspicious Regsvr32 Activity
   - Remcos
   - Hermetic Wiper
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml

@@ -35,6 +35,7 @@ tags:
   - IcedID
   - Suspicious Regsvr32 Activity
   - Remcos
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/remote_wmi_command_attempt.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Suspicious WMI Use
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/rundll32_control_rundll_hunt.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  - Living Off The Land
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/rundll32_control_rundll_world_writable_directory.yml

@@ -39,6 +39,7 @@ tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/rundll32_create_remote_thread_to_a_process.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/rundll32_createremotethread_in_browser.yml

@@ -25,6 +25,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/rundll32_dnsquery.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/rundll32_process_creating_exe_dll_files.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/rundll32_shimcache_flush.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Unusual Processes
+  - Living Off The Land
   confidence: 100
   context:
   - Stage:Execution

detections/endpoint/rundll_loading_dll_by_ordinal.yml

@@ -33,6 +33,7 @@ tags:
   analytic_story:
   - Unusual Processes
   - Suspicious Rundll32 Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/schedule_task_with_http_command_arguments.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Windows Persistence Techniques
+  - Living Off The Land
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/schedule_task_with_rundll32_command_trigger.yml

@@ -36,6 +36,7 @@ tags:
   - Windows Persistence Techniques
   - Trickbot
   - IcedID
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Living Off The Land
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -30,6 +30,7 @@ tags:
   - DHS Report TA18-074A
   - NOBELIUM Group
   - Windows Persistence Techniques
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Living Off The Land
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Active Directory Lateral Movement
   - NOBELIUM Group
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/services_exe_lolbas_execution_process_spawn.yml

@@ -41,6 +41,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Living Off The Land
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/suspicious_icedid_rundll32_cmdline.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Living Off The Land
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml

@@ -33,6 +33,7 @@ tags:
   - Trusted Developer Utilities Proxy Execution
   - Cobalt Strike
   - Masquerading - Rename System Utilities
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_msbuild_path.yml

@@ -34,6 +34,7 @@ tags:
   - Trusted Developer Utilities Proxy Execution MSBuild
   - Cobalt Strike
   - Masquerading - Rename System Utilities
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_msbuild_rename.yml

@@ -32,6 +32,7 @@ tags:
   - Trusted Developer Utilities Proxy Execution MSBuild
   - Cobalt Strike
   - Masquerading - Rename System Utilities
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_msbuild_spawn.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_mshta_child_process.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_mshta_spawn.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
   - Iceid
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_rundll32_dllregisterserver.yml

@@ -38,6 +38,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
+  - Living Off The Land
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_scheduled_task_from_public_directory.yml

@@ -31,6 +31,7 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - Windows Persistence Techniques
+  - Living Off The Land
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml

@@ -40,6 +40,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Living Off The Land
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/windows_installutil_in_non_standard_path.yml

@@ -37,6 +37,7 @@ tags:
   - Ransomware
   - Signed Binary Proxy Execution InstallUtil
   - WhisperGate
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/windows_installutil_remote_network_connection.yml

@@ -1,7 +1,7 @@
 name: Windows InstallUtil Remote Network Connection
 id: 4fbf9270-43da-11ec-9486-acde48001122
-version: 1
-date: '2021-11-12'
+version: 2
+date: '2022-03-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -21,14 +21,14 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_installutil` by _time span=1h  Processes.process_guid Processes.process_name
+  where `process_installutil` by _time span=1h  Processes.process_id Processes.process_name
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | join  process_guid [ | tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid
-  Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
-  | table _time dest parent_process_name process_name process_path process process_guid
-  connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`'
+  | `security_content_ctime(lastTime)` | join  process_id [| tstats `security_content_summariesonly`
+  count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
+  All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
+  | table _time dest parent_process_name process_name process_path process process_id dest_port C2 
+  | `windows_installutil_remote_network_connection_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
@@ -42,6 +42,7 @@ references:
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/windows_installutil_uninstall_option.yml

@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/windows_installutil_uninstall_option_with_network.yml

@@ -1,7 +1,7 @@
 name: Windows InstallUtil Uninstall Option with Network
 id: 1a52c836-43ef-11ec-a36c-acde48001122
-version: 1
-date: '2021-11-12'
+version: 2
+date: '2022-03-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -26,13 +26,12 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
   processes. Capture any artifacts and review further.'
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
-  span=1h  Processes.process_guid Processes.process_name Processes.dest Processes.process_path
+  span=1h  Processes.process_id Processes.process_name Processes.dest Processes.process_path
   Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_guid
-  [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
-  where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
-  | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
-  original_file_name process_path process process_guid connection_to_CNC dest_port
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_id [| tstats `security_content_summariesonly`
+  count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
+  All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
+  | table _time dest parent_process_name process_name process_path process process_id dest_port C2
   | `windows_installutil_uninstall_option_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -49,6 +48,7 @@ references:
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/windows_installutil_url_in_command_line.yml

@@ -40,6 +40,7 @@ references:
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
+  - Living Off The Land
   confidence: 100
   context:
   - Source:Endpoint

stories/living_off_the_land.yml

@@ -1,10 +1,10 @@
 name: Living Off The Land
 id: 6f7982e2-900b-11ec-a54a-acde48001122
-version: 1
-date: '2022-02-17'
+version: 2
+date: '2022-03-16'
 author: Lou Stella, Splunk
-description: Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment. 
-narrative: Living Off The Land refers to an attacker methodology of using software already installed on their target host to achieve their goals. Many utilities that ship with Windows can be used to achieve various goals, with reduced chances of detection by an antivirus software.
+description: Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. 
+narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
 references:
 - https://lolbas-project.github.io/
 tags: