From af8a47c5c2cfe73511249b6131bc6b186eadf2b7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 15 Mar 2022 14:44:54 -0600 Subject: [PATCH 1/4] Added - Living Off The Land Story Added - Living Off The Land Story --- detections/endpoint/account_discovery_with_net_app.yml | 1 + detections/endpoint/bits_job_persistence.yml | 1 + detections/endpoint/bitsadmin_download_file.yml | 1 + .../certutil_download_with_urlcache_and_split_arguments.yml | 1 + .../certutil_download_with_verifyctl_and_split_arguments.yml | 1 + detections/endpoint/certutil_exe_certificate_extraction.yml | 1 + detections/endpoint/certutil_with_decode_argument.yml | 1 + detections/endpoint/cmd_carry_out_string_command_parameter.yml | 1 + .../endpoint/control_loading_from_world_writable_directory.yml | 1 + .../creation_of_shadow_copy_with_wmic_and_powershell.yml | 1 + detections/endpoint/detect_html_help_renamed.yml | 1 + detections/endpoint/detect_html_help_spawn_child_process.yml | 1 + detections/endpoint/detect_html_help_url_in_command_line.yml | 1 + .../detect_html_help_using_infotech_storage_handlers.yml | 1 + detections/endpoint/detect_mshta_inline_hta_execution.yml | 1 + detections/endpoint/detect_mshta_renamed.yml | 1 + detections/endpoint/detect_mshta_url_in_command_line.yml | 1 + detections/endpoint/detect_regasm_spawning_a_process.yml | 1 + detections/endpoint/detect_regasm_with_network_connection.yml | 1 + .../endpoint/detect_regasm_with_no_command_line_arguments.yml | 1 + detections/endpoint/detect_regsvcs_spawning_a_process.yml | 1 + detections/endpoint/detect_regsvcs_with_network_connection.yml | 1 + .../endpoint/detect_regsvcs_with_no_command_line_arguments.yml | 1 + .../endpoint/detect_regsvr32_application_control_bypass.yml | 1 + .../detect_rundll32_application_control_bypass___advpack.yml | 1 + .../detect_rundll32_application_control_bypass___setupapi.yml | 1 + .../detect_rundll32_application_control_bypass___syssetup.yml | 1 + detections/endpoint/detect_rundll32_inline_hta_execution.yml | 1 + detections/endpoint/disable_schedule_task.yml | 1 + detections/endpoint/dump_lsass_via_comsvcs_dll.yml | 1 + detections/endpoint/esentutl_sam_copy.yml | 1 + detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml | 1 + .../endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml | 1 + detections/endpoint/mshtml_module_load_in_office_product.yml | 1 + detections/endpoint/ntdsutil_export_ntds.yml | 1 + .../reg_exe_manipulating_windows_services_registry_keys.yml | 1 + .../endpoint/regsvr32_silent_and_install_param_dll_loading.yml | 1 + .../endpoint/regsvr32_with_known_silent_switch_cmdline.yml | 1 + detections/endpoint/remote_wmi_command_attempt.yml | 1 + detections/endpoint/rundll32_control_rundll_hunt.yml | 1 + .../rundll32_control_rundll_world_writable_directory.yml | 1 + .../endpoint/rundll32_create_remote_thread_to_a_process.yml | 1 + detections/endpoint/rundll32_createremotethread_in_browser.yml | 1 + detections/endpoint/rundll32_dnsquery.yml | 1 + detections/endpoint/rundll32_process_creating_exe_dll_files.yml | 1 + detections/endpoint/rundll32_shimcache_flush.yml | 1 + detections/endpoint/rundll_loading_dll_by_ordinal.yml | 1 + .../endpoint/schedule_task_with_http_command_arguments.yml | 1 + .../endpoint/schedule_task_with_rundll32_command_trigger.yml | 1 + .../scheduled_task_creation_on_remote_endpoint_using_at.yml | 1 + .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/scheduled_task_initiation_on_remote_endpoint.yml | 1 + detections/endpoint/schtasks_scheduling_job_on_remote_system.yml | 1 + .../endpoint/services_exe_lolbas_execution_process_spawn.yml | 1 + detections/endpoint/suspicious_icedid_rundll32_cmdline.yml | 1 + .../endpoint/suspicious_microsoft_workflow_compiler_rename.yml | 1 + .../endpoint/suspicious_microsoft_workflow_compiler_usage.yml | 1 + detections/endpoint/suspicious_msbuild_path.yml | 1 + detections/endpoint/suspicious_msbuild_rename.yml | 1 + detections/endpoint/suspicious_msbuild_spawn.yml | 1 + detections/endpoint/suspicious_mshta_child_process.yml | 1 + detections/endpoint/suspicious_mshta_spawn.yml | 1 + .../endpoint/suspicious_regsvr32_register_suspicious_path.yml | 1 + detections/endpoint/suspicious_rundll32_dllregisterserver.yml | 1 + .../endpoint/suspicious_scheduled_task_from_public_directory.yml | 1 + .../endpoint/svchost_exe_lolbas_execution_process_spawn.yml | 1 + detections/endpoint/windows_installutil_credential_theft.yml | 1 + detections/endpoint/windows_installutil_in_non_standard_path.yml | 1 + .../endpoint/windows_installutil_remote_network_connection.yml | 1 + detections/endpoint/windows_installutil_uninstall_option.yml | 1 + .../windows_installutil_uninstall_option_with_network.yml | 1 + detections/endpoint/windows_installutil_url_in_command_line.yml | 1 + 72 files changed, 72 insertions(+) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 50656c9f33..e4b1a3da33 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -34,6 +34,7 @@ tags: analytic_story: - Trickbot - IcedID + - Living Off The Land confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 9428c65705..307e045316 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - BITS Jobs + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 0d0ad64eed..f1b6f78e05 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -41,6 +41,7 @@ tags: - Ingress Tool Transfer - BITS Jobs - DarkSide Ransomware + - Living Off The Land confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 8583de094f..8c970d2088 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -34,6 +34,7 @@ tags: analytic_story: - Ingress Tool Transfer - DarkSide Ransomware + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index ad5c240a79..a1ac0e1293 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Ingress Tool Transfer - DarkSide Ransomware + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 783f07b7c8..eaf6ec2b1c 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -25,6 +25,7 @@ tags: analytic_story: - Windows Persistence Techniques - Cloud Federated Credential Abuse + - Living Off The Land asset_type: Endpoint confidence: 70 context: diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index c838779cff..1fe6d13c13 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Deobfuscate-Decode Files or Information + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 78a46d2339..6d31a47b77 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -34,6 +34,7 @@ tags: - Log4Shell CVE-2021-44228 - WhisperGate - Hermetic Wiper + - Living Off The Land automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index ebc2e0fc8d..793b4675b7 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index be92992b35..8abe81f2cd 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - Credential Dumping + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index acedbbde4c..0a9704fd49 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Suspicious Compiled HTML Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index b37e8b42ec..7803c03508 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Suspicious Compiled HTML Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 8fef218549..71053ab030 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Suspicious Compiled HTML Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 7bd3f79f89..1c1298b8fe 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -42,6 +42,7 @@ references: tags: analytic_story: - Suspicious Compiled HTML Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 4d4081f2d8..a27bb49389 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Suspicious MSHTA Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index c159e3aa43..f302aeee8a 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Suspicious MSHTA Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 72c70ff9d6..983ee69118 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Suspicious MSHTA Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index 828b69e974..6ef8210b38 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Suspicious Regsvcs Regasm Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index 8a091d5cad..617f921d2a 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Suspicious Regsvcs Regasm Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index c1dc6b4aca..e686ef4f69 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Suspicious Regsvcs Regasm Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index b97eba3c59..2064a652f1 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Suspicious Regsvcs Regasm Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index ce949a8e08..3a544bda18 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Suspicious Regsvcs Regasm Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 3c10194a8d..c9e3293038 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Suspicious Regsvcs Regasm Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index b95c9855a7..4431ef3dac 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Suspicious Regsvr32 Activity - Cobalt Strike + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 0eff122630..a3e262f36e 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - Suspicious Rundll32 Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 3364160849..1a4e2bb1cd 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Suspicious Rundll32 Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 643d906750..78f7368a0e 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - Suspicious Rundll32 Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index b260e1f0f7..b11e5a90bb 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Suspicious MSHTA Activity - NOBELIUM Group + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 5202dc15df..d222d57b32 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - IcedID + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 7ac74deb95..8c90706d14 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -26,6 +26,7 @@ tags: - Credential Dumping - Suspicious Rundll32 Activity - HAFNIUM Group + - Living Off The Land asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index ec661e947c..53b132d169 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Credential Dumping + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index e5099efcbf..d334b82b64 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -41,6 +41,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - Living Off The Land confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index a398270bfe..1ddb54a7fd 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Trickbot - IcedID + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 4a7bb55824..b13e645ed6 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Spearphishing Attachments - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 94bc05d64a..1fcdc546b4 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Credential Dumping - HAFNIUM Group + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 3c09425f7f..3922b07f3f 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Service Abuse - Windows Persistence Techniques + - Living Off The Land asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 999e6539d5..7047478d56 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -33,6 +33,7 @@ tags: - Suspicious Regsvr32 Activity - Remcos - Hermetic Wiper + - Living Off The Land automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 30da9a9714..a862143fbc 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -35,6 +35,7 @@ tags: - IcedID - Suspicious Regsvr32 Activity - Remcos + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index 7062469ad5..d99426d2cf 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Suspicious WMI Use + - Living Off The Land asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 301e52d8c1..08ce69d321 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Living Off The Land confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 6133119d42..db851af26e 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -39,6 +39,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 03402fae13..40862aa624 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - IcedID + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 5c8e55f1e0..4330b1f658 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - IcedID + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index 2efa8e3421..e72827f5f6 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - IcedID + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index b8de34301c..b0fd862caf 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - IcedID + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index de7b6dd5fd..5a4eb1959c 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Unusual Processes + - Living Off The Land confidence: 100 context: - Stage:Execution diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 94189a0b29..2c40265a4a 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -33,6 +33,7 @@ tags: analytic_story: - Unusual Processes - Suspicious Rundll32 Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 19c3c2a53f..acfd1992d4 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Windows Persistence Techniques + - Living Off The Land confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 55f860d8d1..85cfe1293e 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -36,6 +36,7 @@ tags: - Windows Persistence Techniques - Trickbot - IcedID + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index b9ad8ac491..9aaa11065b 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - Living Off The Land confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 30376311ea..70e44fae46 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -30,6 +30,7 @@ tags: - DHS Report TA18-074A - NOBELIUM Group - Windows Persistence Techniques + - Living Off The Land asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index a4a9213035..d5076575f4 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - Living Off The Land confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 8542db811c..26e4767fda 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Active Directory Lateral Movement - NOBELIUM Group + - Living Off The Land asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index f9c6f7dee5..e412490b64 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -41,6 +41,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - Living Off The Land confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 712c4239fd..1359d868d8 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - IcedID + - Living Off The Land confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 90b9c6cfb3..9fa6a8b73e 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -33,6 +33,7 @@ tags: - Trusted Developer Utilities Proxy Execution - Cobalt Strike - Masquerading - Rename System Utilities + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 0b565e2301..bfad4d1fe4 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Trusted Developer Utilities Proxy Execution + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index a734e8aac7..04ca2cebf8 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -34,6 +34,7 @@ tags: - Trusted Developer Utilities Proxy Execution MSBuild - Cobalt Strike - Masquerading - Rename System Utilities + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index c92bfb3578..7f283e8b1f 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -32,6 +32,7 @@ tags: - Trusted Developer Utilities Proxy Execution MSBuild - Cobalt Strike - Masquerading - Rename System Utilities + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index 026123b5eb..f264286192 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 99533384fd..61e018897e 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Suspicious MSHTA Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index 8c2bbfbce4..3d0476a096 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Suspicious MSHTA Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index d7b215489e..5bee38d8e6 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Suspicious Regsvr32 Activity - Iceid + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index cf8168714b..01c948bca9 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -38,6 +38,7 @@ references: tags: analytic_story: - Suspicious Rundll32 Activity + - Living Off The Land asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 5df156e6aa..000d4eb9c0 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -31,6 +31,7 @@ tags: - Ransomware - Ryuk Ransomware - Windows Persistence Techniques + - Living Off The Land confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index f1113e7d67..90587f65be 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - Living Off The Land confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index d2bf537944..71b48bb347 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Signed Binary Proxy Execution InstallUtil + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 81de856979..096a3b6e3d 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -37,6 +37,7 @@ tags: - Ransomware - Signed Binary Proxy Execution InstallUtil - WhisperGate + - Living Off The Land automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index acf452a753..4dcebced52 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -42,6 +42,7 @@ references: tags: analytic_story: - Signed Binary Proxy Execution InstallUtil + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 4bf7a02af8..17ccd4d0fd 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - Signed Binary Proxy Execution InstallUtil + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index ad88a19b1d..7b0ce5904b 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -49,6 +49,7 @@ references: tags: analytic_story: - Signed Binary Proxy Execution InstallUtil + - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index c76ec8cf81..97044fe49e 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Signed Binary Proxy Execution InstallUtil + - Living Off The Land confidence: 100 context: - Source:Endpoint From f6aff10752f3742ab3c7e85227fe255072dd9ac7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Mar 2022 11:34:43 -0600 Subject: [PATCH 2/4] Update account_discovery_with_net_app.yml --- detections/endpoint/account_discovery_with_net_app.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index e4b1a3da33..50656c9f33 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -34,7 +34,6 @@ tags: analytic_story: - Trickbot - IcedID - - Living Off The Land confidence: 50 context: - Source:Endpoint From 21079e3568931ee6f878b832539b49a37e848e50 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Mar 2022 12:40:39 -0600 Subject: [PATCH 3/4] fixes --- .../mshtml_module_load_in_office_product.yml | 1 - .../windows_installutil_credential_theft.yml | 1 - ...ows_installutil_remote_network_connection.yml | 16 ++++++++-------- ...installutil_uninstall_option_with_network.yml | 15 +++++++-------- 4 files changed, 15 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index b13e645ed6..4a7bb55824 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -28,7 +28,6 @@ tags: analytic_story: - Spearphishing Attachments - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 71b48bb347..d2bf537944 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -36,7 +36,6 @@ references: tags: analytic_story: - Signed Binary Proxy Execution InstallUtil - - Living Off The Land confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index 4dcebced52..dffd5a950f 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 1 -date: '2021-11-12' +version: 2 +date: '2022-03-16' author: Michael Haag, Splunk type: TTP datamodel: @@ -21,14 +21,14 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_installutil` by _time span=1h Processes.process_guid Processes.process_name + where `process_installutil` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | join process_guid [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid - Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process process_guid - connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`' + | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] + | table _time dest parent_process_name process_name process_path process process_id dest_port C2 + | `windows_installutil_remote_network_connection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 7b0ce5904b..16a3fe5878 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Uninstall Option with Network id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 1 -date: '2021-11-12' +version: 2 +date: '2022-03-16' author: Michael Haag, Splunk type: TTP datamodel: @@ -26,13 +26,12 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina processes. Capture any artifacts and review further.' search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time - span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path + span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_guid - [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports - where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name - original_file_name process_path process process_guid connection_to_CNC dest_port + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] + | table _time dest parent_process_name process_name process_path process process_id dest_port C2 | `windows_installutil_uninstall_option_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From a61943fe0f50756b96929285b11541f027ce644c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 16 Mar 2022 13:02:19 -0600 Subject: [PATCH 4/4] LOL --- stories/living_off_the_land.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/stories/living_off_the_land.yml b/stories/living_off_the_land.yml index 5697926a34..1e7dc547b2 100644 --- a/stories/living_off_the_land.yml +++ b/stories/living_off_the_land.yml @@ -1,10 +1,10 @@ name: Living Off The Land id: 6f7982e2-900b-11ec-a54a-acde48001122 -version: 1 -date: '2022-02-17' +version: 2 +date: '2022-03-16' author: Lou Stella, Splunk -description: Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment. -narrative: Living Off The Land refers to an attacker methodology of using software already installed on their target host to achieve their goals. Many utilities that ship with Windows can be used to achieve various goals, with reduced chances of detection by an antivirus software. +description: Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. +narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. references: - https://lolbas-project.github.io/ tags: