From 767f562d58b01e4c6a19b6c1e02bb534692af02b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 17 May 2021 10:50:49 +0200 Subject: [PATCH 1/3] rns_notes --- detections/endpoint/ransomware_notes_bulk_creation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index ace3740572..89173358c8 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your lookup table list for monitoring. + industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer From 9df93090873d56aa4256a5bfd73e81bda3b829b4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 28 May 2021 09:17:34 +0200 Subject: [PATCH 2/3] nslookup --- .../excessive_usage_of_nslookup_app.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index daafa2b2bf..ac95fc2963 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -2,7 +2,7 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 version: 1 date: '2021-04-21' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Stanislav Miskovic, Splunk type: batch datamodel: - Endpoint @@ -12,12 +12,15 @@ description: this search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name - | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" +| bucket _time span=15m | stats count as numNsLookup by Computer, _time +| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer +| eval upperThreshold=(avgNsLookup + stdNsLookup *3) +| eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) +| search isOutlier=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From cac94b27e72c6b2840c12b81579c816550cfaf4e Mon Sep 17 00:00:00 2001 From: root Date: Fri, 28 May 2021 07:50:13 +0000 Subject: [PATCH 3/3] Added detection testing service results inExcessive Usage of NSLOOKUP App --- .../endpoint/excessive_usage_of_nslookup_app.yml | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index ac95fc2963..8edf6f4e6e 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -12,15 +12,12 @@ description: this search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" -| bucket _time span=15m | stats count as numNsLookup by Computer, _time -| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer -| eval upperThreshold=(avgNsLookup + stdNsLookup *3) -| eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) -| search isOutlier=1 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m + | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as + avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval + upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > + 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the