diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 7b38c7b154..d4993baf2c 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -19,7 +19,7 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may references: [] tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 6b8b7a8286..a8f9c6fc3c 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -36,7 +36,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - DarkSide Ransomware - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index f3bed31e95..aae0bea823 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -33,7 +33,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - DarkSide Ransomware - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index cea14e9c2d..d4cdc813b6 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents - suspicious behavior as its commonly user by tools like like PsExec/PaExec and others + suspicious behavior as its commonly used by tools like like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements @@ -31,7 +31,7 @@ references: - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement - Trickbot automated_detection_testing: passed confidence: 100 diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 103da14e4d..d2c6c8d24a 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -36,7 +36,7 @@ references: - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index 8a8ae569ea..3f8090e1e6 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -25,7 +25,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2 tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml index adb4eb9517..0ef0b02006 100644 --- a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml +++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml @@ -23,7 +23,7 @@ references: [] tags: analytic_story: - Hidden Cobra Malware - - Lateral Movement + - Active Directory Lateral Movement - SamSam Ransomware product: - Splunk Phantom diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index ea44d9edb0..b49f8879df 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -40,7 +40,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml new file mode 100644 index 0000000000..b9179b8089 --- /dev/null +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -0,0 +1,86 @@ +name: Possible Lateral Movement PowerShell Spawn +id: cb909b3e-512b-11ec-aa31-3e22fbd008af +version: 1 +date: '2021-11-29' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic assists with identifying a PowerShell process + spawned as a child or grand child process of commonly abused processes during lateral + movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` + and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, + Windows Management Instrumentation, Task Scheduler, Windows Remote Management and + the DCOM protocol can be abused to start a process on a remote endpoint. Looking + for PowerShell spawned out of this processes may reveal a lateral movement attack. + Red Teams and adversaries alike may abuse these services during a breach for lateral + movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe + OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe + OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) + (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) + OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Legitimate applications may spawn PowerShell as a child process + of the the identified processes. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1021/003 +- https://attack.mitre.org/techniques/T1021/006/ +- https://attack.mitre.org/techniques/T1047/ +- https://attack.mitre.org/techniques/T1053.005/ +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Active Directory Lateral Movement + - Malicious PowerShell + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log + kill_chain_phases: + - Lateral Movement + - Malicious PowerShell + mitre_attack_id: + - T1021 + - T1021.003 + - T1021.006 + - T1047 + - T1053.005 + - T1543.003 + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A PowerShell process was spawned as a child process of typically abused + processes on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index a9909bece8..4732042e6b 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -27,7 +27,7 @@ references: - https://www.cybereason.com/blog/dcom-lateral-movement-techniques tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 921e7209ea..15389b529a 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -25,7 +25,7 @@ references: - https://www.cybereason.com/blog/dcom-lateral-movement-techniques tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index b91bf8ffc1..b26ed0eae8 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -28,7 +28,7 @@ references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index 0cc04eb85e..3482d16ebd 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -26,7 +26,7 @@ references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 66f259f1d8..0cf0e762c5 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -27,7 +27,7 @@ references: - https://attack.mitre.org/techniques/T1021/006/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 4a29b6ae73..ea0ab2981e 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -30,7 +30,7 @@ tags: analytic_story: - Ransomware - Suspicious WMI Use - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index 230e41cbfe..aa04af220f 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -27,7 +27,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index 6a6016cf50..abd9d37eec 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -25,7 +25,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index 61c0b7ecdd..dc1b4e2e5c 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -29,7 +29,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index f30345a006..534990ea49 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -26,7 +26,7 @@ references: - https://attack.mitre.org/techniques/T1053/005/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 06696828bb..ba117efbda 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -27,7 +27,7 @@ known_false_positives: Administrators may create scheduled tasks on remote syste references: [] tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement - NOBELIUM Group asset_type: Endpoint automated_detection_testing: passed diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index bd90a89185..3761b132b9 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic identifies `services.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned - as a child processs of `services.exe`. The LOLBAS project documents Windows native + as a child process of `services.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. @@ -40,7 +40,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml new file mode 100644 index 0000000000..7caeaf1551 --- /dev/null +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -0,0 +1,67 @@ +name: Short Lived Scheduled Task +id: 6fa31414-546e-11ec-adfa-acde48001122 +version: 1 +date: '2021-12-03' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic leverages Windows Security EventCode 4698, `A + scheduled task was created` and Windows Security EventCode 4699, `A scheduled task + was deleted` to identify scheduled tasks created and deleted in less than 30 seconds. + This behavior may represent a lateral movement attack abusing the Task Scheduler + to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler + for lateral movement and remote code execution. +search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message + | transaction Task_Name startswith=(EventCode=4698) endswith=(EventCode=4699) | + eval short_lived=case((duration<30),"TRUE") | search short_lived = TRUE | table + _time, ComputerName, Account_Name, Command, Task_Name, short_lived | `short_lived_scheduled_task_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: Although uncommon, legitimate applications may create and delete + a Scheduled Task within 30 seconds. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler +tags: + analytic_story: + - Active Directory Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - ComputerName + - Account_Name + - Task_Name + - Description + - Command + security_domain: endpoint + impact: 90 + confidence: 90 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Lateral Movement + message: A windows scheduled task was created and deleted in 30 seconds on $ComputerName$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Command + type: Command + role: + - Target + automated_detection_testing: passed diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index 62d3db0f76..9337d767fe 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -49,7 +49,7 @@ references: - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 72a13c15f0..c771240784 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -51,7 +51,7 @@ references: - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index a647523f9c..e4ff7baa92 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Task Scheduler and creating a malicious remote scheduled task, the executed command is spawned - as a child processs of `svchost.exe`. The LOLBAS project documents Windows native + as a child process of `svchost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. @@ -39,7 +39,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 63dfff09af..c3fa2d88f7 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -28,7 +28,7 @@ references: tags: analytic_story: - Clop Ransomware - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index 94cc1e0dee..483bbb5954 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -26,7 +26,7 @@ references: - https://pentestlab.blog/2020/07/21/lateral-movement-services/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 1067c551d7..ee54cbec60 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -28,7 +28,7 @@ references: - https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 72ec8412e9..bf0a3f099e 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -26,7 +26,7 @@ references: - https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 0091f8b44b..ff59f2304b 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -47,7 +47,7 @@ tags: - Ransomware - Ryuk Ransomware - IcedID - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index d8c382523d..e97f6960b8 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management - Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`. + Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify @@ -40,7 +40,7 @@ references: - https://lolbas-project.github.io/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index f3884c6b51..f7a2261b11 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -40,7 +40,7 @@ references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ tags: analytic_story: - - Lateral Movement + - Active Directory Lateral Movement automated_detection_testing: passed confidence: 60 context: diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml new file mode 100644 index 0000000000..ddb0436bae --- /dev/null +++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml @@ -0,0 +1,63 @@ +name: Randomly Generated Scheduled Task Name +id: 9d22a780-5165-11ec-ad4f-3e22fbd008af +version: 1 +date: '2021-11-29' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, + to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this, + this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. + Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task + and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec, + typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help + defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` + should be customized by users. The Command field can be used to determine if the task has malicious intent or not. +search: ' `wineventlog_security` EventCode=4698 | xmlkv Message +| lookup ut_shannon_lookup word as Task_Name +| where ut_shannon > 3 +| table _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also + required. +known_false_positives: Legitimate applications may use random Scheduled Task names. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://splunkbase.splunk.com/app/2734/ +- https://en.wikipedia.org/wiki/Entropy_(information_theory) +tags: + analytic_story: + - Active Directory Lateral Movement + kill_chain_phases: + - Privilege Escalation + - Lateral Movement + - Persistence + mitre_attack_id: + - T1053 + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Description + - Command + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Lateral Movement + message: 'A windows scheduled task with a suspicious task name was created on $dest$' + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml new file mode 100644 index 0000000000..af39d3a77f --- /dev/null +++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml @@ -0,0 +1,65 @@ +name: Randomly Generated Windows Service Name +id: 2032a95a-5165-11ec-a2c3-3e22fbd008af +version: 1 +date: '2021-11-29' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, + to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this, + this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. + Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service + and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket, + typically create a Windows Service with a random service name on the victim host. This hunting analytic may help + defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` + should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. +search: ' `wineventlog_system` EventCode=7045 +| lookup ut_shannon_lookup word as Service_Name +| where ut_shannon > 3 +| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. The Windows TA as well as the URL ToolBox application are also + required. +known_false_positives: Legitimate applications may use random Windows Service names. +references: +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Active Directory Lateral Movement + kill_chain_phases: + - Privilege Escalation + - Lateral Movement + mitre_attack_id: + - T1543 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ComputerName + - Service_File_Name + - Service_Type + - Service_Name + - Service_Start_Type + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A Windows Service with a suspicious service name was installed on $ComputerName$ + observable: + - name: Service_File_Name + type: Other + role: + - Other + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml index 512846226c..d9c7c0dda1 100644 --- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml @@ -28,7 +28,7 @@ references: [] tags: analytic_story: - Hidden Cobra Malware - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml new file mode 100644 index 0000000000..0072e766ee --- /dev/null +++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -0,0 +1,70 @@ +name: Unusual Number of Computer Service Tickets Requested +id: ac3b81c0-52f4-11ec-ac44-acde48001122 +version: 1 +date: '2021-12-01' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, + to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects + to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint + requesting a large number of computer service tickets for different endpoints could represent malicious behavior like + lateral movement, malware staging, reconnaissance, etc.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of service requests. To customize this + analytic, users can try different combinations of the `bucket` span time, the + calculation of the `upperBound` field as well as the Outlier calculation. + This logic can be used for real time security monitoring as well as threat hunting exercises.\ + +search: ' `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*" +| bucket span=2m _time +| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets by _time, Client_Address, Account_Name +| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) +| `unusual_number_of_computer_service_tickets_requested_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: An single endpoint requesting a large number of computer service tickets + is not common behavior. Possible false positive scenarios include but are not limited + to vulnerability scanners, administration systeams and missconfigured systems. +references: +- https://attack.mitre.org/techniques/T1078/ +tags: + analytic_story: + - Active Directory Lateral Movement + kill_chain_phases: + - Reconnaissance + - Exploitation + - Lateral Movement + mitre_attack_id: + - T1078 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Ticket_Options + - Ticket_Encryption_Type + - dest + - service + - service_id + security_domain: endpoint + impact: 70 + confidence: 60 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: + observable: + - name: Client_Address + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml new file mode 100644 index 0000000000..0fc6e072e6 --- /dev/null +++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -0,0 +1,70 @@ +name: Unusual Number of Remote Endpoint Authentication Events +id: acb5dc74-5324-11ec-a36d-acde48001122 +version: 1 +date: '2021-12-01' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, + to identify an unusual number of remote authentication attempts coming from one source. An endpoint + authenticating to a large number of remote endpoints could represent malicious behavior like + lateral movement, malware staging, reconnaissance, etc.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this + analytic, users can try different combinations of the `bucket` span time, the + calculation of the `upperBound` field as well as the Outlier calculation. + This logic can be used for real time security monitoring as well as threat hunting exercises.\ + +search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$" +| eval Source_Account = mvindex(Account_Name, 1) +| bucket span=2m _time +| stats dc(ComputerName) AS unique_targets values(ComputerName) as target_hosts by _time, Source_Network_Address, Source_Account +| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Source_Network_Address, Source_Account +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) + `unusual_number_of_remote_endpoint_authentication_events_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers aas well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: An single endpoint authenticating to a large number of hosts + is not common behavior. Possible false positive scenarios include but are not limited + to vulnerability scanners, jump servers and missconfigured systems. +references: +- https://attack.mitre.org/techniques/T1078/ +tags: + analytic_story: + - Active Directory Lateral Movement + kill_chain_phases: + - Reconnaissance + - Lateral Movement + mitre_attack_id: + - T1078 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - Caller_Process_Name + - Security_ID + - Account_Name + - ComputerName + security_domain: endpoint + impact: 70 + confidence: 60 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Reconnaissance + - Stage:Lateral Movement + message: + observable: + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml index a3148b01dd..e08cb53592 100644 --- a/detections/experimental/network/remote_desktop_network_traffic.yml +++ b/detections/experimental/network/remote_desktop_network_traffic.yml @@ -32,7 +32,7 @@ tags: - SamSam Ransomware - Ryuk Ransomware - Hidden Cobra Malware - - Lateral Movement + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/stories/lateral_movement.yml b/stories/active_directory_lateral_movement.yml similarity index 76% rename from stories/lateral_movement.yml rename to stories/active_directory_lateral_movement.yml index b245f947c7..c54c881974 100644 --- a/stories/lateral_movement.yml +++ b/stories/active_directory_lateral_movement.yml @@ -1,19 +1,20 @@ -name: Lateral Movement +name: Active Directory Lateral Movement id: 399d65dc-1f08-499b-a259-aad9051f38ad -version: 2 -date: '2021-11-23' +version: 3 +date: '2021-12-09' author: David Dorsey, Mauricio Velazco Splunk description: Detect and investigate tactics, techniques, and procedures around how - attackers move laterally within the enterprise. Because lateral movement can expose - the adversary to detection, it should be an important focus for security analysts. + attackers move laterally within an Active Directory environment. Since lateral movement + is often a necessary step in a breach, it is important for cyber defenders to deploy + detection coverage. narrative: "Once attackers gain a foothold within an enterprise, they will seek to\ \ expand their accesses and leverage techniques that facilitate lateral movement.\ \ Attackers will often spend quite a bit of time and effort moving laterally. Because\ \ lateral movement renders an attacker the most vulnerable to detection, it's an\ \ excellent focus for detection and investigation.\\\nIndications of lateral movement\ - \ can include the abuse of system utilities (such as `psexec.exe`), unauthorized\ - \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash,\ - \ or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\ + \ in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized\ + \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager,\ + \ the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\ \ lateral movement techniques and look for suspicious activity in and around high-value\ \ strategic network assets, such as Active Directory, which are often considered\ \ the primary target or \"crown jewels\" to a persistent threat actor.\\\nAn adversary\ @@ -32,9 +33,9 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek \ for all processes to ensure that the attackers did not install unauthorized software." references: - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html -- https://www.youtube.com/watch?v=hVTkkkM9XDg +- http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco tags: - analytic_story: Lateral Movement + analytic_story: Active Directory Lateral Movement category: - Adversary Tactics product: diff --git a/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml new file mode 100644 index 0000000000..96d82a8249 --- /dev/null +++ b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml @@ -0,0 +1,12 @@ +name: Possible Lateral Movement PowerShell Spawn Unit Test +tests: +- name: Possible Lateral Movement PowerShell Spawn + file: endpoint/possible_lateral_movement_powershell_spawn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/short_lived_scheduled_task.test.yml b/tests/endpoint/short_lived_scheduled_task.test.yml new file mode 100644 index 0000000000..5cc0192b87 --- /dev/null +++ b/tests/endpoint/short_lived_scheduled_task.test.yml @@ -0,0 +1,12 @@ +name: Short Lived Scheduled Task Unit Test +tests: +- name: Short Lived Scheduled Task + file: endpoint/short_lived_scheduled_task.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file