diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 43730b9334..17fb173073 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -35,6 +35,7 @@ tags: - Malicious PowerShell - Ingress Tool Transfer - Log4Shell CVE-2021-44228 + - DarkCrystal RAT confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 2d7567db60..d7909ae2a3 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -43,6 +43,7 @@ tags: - Hermetic Wiper - Industroyer2 - Azorult + - DarkCrystal RAT automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 4352f949f6..40babd109a 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -44,6 +44,7 @@ tags: - Malicious PowerShell - NOBELIUM Group - WhisperGate + - DarkCrystal RAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index a4c8ef2564..0d1737fdd4 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -29,6 +29,7 @@ tags: analytic_story: - DHS Report TA18-074A - HAFNIUM Group + - DarkCrystal RAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index bd6d5aecb7..d072573d39 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -30,6 +30,7 @@ tags: - Spearphishing Attachments - Trickbot - IcedID + - DarkCrystal RAT confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 61dce8802b..ee2c24c7c4 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Trickbot + - DarkCrystal RAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 40cedea8de..d5cc4c4d33 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -39,6 +39,7 @@ tags: - WhisperGate - Hermetic Wiper - Industroyer2 + - DarkCrystal RAT automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 330359665c..abfd380d59 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - DarkCrystal RAT confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 26500a08b9..3a9ef16100 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - DarkCrystal RAT confidence: 100 context: - Source:Endpoint diff --git a/stories/darkcrystal_rat.yml b/stories/darkcrystal_rat.yml new file mode 100644 index 0000000000..2b2f8728b0 --- /dev/null +++ b/stories/darkcrystal_rat.yml @@ -0,0 +1,24 @@ +name: DarkCrystal RAT +id: 639e6006-0885-4847-9394-ddc2902629bf +version: 1 +date: '2022-07-26' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc. + The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest + commercial RATs. + DcRat is modular and bespoke plugin framework make it a very flexible option, helpful for a range of nefearious uses. +narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption + is the goal. +references: +- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor +- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat +tags: + analytic_story: DarkCrystal RAT + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file