From e65c62b66baea7f14fd29155455362bd0aac7c64 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 12 Nov 2021 05:29:31 -0700 Subject: [PATCH 01/23] The Prodigal Haag Returns --- .../endpoint/wmic_xsl_execution_via_url.yml | 73 +++++++++++++++++++ .../xsl_script_execution_with_wmic.yml | 26 +++++-- .../wmic_xsl_execution_via_url.test.yml | 12 +++ 3 files changed, 103 insertions(+), 8 deletions(-) create mode 100644 detections/endpoint/wmic_xsl_execution_via_url.yml create mode 100644 tests/endpoint/wmic_xsl_execution_via_url.test.yml diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml new file mode 100644 index 0000000000..710a736c18 --- /dev/null +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -0,0 +1,73 @@ +name: WMIC XSL Execution via URL +id: 787e9dd0-4328-11ec-a029-acde48001122 +version: 1 +date: '2021-11-11' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this technique to invoke JScript or VBScript within an XSL file. This technique can also execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch. + Upon identifying a suspicious execution, review for confirmed network connnection and script download.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process IN ("*http://*", "*https://*") + Processes.process="*/format:*" by Processes.parent_process_name Processes.original_file_name + Processes.parent_process Processes.process_name Processes.process_id Processes.process + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md + - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file +tags: + analytic_story: + - Suspicious WMI Use + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1220 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 9f39ecc1a4..a2d658b7ef 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -12,7 +12,7 @@ description: This search is to detect a suspicious wmic.exe process or renamed w This TTP is really a good indicator for you to hunt further for FIN7 or other attacker that known to used this technique. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process = "*os get*" + as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -25,32 +25,42 @@ known_false_positives: unknown references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ +- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file tags: analytic_story: - FIN7 + - Suspicious WMI Use automated_detection_testing: passed confidence: 70 context: - Source:Endpoint - - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log impact: 70 kill_chain_phases: - Exploitation - message: Process name $process_name$ with commandline $process$ to execute jscript - in $dest$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script. mitre_attack_id: - T1220 observable: - - name: dest - type: Endpoint - role: - - Victim - name: user type: User role: - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/tests/endpoint/wmic_xsl_execution_via_url.test.yml b/tests/endpoint/wmic_xsl_execution_via_url.test.yml new file mode 100644 index 0000000000..3fceae6396 --- /dev/null +++ b/tests/endpoint/wmic_xsl_execution_via_url.test.yml @@ -0,0 +1,12 @@ +name: WMIC XSL Execution via URL Unit Test +tests: +- name: WMIC XSL Execution via URL + file: endpoint/wmic_xsl_execution_via_url.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1220/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From a5a1157c77cb45e7b198a26691c52f446ed80d0c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 12 Nov 2021 08:07:59 -0700 Subject: [PATCH 02/23] Update wmic_xsl_execution_via_url.test.yml --- tests/endpoint/wmic_xsl_execution_via_url.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/wmic_xsl_execution_via_url.test.yml b/tests/endpoint/wmic_xsl_execution_via_url.test.yml index 3fceae6396..07437ec109 100644 --- a/tests/endpoint/wmic_xsl_execution_via_url.test.yml +++ b/tests/endpoint/wmic_xsl_execution_via_url.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1220/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 7a72387e2cd81a9b6f5a0853dbb4c4cd68bc67f2 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 15:28:29 +0000 Subject: [PATCH 03/23] Added detection testing service results inWMIC XSL Execution via URL --- .../endpoint/wmic_xsl_execution_via_url.yml | 53 ++++++++++++------- 1 file changed, 33 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 710a736c18..768394b4ba 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -6,24 +6,36 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this technique to invoke JScript or VBScript within an XSL file. This technique can also execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch. - Upon identifying a suspicious execution, review for confirmed network connnection and script download.' +description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible + Stylesheet Language) script. This originally was identified by Casey Smith, dubbed + Squiblytwo, as an application control bypass. Many adversaries will utilize this + technique to invoke JScript or VBScript within an XSL file. This technique can also + execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, + leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows + Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying + a suspicious execution, review for confirmed network connnection and script download. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process IN ("*http://*", "*https://*") - Processes.process="*/format:*" by Processes.parent_process_name Processes.original_file_name - Processes.parent_process Processes.process_name Processes.process_id Processes.process - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed. + as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process + IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.parent_process_name + Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id + Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives are limited as legitimate applications typically + do not download files or xsl using WMIC. Filter as needed. references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md - - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md +- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file tags: analytic_story: - Suspicious WMI Use - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -36,11 +48,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -48,12 +60,12 @@ tags: security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. observable: - name: user type: User @@ -70,4 +82,5 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + automated_detection_testing: passed From 878c0c775bc86d34b741fb186625747d4c2da491 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 12 Nov 2021 13:05:19 -0700 Subject: [PATCH 04/23] InstallUTIL :beer: --- .../windows_installutil_credential_theft.yml | 81 +++++++++++++++++ ..._installutil_remote_network_connection.yml | 85 ++++++++++++++++++ .../windows_installutil_uninstall_option.yml | 84 +++++++++++++++++ ...tallutil_uninstall_option_with_network.yml | 89 +++++++++++++++++++ ...indows_installutil_url_in_command_line.yml | 82 +++++++++++++++++ macros/process_installutil.yml | 3 + ...ned_binary_proxy_execution_installutil.yml | 28 ++++++ ...dows_installutil_credential_theft.test.yml | 12 +++ ...allutil_remote_network_connection.test.yml | 12 +++ ...dows_installutil_uninstall_option.test.yml | 12 +++ ...til_uninstall_option_with_network.test.yml | 12 +++ ...s_installutil_url_in_command_line.test.yml | 12 +++ 12 files changed, 512 insertions(+) create mode 100644 detections/endpoint/windows_installutil_credential_theft.yml create mode 100644 detections/endpoint/windows_installutil_remote_network_connection.yml create mode 100644 detections/endpoint/windows_installutil_uninstall_option.yml create mode 100644 detections/endpoint/windows_installutil_uninstall_option_with_network.yml create mode 100644 detections/endpoint/windows_installutil_url_in_command_line.yml create mode 100644 macros/process_installutil.yml create mode 100644 stories/signed_binary_proxy_execution_installutil.yml create mode 100644 tests/endpoint/windows_installutil_credential_theft.test.yml create mode 100644 tests/endpoint/windows_installutil_remote_network_connection.test.yml create mode 100644 tests/endpoint/windows_installutil_uninstall_option.test.yml create mode 100644 tests/endpoint/windows_installutil_uninstall_option_with_network.test.yml create mode 100644 tests/endpoint/windows_installutil_url_in_command_line.test.yml diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml new file mode 100644 index 0000000000..b9081b4926 --- /dev/null +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -0,0 +1,81 @@ +name: Windows InstallUtil Credential Theft +id: ccfeddec-43ec-11ec-b494-acde48001122 +version: 1 +date: '2021-11-12' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like MimiKatz. \ + + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' +search: '`sysmon` EventID=7 process_name=installutil.exe + ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, + ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and module loads from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed. +references: + - https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0 +tags: + analytic_story: + - Signed Binary Proxy Execution InstallUtil + dataset: [] + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1218.004 + - T1218 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml new file mode 100644 index 0000000000..b085b724be --- /dev/null +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -0,0 +1,85 @@ +name: Windows InstallUtil Remote Network Connection +id: 4fbf9270-43da-11ec-9486-acde48001122 +version: 1 +date: '2021-11-12' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control. \ + + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port + | `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Signed Binary Proxy Execution InstallUtil + dataset: [] + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1218.004 + - T1218 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + - Ports.process_guid + - Ports.dest + - Ports.dest_port + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml new file mode 100644 index 0000000000..eff99f9226 --- /dev/null +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -0,0 +1,84 @@ +name: Windows InstallUtil Uninstall Option +id: cfa7b9ac-43f0-11ec-9b48-acde48001122 +version: 1 +date: '2021-11-12' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies the Windows InstallUtil.exe binary. This will execute code while bypassing application control using the `/u` (uninstall) switch. \ + + InstallUtil uses the functions install and uninstall within the System.Configuration.Install namespace to process .net assembly. Install function requires admin privileges, however, uninstall function can be run as an unprivileged user.\ + + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Limited false positives should be present. Filter as needed by parent process or application. +references: + - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 + - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Signed Binary Proxy Execution InstallUtil + dataset: [] + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1218.004 + - T1218 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml new file mode 100644 index 0000000000..881e1de9fc --- /dev/null +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -0,0 +1,89 @@ +name: Windows InstallUtil Uninstall Option with Network +id: 1a52c836-43ef-11ec-a36c-acde48001122 +version: 1 +date: '2021-11-12' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control using the `/u` (uninstall) switch. \ + + InstallUtil uses the functions install and uninstall within the System.Configuration.Install namespace to process .net assembly. Install function requires admin privileges, however, uninstall function can be run as an unprivileged user.\ + + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | join process_guid [ + | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port + | `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name original_file_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_uninstall_option_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. +references: + - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 + - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Signed Binary Proxy Execution InstallUtil + dataset: [] + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1218.004 + - T1218 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + - Ports.process_guid + - Ports.dest + - Ports.dest_port + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml new file mode 100644 index 0000000000..ee1e64dd87 --- /dev/null +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -0,0 +1,82 @@ +name: Windows InstallUtil URL in Command Line +id: 28e06670-43df-11ec-a569-acde48001122 +version: 1 +date: '2021-11-12' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies the Windows InstallUtil.exe binary passing a HTTP request on the command-line. This technique may be used to download and execute code while bypassing application control. \ + + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*http://*","*https://*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_installutil_url_in_command_line_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d +tags: + analytic_story: + - Signed Binary Proxy Execution InstallUtil + dataset: [] + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1218.004 + - T1218 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/macros/process_installutil.yml b/macros/process_installutil.yml new file mode 100644 index 0000000000..74b6b60161 --- /dev/null +++ b/macros/process_installutil.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_installutil diff --git a/stories/signed_binary_proxy_execution_installutil.yml b/stories/signed_binary_proxy_execution_installutil.yml new file mode 100644 index 0000000000..c46f2084ad --- /dev/null +++ b/stories/signed_binary_proxy_execution_installutil.yml @@ -0,0 +1,28 @@ +name: Signed Binary Proxy Execution InstallUtil +id: 9482a314-43dc-11ec-a3c9-acde48001122 +version: 1 +date: '2021-11-12' +author: Michael Haag, Splunk +description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. +narrative: 'InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. \ + + There are multiple ways to instantiate InstallUtil and they are all outlined within Atomic Red Team - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md. Two specific ways may be used and that includes invoking via installer assembly class constructor through .NET and via InstallUtil.exe. \ + + Typically, adversaries will utilize the most commonly found way to invoke via InstallUtil Uninstall method. \ + + Note that parallel processes, and parent process, play a role in how InstallUtil is being used. In particular, a developer using InstallUtil will spawn from VisualStudio. Adversaries, will spawn from non-standard processes like Explorer.exe, cmd.exe or PowerShell.exe. It''s important to review the command-line to identify the DLL being loaded. \ + + Parallel processes may also include csc.exe being used to compile a local `.cs` file. This file will be the input to the output. Developers usually do not build direct on the command shell, therefore this should raise suspicion.' +references: +- https://attack.mitre.org/techniques/T1218/004/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +tags: + analytic_story: + - Signed Binary Proxy Execution InstallUtil + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/windows_installutil_credential_theft.test.yml b/tests/endpoint/windows_installutil_credential_theft.test.yml new file mode 100644 index 0000000000..c1b6135db7 --- /dev/null +++ b/tests/endpoint/windows_installutil_credential_theft.test.yml @@ -0,0 +1,12 @@ +name: Windows InstallUtil Credential Theft Unit Test +tests: +- name: Windows InstallUtil Credential Theft + file: endpoint/windows_installutil_credential_theft.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_installutil_remote_network_connection.test.yml b/tests/endpoint/windows_installutil_remote_network_connection.test.yml new file mode 100644 index 0000000000..36ed1a889f --- /dev/null +++ b/tests/endpoint/windows_installutil_remote_network_connection.test.yml @@ -0,0 +1,12 @@ +name: Windows InstallUtil Remote Network Connection Unit Test +tests: +- name: Windows InstallUtil Remote Network Connection + file: endpoint/windows_installutil_remote_network_connection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_installutil_uninstall_option.test.yml b/tests/endpoint/windows_installutil_uninstall_option.test.yml new file mode 100644 index 0000000000..2b37ecc20c --- /dev/null +++ b/tests/endpoint/windows_installutil_uninstall_option.test.yml @@ -0,0 +1,12 @@ +name: Windows InstallUtil Uninstall Option Unit Test +tests: +- name: Windows InstallUtil Uninstall Option + file: endpoint/windows_installutil_uninstall_option.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_installutil_uninstall_option_with_network.test.yml b/tests/endpoint/windows_installutil_uninstall_option_with_network.test.yml new file mode 100644 index 0000000000..b48813e0a3 --- /dev/null +++ b/tests/endpoint/windows_installutil_uninstall_option_with_network.test.yml @@ -0,0 +1,12 @@ +name: Windows InstallUtil Uninstall Option with Network Unit Test +tests: +- name: Windows InstallUtil Uninstall Option with Network + file: endpoint/windows_installutil_uninstall_option_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_installutil_url_in_command_line.test.yml b/tests/endpoint/windows_installutil_url_in_command_line.test.yml new file mode 100644 index 0000000000..7407a4fcd1 --- /dev/null +++ b/tests/endpoint/windows_installutil_url_in_command_line.test.yml @@ -0,0 +1,12 @@ +name: Windows InstallUtil URL in Command Line Unit Test +tests: +- name: Windows InstallUtil URL in Command Line + file: endpoint/windows_installutil_url_in_command_line.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 07c0bd828bf067011632d685d29004a0d1b682e7 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 22:11:12 +0000 Subject: [PATCH 05/23] Added detection testing service results inWindows InstallUtil Uninstall Option --- .../windows_installutil_uninstall_option.yml | 64 +++++++++++-------- 1 file changed, 39 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index eff99f9226..9e17fac379 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -6,32 +6,46 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies the Windows InstallUtil.exe binary. This will execute code while bypassing application control using the `/u` (uninstall) switch. \ - - InstallUtil uses the functions install and uninstall within the System.Configuration.Install namespace to process .net assembly. Install function requires admin privileges, however, uninstall function can be run as an unprivileged user.\ +description: 'The following analytic identifies the Windows InstallUtil.exe binary. + This will execute code while bypassing application control using the `/u` (uninstall) + switch. \ - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ - - If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ + InstallUtil uses the functions install and uninstall within the System.Configuration.Install + namespace to process .net assembly. Install function requires admin privileges, + however, uninstall function can be run as an unprivileged user.\ - During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on + the filesystem is typically specified. Take note of the parent process. In a suspicious + instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` + or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line + switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel + processes. Capture any artifacts and review further.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` + as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process + IN ("*/u*", "*uninstall*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Limited false positives should be present. Filter as needed by parent process or application. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives should be present. Filter as needed + by parent process or application. references: - - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 - - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 +- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: analytic_story: - Signed Binary Proxy Execution InstallUtil - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log kill_chain_phases: - Exploitation - Privilege Escalation @@ -46,11 +60,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -58,12 +72,12 @@ tags: security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ performing an uninstall. observable: - name: user type: User @@ -81,4 +95,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 1aa5852b19d8e93891b880030efa764d985c69ae Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 Nov 2021 07:53:20 -0700 Subject: [PATCH 06/23] Update exchange_powershell_module_usage.yml --- .../experimental/endpoint/exchange_powershell_module_usage.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml index d987ac2c27..ba9c5b83c7 100644 --- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml +++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml @@ -33,6 +33,7 @@ references: - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell +- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ tags: analytic_story: - ProxyShell From 6e5b06270e6c12d605f022109a5b41657b52b6db Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 Nov 2021 10:21:17 -0700 Subject: [PATCH 07/23] Update windows_installutil_credential_theft.yml --- detections/endpoint/windows_installutil_credential_theft.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index b9081b4926..f3e3d420f7 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -13,7 +13,7 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -search: '`sysmon` EventID=7 process_name=installutil.exe +search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` From 5446bc59a87574bbccd71242f5219647b47e7b3e Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 17:59:30 +0000 Subject: [PATCH 08/23] Added detection testing service results inWindows InstallUtil URL in Command Line --- ...indows_installutil_url_in_command_line.yml | 62 +++++++++++-------- 1 file changed, 37 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index ee1e64dd87..5a0138303f 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -6,30 +6,42 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies the Windows InstallUtil.exe binary passing a HTTP request on the command-line. This technique may be used to download and execute code while bypassing application control. \ - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ - - If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ +description: 'The following analytic identifies the Windows InstallUtil.exe binary + passing a HTTP request on the command-line. This technique may be used to download + and execute code while bypassing application control. \ - During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on + the filesystem is typically specified. Take note of the parent process. In a suspicious + instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` + or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line + switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel + processes. Capture any artifacts and review further.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*http://*","*https://*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_installutil_url_in_command_line_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. + as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process + IN ("*http://*","*https://*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is + not typically used to download remote files. Filter as needed based on Developers + requirements. references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md - - https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d tags: analytic_story: - Signed Binary Proxy Execution InstallUtil - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log kill_chain_phases: - Exploitation - Privilege Escalation @@ -44,11 +56,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -56,12 +68,12 @@ tags: security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ passing a URL on the command-line. observable: - name: user type: User @@ -79,4 +91,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 87fe65ac660afac323f845746645da44c18ea599 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 18:38:15 +0000 Subject: [PATCH 09/23] Added detection testing service results inWindows InstallUtil Uninstall Option with Network --- ...tallutil_uninstall_option_with_network.yml | 79 +++++++++++-------- 1 file changed, 48 insertions(+), 31 deletions(-) diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 881e1de9fc..3e84ff76eb 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -6,34 +6,51 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control using the `/u` (uninstall) switch. \ - - InstallUtil uses the functions install and uninstall within the System.Configuration.Install namespace to process .net assembly. Install function requires admin privileges, however, uninstall function can be run as an unprivileged user.\ +description: 'The following analytic identifies the Windows InstallUtil.exe binary + making a remote network connection. This technique may be used to download and execute + code while bypassing application control using the `/u` (uninstall) switch. \ - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ - - If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ + InstallUtil uses the functions install and uninstall within the System.Configuration.Install + namespace to process .net assembly. Install function requires admin privileges, + however, uninstall function can be run as an unprivileged user.\ - During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port - | `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name original_file_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_uninstall_option_with_network_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on + the filesystem is typically specified. Take note of the parent process. In a suspicious + instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` + or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line + switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel + processes. Capture any artifacts and review further.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time + span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path + Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_guid + [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports + where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name + original_file_name process_path process process_guid connection_to_CNC dest_port + | `windows_installutil_uninstall_option_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is + not typically used to download remote files. Filter as needed based on Developers + requirements. references: - - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 - - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 +- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: analytic_story: - Signed Binary Proxy Execution InstallUtil - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log kill_chain_phases: - Exploitation - Privilege Escalation @@ -48,27 +65,27 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - - Ports.process_guid + - Ports.process_guid - Ports.dest - - Ports.dest_port + - Ports.dest_port security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ performing an uninstall. observable: - name: user type: User @@ -86,4 +103,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 000a3acefbd33b7a5c5714d359aaeab2f6041bec Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 18:38:45 +0000 Subject: [PATCH 10/23] Added detection testing service results inWindows InstallUtil URL in Command Line From 48c0b7d03941181370dde0b774db5647cdec326d Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 18:46:36 +0000 Subject: [PATCH 11/23] Added detection testing service results inWindows InstallUtil Credential Theft --- .../windows_installutil_credential_theft.yml | 58 +++++++++++-------- 1 file changed, 34 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index f3e3d420f7..0cfabc008d 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -6,29 +6,38 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like MimiKatz. \ - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ - - If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ +description: 'The following analytic identifies the Windows InstallUtil.exe binary + loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code + to bypassing application control and capture credentials by utilizing a tool like + MimiKatz. \ - During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -search: '`sysmon` EventCode=7 process_name=installutil.exe - ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, - ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on + the filesystem is typically specified. Take note of the parent process. In a suspicious + instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` + or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line + switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel + processes. Capture any artifacts and review further.' +search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", + "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime + by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer + as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and module loads from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed. + logs with the process name, parent process, and module loads from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Typically this will not trigger as by it's very nature InstallUtil + does not need credentials. Filter as needed. references: - - https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0 +- https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0 tags: analytic_story: - Signed Binary Proxy Execution InstallUtil - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log kill_chain_phases: - Exploitation - Privilege Escalation @@ -43,11 +52,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -55,12 +64,13 @@ tags: security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially + capture credentials in memory. observable: - name: user type: User @@ -78,4 +88,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 24b19946996a1f0761aae70236f33858fc830ab0 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 18:48:07 +0000 Subject: [PATCH 12/23] Added detection testing service results inWindows InstallUtil Remote Network Connection --- ..._installutil_remote_network_connection.yml | 70 +++++++++++-------- 1 file changed, 42 insertions(+), 28 deletions(-) diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index b085b724be..b75481568c 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -6,30 +6,44 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control. \ - - When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ - - If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ +description: 'The following analytic identifies the Windows InstallUtil.exe binary + making a remote network connection. This technique may be used to download and execute + code while bypassing application control. \ - During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port - | `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. + When `InstallUtil.exe` is used in a malicous manner, the path to an executable on + the filesystem is typically specified. Take note of the parent process. In a suspicious + instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` + or `Explorer.exe`. \ + + If used by a developer, typically this will be found with multiple command-line + switches/arguments and spawn from Visual Studio. \ + + During triage review resulting network connections, file modifications, and parallel + processes. Capture any artifacts and review further.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` by _time span=1h Processes.process_guid Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | join process_guid [ | tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid + Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process process_guid + connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. +known_false_positives: Limited false positives should be present as InstallUtil is + not typically used to download remote files. Filter as needed based on Developers + requirements. references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: analytic_story: - Signed Binary Proxy Execution InstallUtil - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log kill_chain_phases: - Exploitation - Privilege Escalation @@ -44,27 +58,27 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - - Ports.process_guid + - Ports.process_guid - Ports.dest - - Ports.dest_port + - Ports.dest_port security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ generating a remote download. observable: - name: user type: User @@ -82,4 +96,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 7f5475ff8bf2fa3e74d53d4651e3858b64c752a7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 Nov 2021 14:17:20 -0700 Subject: [PATCH 13/23] plink --- .../endpoint/plink_remote_forwarding.yml | 75 +++++++++++++++++++ .../endpoint/plink_remote_forwarding.test.yml | 12 +++ 2 files changed, 87 insertions(+) create mode 100644 detections/endpoint/plink_remote_forwarding.yml create mode 100644 tests/endpoint/plink_remote_forwarding.test.yml diff --git a/detections/endpoint/plink_remote_forwarding.yml b/detections/endpoint/plink_remote_forwarding.yml new file mode 100644 index 0000000000..9c237687bf --- /dev/null +++ b/detections/endpoint/plink_remote_forwarding.yml @@ -0,0 +1,75 @@ +name: Plink Remote Forwarding +id: 773e26e4-461a-11ec-a9be-acde48001122 +version: 1 +date: '2021-11-15' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=plink.exe OR Processes.original_file_name="plink") Processes.process IN ("*-D *", "*-L *", "*-R *") OR Processes.process IN ("*-l *","*-pw *") OR Processes.process IN ("*-ssh*", "*-telnet*", "*-rlogin*" "*-raw*", "*-serial*") OR Processes.process IN ("*-T *","*-N *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `plink_remote_forwarding_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited, however filter as needed. +references: + - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ + - https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html + - https://documentation.help/PuTTY/plink-usage.html +tags: + analytic_story: + - Command and Control + - Data Exfiltration + dataset: [] + kill_chain_phases: + - Exploitation + - Exfiltration + mitre_attack_id: + - T1572 + - T1090 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel network communication. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/tests/endpoint/plink_remote_forwarding.test.yml b/tests/endpoint/plink_remote_forwarding.test.yml new file mode 100644 index 0000000000..93df420cd3 --- /dev/null +++ b/tests/endpoint/plink_remote_forwarding.test.yml @@ -0,0 +1,12 @@ +name: Plink Remote Forwarding Unit Test +tests: +- name: Plink Remote Forwarding + file: endpoint/plink_remote_forwarding.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 084e781385b9bb940df057ffea144ae5fb2fe1c6 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 Nov 2021 14:22:39 -0700 Subject: [PATCH 14/23] dcrypt --- .../endpoint/windows_diskcryptor_usage.yml | 72 +++++++++++++++++++ .../windows_diskcryptor_usage.test.yml | 12 ++++ 2 files changed, 84 insertions(+) create mode 100644 detections/endpoint/windows_diskcryptor_usage.yml create mode 100644 tests/endpoint/windows_diskcryptor_usage.test.yml diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml new file mode 100644 index 0000000000..86cc6a3865 --- /dev/null +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -0,0 +1,72 @@ +name: Windows DiskCryptor Usage +id: d56fe0c8-4650-11ec-a8fa-acde48001122 +version: 1 +date: '2021-11-15' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: 'The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver is installed and requires a reboot in order to take effect. There are no command-line arguments used.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name. +references: + - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ + - https://github.com/DavidXanatos/DiskCryptor +tags: + analytic_story: + - Ransomware + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1486 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 50 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + \ No newline at end of file diff --git a/tests/endpoint/windows_diskcryptor_usage.test.yml b/tests/endpoint/windows_diskcryptor_usage.test.yml new file mode 100644 index 0000000000..a8ff02bae9 --- /dev/null +++ b/tests/endpoint/windows_diskcryptor_usage.test.yml @@ -0,0 +1,12 @@ +name: Windows DiskCryptor Usage Unit Test +tests: +- name: Windows DiskCryptor Usage + file: endpoint/windows_diskcryptor_usage.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From ee3e77b45c1b9ea6786d7c9852707d6c00207b82 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 Nov 2021 14:30:14 -0700 Subject: [PATCH 15/23] DefaultAccount --- .../windows_enable_defaultaccount.yml | 73 +++++++++++++++++++ lookups/attacker_tools.csv | 3 +- .../windows_enable_defaultaccount.test.yml | 12 +++ 3 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/windows_enable_defaultaccount.yml create mode 100644 tests/endpoint/windows_enable_defaultaccount.test.yml diff --git a/detections/endpoint/windows_enable_defaultaccount.yml b/detections/endpoint/windows_enable_defaultaccount.yml new file mode 100644 index 0000000000..ebc49d7fa4 --- /dev/null +++ b/detections/endpoint/windows_enable_defaultaccount.yml @@ -0,0 +1,73 @@ +name: Windows Enable DefaultAccount +id: 7fda89f6-4655-11ec-81ff-acde48001122 +version: 1 +date: '2021-11-15' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies the enabling of DefaultAccount by using `net.exe user`. It is a user-neutral account that can be used to run processes that are either multi-user aware or user-agnostic. The DSMA (Default System Managed Account) is disabled by default on the desktop SKUs (full windows SKUs) and WS 2016 with the Desktop. + The DSMA has a well-known RID of 503. The security identifier (SID) of the DSMA will thus have a well-known SID in the following format S-1-5-21--503. Adversaries may enable, set a password, and add the account to groups to obtain remote/local access to the endpoint.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*user*" Processes.process="*DefaultAccount*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `windows_enable_defaultaccount_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: This account is typically not enabled manually by Administrators, however filter as needed. +references: + - https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#defaultaccount + - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ +tags: + analytic_story: + - Account Monitoring and Controls + dataset: [] + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1078 + - T1078.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enabling the DefaultAccount. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/lookups/attacker_tools.csv b/lookups/attacker_tools.csv index 1a579552b6..2f95dfb054 100644 --- a/lookups/attacker_tools.csv +++ b/lookups/attacker_tools.csv @@ -23,4 +23,5 @@ Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits ns.exe,A commonly used tool used by attackers to scan and map file shares -SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts. \ No newline at end of file +SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts. +kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums, to perform network scanning on the internal networks. \ No newline at end of file diff --git a/tests/endpoint/windows_enable_defaultaccount.test.yml b/tests/endpoint/windows_enable_defaultaccount.test.yml new file mode 100644 index 0000000000..ad85ddc36d --- /dev/null +++ b/tests/endpoint/windows_enable_defaultaccount.test.yml @@ -0,0 +1,12 @@ +name: Windows Enable DefaultAccount Unit Test +tests: +- name: Windows Enable DefaultAccount + file: endpoint/windows_enable_defaultaccount.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/defaultaccount/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 8f6fe7cc4526ffaed69e42eddd8f3ac328e4d187 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 22:17:34 +0000 Subject: [PATCH 16/23] Added detection testing service results inWindows DiskCryptor Usage --- .../endpoint/windows_diskcryptor_usage.yml | 47 ++++++++++++------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 86cc6a3865..1786a1c3c5 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -6,22 +6,33 @@ author: Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: 'The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver is installed and requires a reboot in order to take effect. There are no command-line arguments used.' +description: The following analytic identifies DiskCryptor process name of dcrypt.exe + or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt + disks manually during an operation. In addition, during install, a dcrypt.sys driver + is installed and requires a reboot in order to take effect. There are no command-line + arguments used. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name. + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" + OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible false positives may be present based on the + internal name dcinst.exe, filter as needed. It may be worthy to alert on the service + name. references: - - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ - - https://github.com/DavidXanatos/DiskCryptor +- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ +- https://github.com/DavidXanatos/DiskCryptor tags: analytic_story: - Ransomware - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -34,11 +45,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -46,12 +57,12 @@ tags: security_domain: endpoint impact: 70 confidence: 50 - # (impact * confidence)/100 risk_score: 35 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to encrypt disks. observable: - name: user type: User @@ -69,4 +80,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 6e45efbf987099f5154d56d2776773936ac77dfd Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 22:21:33 +0000 Subject: [PATCH 17/23] Added detection testing service results inWindows DiskCryptor Usage --- .../endpoint/windows_diskcryptor_usage.yml | 47 ++++++++++++------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 86cc6a3865..1786a1c3c5 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -6,22 +6,33 @@ author: Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: 'The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver is installed and requires a reboot in order to take effect. There are no command-line arguments used.' +description: The following analytic identifies DiskCryptor process name of dcrypt.exe + or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt + disks manually during an operation. In addition, during install, a dcrypt.sys driver + is installed and requires a reboot in order to take effect. There are no command-line + arguments used. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name. + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" + OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible false positives may be present based on the + internal name dcinst.exe, filter as needed. It may be worthy to alert on the service + name. references: - - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ - - https://github.com/DavidXanatos/DiskCryptor +- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ +- https://github.com/DavidXanatos/DiskCryptor tags: analytic_story: - Ransomware - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -34,11 +45,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -46,12 +57,12 @@ tags: security_domain: endpoint impact: 70 confidence: 50 - # (impact * confidence)/100 risk_score: 35 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to encrypt disks. observable: - name: user type: User @@ -69,4 +80,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 76b92849a35093ba1d087406f0639fb4c268c420 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 15 Nov 2021 22:23:15 +0000 Subject: [PATCH 18/23] Added detection testing service results inWindows DiskCryptor Usage --- .../endpoint/windows_diskcryptor_usage.yml | 47 ++++++++++++------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 86cc6a3865..1786a1c3c5 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -6,22 +6,33 @@ author: Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: 'The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver is installed and requires a reboot in order to take effect. There are no command-line arguments used.' +description: The following analytic identifies DiskCryptor process name of dcrypt.exe + or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt + disks manually during an operation. In addition, during install, a dcrypt.sys driver + is installed and requires a reboot in order to take effect. There are no command-line + arguments used. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name. + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" + OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: It is possible false positives may be present based on the + internal name dcinst.exe, filter as needed. It may be worthy to alert on the service + name. references: - - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ - - https://github.com/DavidXanatos/DiskCryptor +- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ +- https://github.com/DavidXanatos/DiskCryptor tags: analytic_story: - Ransomware - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -34,11 +45,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -46,12 +57,12 @@ tags: security_domain: endpoint impact: 70 confidence: 50 - # (impact * confidence)/100 risk_score: 35 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to encrypt disks. observable: - name: user type: User @@ -69,4 +80,4 @@ tags: type: Process role: - Child Process - \ No newline at end of file + automated_detection_testing: passed From 66ba3885da2d4840f699134e832a7526475fb39c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 16 Nov 2021 07:49:37 -0700 Subject: [PATCH 19/23] spacing --- detections/endpoint/plink_remote_forwarding.yml | 3 ++- detections/endpoint/windows_enable_defaultaccount.yml | 7 ++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/plink_remote_forwarding.yml b/detections/endpoint/plink_remote_forwarding.yml index 9c237687bf..9587b12b0f 100644 --- a/detections/endpoint/plink_remote_forwarding.yml +++ b/detections/endpoint/plink_remote_forwarding.yml @@ -12,7 +12,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `plink_remote_forwarding_filter`' + | `security_content_ctime(lastTime)` + | `plink_remote_forwarding_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: False positives should be limited, however filter as needed. references: diff --git a/detections/endpoint/windows_enable_defaultaccount.yml b/detections/endpoint/windows_enable_defaultaccount.yml index ebc49d7fa4..0dc191b155 100644 --- a/detections/endpoint/windows_enable_defaultaccount.yml +++ b/detections/endpoint/windows_enable_defaultaccount.yml @@ -11,9 +11,10 @@ description: 'The following analytic identifies the enabling of DefaultAccount b search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*user*" Processes.process="*DefaultAccount*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` | `windows_enable_defaultaccount_filter`' + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_enable_defaultaccount_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: This account is typically not enabled manually by Administrators, however filter as needed. references: From a915e562926f3afe5b2238dcf651391c64ff0bae Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 16 Nov 2021 09:38:19 -0700 Subject: [PATCH 20/23] rebuilt --- detections/endpoint/plink_remote_forwarding.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/plink_remote_forwarding.yml b/detections/endpoint/plink_remote_forwarding.yml index 9587b12b0f..dd59d62e49 100644 --- a/detections/endpoint/plink_remote_forwarding.yml +++ b/detections/endpoint/plink_remote_forwarding.yml @@ -1,18 +1,18 @@ name: Plink Remote Forwarding -id: 773e26e4-461a-11ec-a9be-acde48001122 +id: 547710a8-46fb-11ec-a3a1-acde48001122 version: 1 -date: '2021-11-15' +date: '2021-11-16' author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination. +description: 'The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=plink.exe OR Processes.original_file_name="plink") Processes.process IN ("*-D *", "*-L *", "*-R *") OR Processes.process IN ("*-l *","*-pw *") OR Processes.process IN ("*-ssh*", "*-telnet*", "*-rlogin*" "*-raw*", "*-serial*") OR Processes.process IN ("*-T *","*-N *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `plink_remote_forwarding_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: False positives should be limited, however filter as needed. From 6eb9d23776c6777aa1eb63d22557cae61a765288 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 17 Nov 2021 07:39:18 -0700 Subject: [PATCH 21/23] Update windows_enable_defaultaccount.yml --- detections/endpoint/windows_enable_defaultaccount.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_enable_defaultaccount.yml b/detections/endpoint/windows_enable_defaultaccount.yml index 0dc191b155..7f8e310817 100644 --- a/detections/endpoint/windows_enable_defaultaccount.yml +++ b/detections/endpoint/windows_enable_defaultaccount.yml @@ -9,11 +9,11 @@ datamodel: description: 'The following analytic identifies the enabling of DefaultAccount by using `net.exe user`. It is a user-neutral account that can be used to run processes that are either multi-user aware or user-agnostic. The DSMA (Default System Managed Account) is disabled by default on the desktop SKUs (full windows SKUs) and WS 2016 with the Desktop. The DSMA has a well-known RID of 503. The security identifier (SID) of the DSMA will thus have a well-known SID in the following format S-1-5-21--503. Adversaries may enable, set a password, and add the account to groups to obtain remote/local access to the endpoint.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*user*" Processes.process="*DefaultAccount*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*user*" AND Processes.process="*DefaultAccount*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `windows_enable_defaultaccount_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: This account is typically not enabled manually by Administrators, however filter as needed. From 18ad17726e53333485a645c47550230376c9e663 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 17 Nov 2021 12:01:58 -0700 Subject: [PATCH 22/23] Update windows_enable_defaultaccount.yml --- detections/endpoint/windows_enable_defaultaccount.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_enable_defaultaccount.yml b/detections/endpoint/windows_enable_defaultaccount.yml index 7f8e310817..d5a0da07e8 100644 --- a/detections/endpoint/windows_enable_defaultaccount.yml +++ b/detections/endpoint/windows_enable_defaultaccount.yml @@ -11,9 +11,9 @@ description: 'The following analytic identifies the enabling of DefaultAccount b search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*user*" AND Processes.process="*DefaultAccount*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_enable_defaultaccount_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: This account is typically not enabled manually by Administrators, however filter as needed. From 7ba2d8d41214fe21b33dede117ff16662c9b408e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 17 Nov 2021 14:47:49 -0700 Subject: [PATCH 23/23] removed --- .../endpoint/plink_remote_forwarding.yml | 76 ------------------- .../windows_enable_defaultaccount.yml | 74 ------------------ .../endpoint/plink_remote_forwarding.test.yml | 12 --- .../windows_enable_defaultaccount.test.yml | 12 --- 4 files changed, 174 deletions(-) delete mode 100644 detections/endpoint/plink_remote_forwarding.yml delete mode 100644 detections/endpoint/windows_enable_defaultaccount.yml delete mode 100644 tests/endpoint/plink_remote_forwarding.test.yml delete mode 100644 tests/endpoint/windows_enable_defaultaccount.test.yml diff --git a/detections/endpoint/plink_remote_forwarding.yml b/detections/endpoint/plink_remote_forwarding.yml deleted file mode 100644 index dd59d62e49..0000000000 --- a/detections/endpoint/plink_remote_forwarding.yml +++ /dev/null @@ -1,76 +0,0 @@ -name: Plink Remote Forwarding -id: 547710a8-46fb-11ec-a3a1-acde48001122 -version: 1 -date: '2021-11-16' -author: Michael Haag, Splunk -type: TTP -datamodel: -- Endpoint -description: 'The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=plink.exe OR Processes.original_file_name="plink") Processes.process IN ("*-D *", "*-L *", "*-R *") OR Processes.process IN ("*-l *","*-pw *") OR Processes.process IN ("*-ssh*", "*-telnet*", "*-rlogin*" "*-raw*", "*-serial*") OR Processes.process IN ("*-T *","*-N *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `plink_remote_forwarding_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited, however filter as needed. -references: - - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ - - https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html - - https://documentation.help/PuTTY/plink-usage.html -tags: - analytic_story: - - Command and Control - - Data Exfiltration - dataset: [] - kill_chain_phases: - - Exploitation - - Exfiltration - mitre_attack_id: - - T1572 - - T1090 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel network communication. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file diff --git a/detections/endpoint/windows_enable_defaultaccount.yml b/detections/endpoint/windows_enable_defaultaccount.yml deleted file mode 100644 index d5a0da07e8..0000000000 --- a/detections/endpoint/windows_enable_defaultaccount.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Windows Enable DefaultAccount -id: 7fda89f6-4655-11ec-81ff-acde48001122 -version: 1 -date: '2021-11-15' -author: Michael Haag, Splunk -type: TTP -datamodel: -- Endpoint -description: 'The following analytic identifies the enabling of DefaultAccount by using `net.exe user`. It is a user-neutral account that can be used to run processes that are either multi-user aware or user-agnostic. The DSMA (Default System Managed Account) is disabled by default on the desktop SKUs (full windows SKUs) and WS 2016 with the Desktop. - The DSMA has a well-known RID of 503. The security identifier (SID) of the DSMA will thus have a well-known SID in the following format S-1-5-21--503. Adversaries may enable, set a password, and add the account to groups to obtain remote/local access to the endpoint.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*user*" AND Processes.process="*DefaultAccount*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_enable_defaultaccount_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: This account is typically not enabled manually by Administrators, however filter as needed. -references: - - https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#defaultaccount - - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ -tags: - analytic_story: - - Account Monitoring and Controls - dataset: [] - kill_chain_phases: - - Privilege Escalation - mitre_attack_id: - - T1078 - - T1078.003 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Persistence - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enabling the DefaultAccount. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file diff --git a/tests/endpoint/plink_remote_forwarding.test.yml b/tests/endpoint/plink_remote_forwarding.test.yml deleted file mode 100644 index 93df420cd3..0000000000 --- a/tests/endpoint/plink_remote_forwarding.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Plink Remote Forwarding Unit Test -tests: -- name: Plink Remote Forwarding - file: endpoint/plink_remote_forwarding.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_enable_defaultaccount.test.yml b/tests/endpoint/windows_enable_defaultaccount.test.yml deleted file mode 100644 index ad85ddc36d..0000000000 --- a/tests/endpoint/windows_enable_defaultaccount.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Enable DefaultAccount Unit Test -tests: -- name: Windows Enable DefaultAccount - file: endpoint/windows_enable_defaultaccount.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/defaultaccount/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file