diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml new file mode 100644 index 0000000000..fc6c5ac56a --- /dev/null +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -0,0 +1,47 @@ +name: AWS IAM AccessDenied Discovery Events +id: 3e1f1568-9633-11eb-a69c-acde48001122 +version: 1 +date: '2021-04-05' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following detection identifies excessive AccessDenied events within + an hour timeframe. It is possible that an access key to AWS may have been stolen + and is being misused to perform discovery events. In these instances, the access + is not available with the key stolen therefore these events will be generated. +search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) + | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) + as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) + by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources + >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `aws_iam_accessdenied_discovery_events_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: It is possible to start this detection will need to be tuned + by source IP or user. In addition, change the count values to an upper threshold + to restrict false positives. +references: +- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ +tags: + analytic_story: + - Suspicious Cloud User Activities + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1580 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - eventSource + - userAgent + - errorCode + - userIdentity.type + security_domain: access + automated_detection_testing: passed diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml new file mode 100644 index 0000000000..103b328646 --- /dev/null +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -0,0 +1,49 @@ +name: AWS IAM Assume Role Policy Brute Force +id: f19e09b0-9308-11eb-b7ec-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following detection identifies any malformed policy document exceptions + with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify + a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing. +search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure + (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as + lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource + aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion + userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. Set the `where count` greater + than a value to identify suspicious activity in your environment. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. +references: +- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities +- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ +- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html +tags: + analytic_story: + - AWS IAM Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1580 + - T1110 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.policyName + security_domain: access + automated_detection_testing: passed diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml new file mode 100644 index 0000000000..3321a6f6bb --- /dev/null +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -0,0 +1,49 @@ +name: AWS IAM Delete Policy +id: ec3a9362-92fe-11eb-99d0-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following detection identifes when a policy is deleted on AWS. This + does not identify whether successful or failed, but the error messages tell a story + of suspicious attempts. There is a specific process to follow when deleting a policy. + First, detach the policy from all users, groups, and roles that the policy is attached + to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy. +search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats + count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) + as policyArn by src eventName eventSource aws_account_id errorCode errorMessage + userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. Not every user with AWS access should have permission to + delete policies (least privilege). In addition, this may be saved seperately and + tuned for failed or success attempts only. +references: +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html +- https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html +tags: + analytic_story: + - AWS IAM Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1098 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.policyArn + security_domain: access + automated_detection_testing: passed diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml new file mode 100644 index 0000000000..e07daaf11c --- /dev/null +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -0,0 +1,49 @@ +name: AWS IAM Failure Group Deletion +id: 723b861a-92eb-11eb-93b8-acde48001122 +version: 1 +date: '2021-04-01' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: This detection identifies failure attempts to delete groups. We want to identify + when a group is attempting to be deleted, but either access is denied, there is + a conflict or there is no group. This is indicative of administrators performing + an action, but also could be suspicious behavior occurring. Review parallel IAM + events - recently added users, new groups and so forth. +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode + IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com) + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName) + as group_name by src eventName eventSource aws_account_id errorCode errorMessage + userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. Not every user with AWS access should have permission to + delete groups (least privilege). +references: +- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html +tags: + analytic_story: + - AWS IAM Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1098 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.groupName + security_domain: identity + automated_detection_testing: passed diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml new file mode 100644 index 0000000000..e1461bb777 --- /dev/null +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -0,0 +1,48 @@ +name: AWS IAM Successful Group Deletion +id: e776d06c-9267-11eb-819b-acde48001122 +version: 1 +date: '2021-03-31' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following query uses IAM events to track the success of a group being + deleted on AWS. This is typically not indicative of malicious behavior, but a precurser + to additional events thay may unfold. Review parallel IAM events - recently added + users, new groups and so forth. Inversely, review failed attempts in a similar manner. +search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success + (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as + lastTime values(requestParameters.groupName) by src eventName eventSource errorCode + user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`' +how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize + this data. The search requires AWS Cloudtrail logs. +known_false_positives: This detection will require tuning to provide high fidelity + detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) + or by groups of users. Not every user with AWS access should have permission to + delete groups (least privilege). +references: +- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html +- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html +tags: + analytic_story: + - AWS IAM Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1069.003 + - T1098 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Splunk Security Analytics for AWS + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.groupName + security_domain: identity + automated_detection_testing: passed diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml new file mode 100644 index 0000000000..f0704f8f1e --- /dev/null +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -0,0 +1,54 @@ +name: DLLHost with no Command Line Arguments with Network +id: f1c07594-a141-11eb-8407-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies DLLHost.exe with no command line arguments + with a network connection. It is unusual for DLLHost.exe to execute with no command + line arguments present. This particular behavior is common with malicious software, + including Cobalt Strike. During investigation, triage any network connections and + parallel processes. Identify any suspicious module loads related to credential dumping + or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id + Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process process_id + connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. +known_false_positives: Although unlikely, some legitimate third party applications + may use a moved copy of dllhost, triggering a false positive. +references: +- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +tags: + analytic_story: + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml new file mode 100644 index 0000000000..5c4cbf45b5 --- /dev/null +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -0,0 +1,52 @@ +name: Excel Spawning PowerShell +id: 42d40a22-9be3-11eb-8f08-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Excel spawning PowerShell. + Typically, this is not common behavior and not default with Excel.exe. Excel.exe + will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` + (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing + attachment and is actively used. Albeit, the command executed will most likely be + encoded and captured via another detection. During triage, review parallel processes + and identify any files that may have been written. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe", + "pwsh.exe") by Processes.parent_process Processes.process_name Processes.user Processes.dest + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `excel_spawning_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://redcanary.com/threat-detection-report/techniques/powershell/ +- https://attack.mitre.org/techniques/T1566/001/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml new file mode 100644 index 0000000000..ece7424791 --- /dev/null +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -0,0 +1,56 @@ +name: Excel Spawning Windows Script Host +id: 57fe880a-9be3-11eb-9bf3-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Excel spawning Windows Script + Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and + not default with Excel.exe. Excel.exe will generally be found in the following path + `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` + or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. + `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing + attachment and is actively used. Albeit, the command-line executed will most likely + be obfuscated and captured via another detection. During triage, review parallel + processes and identify any files that may have been written. Review the reputation + of the remote destination and block accordingly. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe", + "wscript.exe") by Processes.parent_process Processes.process_name Processes.user + Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `excel_spawning_windows_script_host_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. In some instances, `cscript.exe` is used for legitimate business + practices. +references: +- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/ +- https://attack.mitre.org/techniques/T1566/001/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml new file mode 100644 index 0000000000..202fe2959e --- /dev/null +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -0,0 +1,55 @@ +name: GPUpdate with no Command Line Arguments with Network +id: 2c853856-a140-11eb-a5b5-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies gpupdate.exe with no command line arguments + and with a network connection. It is unusual for gpupdate.exe to execute with no + command line arguments present. This particular behavior is common with malicious + software, including Cobalt Strike. During investigation, triage any network connections + and parallel processes. Identify any suspicious module loads related to credential + dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and + C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(gpupdate\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id + Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC + dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: +- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +tags: + analytic_story: + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 18f6283ebc..a7942cf80e 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -28,7 +28,7 @@ references: - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index e19c0b7cb7..35e8c79559 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -34,7 +34,7 @@ references: - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index da2b5c9f3d..cd5b8965c2 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -27,7 +27,7 @@ references: - https://www.joesandbox.com/analysis/386500/0/html tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index b76f07bf38..e6b0c896b5 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -26,7 +26,7 @@ references: - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/# tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml new file mode 100644 index 0000000000..e5872af928 --- /dev/null +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -0,0 +1,57 @@ +name: Office Product Spawning Rundll32 with no DLL +id: c661f6be-a38c-11eb-be57-acde48001122 +version: 1 +date: '2021-04-22' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies the latest behavior utilized by IcedID + malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` + without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` + will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat + Research has released a detection identifying the use of `DllRegisterServer` on + the command-line of `rundll32.exe`. In this instance, we narrow our detection down + to the Office suite as a parent process. During triage, review all file modifications. + Capture and analyze the `DLL` that was dropped to disk. The Office Product will + have reached out to a remote destination, capture and block the IPs or domain. Review + additional parallel processes for further activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=rundll32.exe + (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `office_product_spawning_rundll32_with_no_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://www.joesandbox.com/analysis/395471/0/html +- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ +- https://any.run/malware-trends/icedid +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index bd62631195..1ac2e4fbcf 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -30,7 +30,7 @@ references: - https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml new file mode 100644 index 0000000000..d1a9416df2 --- /dev/null +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -0,0 +1,58 @@ +name: Rundll32 with no Command Line Arguments with Network +id: 35307032-a12d-11eb-835f-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies rundll32.exe with no command line arguments + and performing a network connection. It is unusual for rundll32.exe to execute with + no command line arguments present. This particular behavior is common with malicious + software, including Cobalt Strike. During investigation, triage any network connections + and parallel processes. Identify any suspicious module loads related to credential + dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and + C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=rundll32.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(rundll32\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id + Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] + | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC + dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. +known_false_positives: Although unlikely, some legitimate applications may use a moved + copy of rundll32, triggering a false positive. +references: +- https://attack.mitre.org/techniques/T1218/011/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +- https://lolbas-project.github.io/lolbas/Binaries/Rundll32 +- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ +tags: + analytic_story: + - Suspicious Rundll32 Activity + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml new file mode 100644 index 0000000000..7f033adf73 --- /dev/null +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -0,0 +1,53 @@ +name: SearchProtocolHost with no Command Line with Network +id: b690df8c-a145-11eb-a38b-acde48001122 +version: 1 +date: '2021-04-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies searchprotocolhost.exe with no command + line arguments and with a network connection. It is unusual for searchprotocolhost.exe + to execute with no command line arguments present. This particular behavior is common + with malicious software, including Cobalt Strike. During investigation, identify + any network connections and parallel processes. Identify any suspicious module loads + related to credential dumping or file writes. searchprotocolhost.exe is natively + found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id + Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats + `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port + !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name + process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: +- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc +tags: + analytic_story: + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml new file mode 100644 index 0000000000..cf38cd77e5 --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -0,0 +1,66 @@ +name: WinEvent Scheduled Task Created to Spawn Shell +id: 203ef0ea-9bd8-11eb-8201-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with a command to be executed with a native Windows + shell (PowerShell, Cmd, Wscript, Cscript).\ + + The search will return the first time and last time the task was registered, as + well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ + + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it is possible a scheduled task is being registered + within that process context in memory.\ + + Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? + Review the job created and the Command to be executed. Capture any artifacts on + disk and review. Identify any parallel processes within the same timeframe to identify + source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN + ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", + "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count + min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, + Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `winevent_scheduled_task_created_to_spawn_shell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: False positives are possible if legitimate applications are + allowed to register tasks that call a shell to be spawned. Filter as needed based + on command-line or processes that are used legitimately. +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN +tags: + analytic_story: + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Description + - Command + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml new file mode 100644 index 0000000000..761ff77e10 --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -0,0 +1,66 @@ +name: WinEvent Scheduled Task Created Within Public Path +id: 5d9c6eee-988c-11eb-8253-acde48001122 +version: 1 +date: '2021-04-08' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled + task was created`, to identify suspicious tasks registered on Windows either via + schtasks.exe OR TaskService with a command to be executed from a user writeable + file path.\ + + The search will return the first time and last time the task was registered, as + well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether + it is `Hidden` or not.\ + + schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ + + The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. + If found loaded by another process, it is possible a scheduled task is being registered + within that process context in memory.\ + + Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via + TaskService. Review the job created and the Command to be executed. Capture any + artifacts on disk and review. Identify any parallel processes within the same timeframe + to identify source.' +search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN + ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", + "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by + dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also + required. +known_false_positives: False positives are possible if legitimate applications are + allowed to register tasks in public paths. Filter as needed based on paths that + are used legitimately. +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698 +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN +- https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/ +tags: + analytic_story: + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - Task_Name + - Description + - Command + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml new file mode 100644 index 0000000000..87fd2c182c --- /dev/null +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -0,0 +1,52 @@ +name: Winword Spawning Cmd +id: 6fcbaedc-a37b-11eb-956b-acde48001122 +version: 1 +date: '2021-04-22' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Word spawning `cmd.exe`. + Typically, this is not common behavior and not default with winword.exe. Winword.exe + will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` + (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing + attachment and is actively used. Albeit, the command-line will indicate what is + being executed. During triage, review parallel processes and identify any files + that may have been written. It is possible that COM is utilized to trampoline the + child process to `explorer.exe` or `wmiprvse.exe`. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winword.exe + Processes.process_name=cmd.exe by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `winword_spawning_cmd_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml new file mode 100644 index 0000000000..938e19c154 --- /dev/null +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -0,0 +1,54 @@ +name: Winword Spawning PowerShell +id: b2c950b8-9be2-11eb-8658-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Word spawning PowerShell. + Typically, this is not common behavior and not default with winword.exe. Winword.exe + will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` + (version will vary). PowerShell spawning from winword.exe is common for a spearphishing + attachment and is actively used. Albeit, the command executed will most likely be + encoded and captured via another detection. During triage, review parallel processes + and identify any files that may have been written. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" + Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://redcanary.com/threat-detection-report/techniques/powershell/ +- https://attack.mitre.org/techniques/T1566/001/ +- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/ +- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml new file mode 100644 index 0000000000..fcfd73ff5b --- /dev/null +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -0,0 +1,54 @@ +name: Winword Spawning Windows Script Host +id: 637e1b5c-9be1-11eb-9c32-acde48001122 +version: 1 +date: '2021-04-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Microsoft Winword.exe spawning Windows + Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior + and not default with Winword.exe. Winword.exe will generally be found in the following + path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` + or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. + `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing + attachment and is actively used. Albeit, the command-line executed will most likely + be obfuscated and captured via another detection. During triage, review parallel + processes and identify any files that may have been written. Review the reputation + of the remote destination and block accordingly. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" + Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: There will be limited false positives and it will be different + for every environment. Tune by child process or command-line as needed. +references: +- https://attack.mitre.org/techniques/T1566/001/ +tags: + analytic_story: + - Spearphishing Attachment + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml similarity index 94% rename from detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml rename to detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 546b1ca211..6ae32a93c3 100644 --- a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml +++ b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -1,4 +1,4 @@ -name: Detect Oulook exe writing a zip file +name: Detect Outlook exe writing a zip file id: a51bfe1a-94f0-4822-b1e4-16ae10145893 version: 3 date: '2020-07-21' @@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max( | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path | where file_name - != "" | `detect_oulook_exe_writing_a__zip_file_filter` ' + != "" | `detect_outlook_exe_writing_a_zip_file_filter` ' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data @@ -32,7 +32,7 @@ known_false_positives: It is not uncommon for outlook to write legitimate zip fi references: [] tags: analytic_story: - - Phishing Payloads + - Spearphishing Attachments asset_type: Endpoint cis20: - CIS 7 diff --git a/stories/phishing_payloads.yml b/stories/spearphishing_attachments.yml similarity index 97% rename from stories/phishing_payloads.yml rename to stories/spearphishing_attachments.yml index bb02015adf..ee7ef3b1bc 100644 --- a/stories/phishing_payloads.yml +++ b/stories/spearphishing_attachments.yml @@ -1,4 +1,4 @@ -name: Phishing Payloads +name: Spearphishing Attachments id: 57226b40-94f3-4ce5-b101-a75f67759c27 version: 1 date: '2019-04-29' @@ -46,7 +46,7 @@ narrative: 'Despite its simplicity, phishing remains the most pervasive and dang references: - https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html tags: - analytic_story: Phishing Payloads + analytic_story: Spearphishing Attachments category: - Adversary Tactics product: diff --git a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml new file mode 100644 index 0000000000..2425d8e763 --- /dev/null +++ b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml @@ -0,0 +1,13 @@ +name: AWS IAM AccessDenied Discovery Events Unit Test +tests: +- name: AWS IAM AccessDenied Discovery Events + file: cloud/aws_iam_accessdenied_discovery_events.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_iam_accessdenied_discovery_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml new file mode 100644 index 0000000000..72dfdb5b50 --- /dev/null +++ b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml @@ -0,0 +1,13 @@ +name: AWS IAM Assume Role Policy Brute Force Unit Test +tests: +- name: AWS IAM Assume Role Policy Brute Force + file: cloud/aws_iam_assume_role_policy_brute_force.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_iam_assume_role_policy_brute_force.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_delete_policy.test.yml b/tests/cloud/aws_iam_delete_policy.test.yml new file mode 100644 index 0000000000..a76ae42664 --- /dev/null +++ b/tests/cloud/aws_iam_delete_policy.test.yml @@ -0,0 +1,13 @@ +name: AWS IAM Delete Policy Unit Test +tests: +- name: AWS IAM Delete Policy + file: cloud/aws_iam_delete_policy.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_iam_delete_policy.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_failure_group_deletion.test.yml b/tests/cloud/aws_iam_failure_group_deletion.test.yml new file mode 100644 index 0000000000..83f02e7dd3 --- /dev/null +++ b/tests/cloud/aws_iam_failure_group_deletion.test.yml @@ -0,0 +1,13 @@ +name: AWS IAM Failure Group Deletion Unit Test +tests: +- name: AWS IAM Failure Group Deletion + file: cloud/aws_iam_failure_group_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_iam_delete_policy.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_iam_successful_group_deletion.test.yml b/tests/cloud/aws_iam_successful_group_deletion.test.yml new file mode 100644 index 0000000000..76767a7f16 --- /dev/null +++ b/tests/cloud/aws_iam_successful_group_deletion.test.yml @@ -0,0 +1,13 @@ +name: AWS IAM Successful Group Deletion Unit Test +tests: +- name: AWS IAM Successful Group Deletion + file: cloud/aws_iam_successful_group_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_iam_successful_group_deletion.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml new file mode 100644 index 0000000000..bcd7fb2a54 --- /dev/null +++ b/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml @@ -0,0 +1,12 @@ +name: DLLHost with no Command Line Arguments with Network Unit Test +tests: +- name: DLLHost with no Command Line Arguments with Network + file: endpoint/dllhost_with_no_command_line_arguments_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excel_spawning_powershell.test.yml b/tests/endpoint/excel_spawning_powershell.test.yml new file mode 100644 index 0000000000..c727cd2f58 --- /dev/null +++ b/tests/endpoint/excel_spawning_powershell.test.yml @@ -0,0 +1,12 @@ +name: Excel Spawning PowerShell Unit Test +tests: +- name: Excel Spawning PowerShell + file: endpoint/excel_spawning_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/excel_spawning_windows_script_host.test.yml b/tests/endpoint/excel_spawning_windows_script_host.test.yml new file mode 100644 index 0000000000..9f3e80bd51 --- /dev/null +++ b/tests/endpoint/excel_spawning_windows_script_host.test.yml @@ -0,0 +1,12 @@ +name: Excel Spawning Windows Script Host Unit Test +tests: +- name: Excel Spawning Windows Script Host + file: endpoint/excel_spawning_windows_script_host.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/gpupdate_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/gpupdate_with_no_command_line_arguments_with_network.test.yml new file mode 100644 index 0000000000..71325e2495 --- /dev/null +++ b/tests/endpoint/gpupdate_with_no_command_line_arguments_with_network.test.yml @@ -0,0 +1,12 @@ +name: GPUpdate with no Command Line Arguments with Network Unit Test +tests: +- name: GPUpdate with no Command Line Arguments with Network + file: endpoint/gpupdate_with_no_command_line_arguments_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml b/tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml new file mode 100644 index 0000000000..bd2950c9c2 --- /dev/null +++ b/tests/endpoint/office_product_spawning_rundll32_with_no_dll.test.yml @@ -0,0 +1,12 @@ +name: Office Product Spawning Rundll32 with no DLL Unit Test +tests: +- name: Office Product Spawning Rundll32 with no DLL + file: endpoint/office_product_spawning_rundll32_with_no_dll.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_icedid.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml b/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml new file mode 100644 index 0000000000..bc148862c9 --- /dev/null +++ b/tests/endpoint/rundll32_with_no_command_line_arguments_with_network.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 with no Command Line Arguments with Network Unit Test +tests: +- name: Rundll32 with no Command Line Arguments with Network + file: endpoint/rundll32_with_no_command_line_arguments_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml b/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml new file mode 100644 index 0000000000..f585781bed --- /dev/null +++ b/tests/endpoint/searchprotocolhost_with_no_command_line_with_network.test.yml @@ -0,0 +1,12 @@ +name: SearchProtocolHost with no Command Line with Network Unit Test +tests: +- name: SearchProtocolHost with no Command Line with Network + file: endpoint/searchprotocolhost_with_no_command_line_with_network.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml new file mode 100644 index 0000000000..316980bb0d --- /dev/null +++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml @@ -0,0 +1,13 @@ +name: WinEvent Scheduled Task Created to Spawn Shell Unit Test +tests: +- name: WinEvent Scheduled Task Created to Spawn Shell + file: endpoint/winevent_scheduled_task_created_to_spawn_shell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml new file mode 100644 index 0000000000..8bbd7f609d --- /dev/null +++ b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml @@ -0,0 +1,13 @@ +name: WinEvent Scheduled Task Created Within Public Path Unit Test +tests: +- name: WinEvent Scheduled Task Created Within Public Path + file: endpoint/winevent_scheduled_task_created_within_public_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/winword_spawning_cmd.test.yml b/tests/endpoint/winword_spawning_cmd.test.yml new file mode 100644 index 0000000000..d4690cf41c --- /dev/null +++ b/tests/endpoint/winword_spawning_cmd.test.yml @@ -0,0 +1,12 @@ +name: Winword Spawning Cmd Unit Test +tests: +- name: Winword Spawning Cmd + file: endpoint/winword_spawning_cmd.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/winword_spawning_powershell.test.yml b/tests/endpoint/winword_spawning_powershell.test.yml new file mode 100644 index 0000000000..db6526a36f --- /dev/null +++ b/tests/endpoint/winword_spawning_powershell.test.yml @@ -0,0 +1,12 @@ +name: Winword Spawning PowerShell Unit Test +tests: +- name: Winword Spawning PowerShell + file: endpoint/winword_spawning_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/winword_spawning_windows_script_host.test.yml b/tests/endpoint/winword_spawning_windows_script_host.test.yml new file mode 100644 index 0000000000..0739cfebc7 --- /dev/null +++ b/tests/endpoint/winword_spawning_windows_script_host.test.yml @@ -0,0 +1,12 @@ +name: Winword Spawning Windows Script Host Unit Test +tests: +- name: Winword Spawning Windows Script Host + file: endpoint/winword_spawning_windows_script_host.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog