Merge pull request #2043 from splunk/hermetic_wiper

hermetic_wiper

detections/endpoint/windows_file_without_extension_in_critical_folder.yml

@@ -0,0 +1,80 @@
+name: Windows File Without Extension In Critical Folder
+id: 0dbcac64-963c-11ec-bf04-acde48001122
+version: 1
+date: '2022-02-25'
+author: Teoderick Contreras, Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. 
+  This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) 
+  and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive 
+  malware that wipes the boot sector of the system.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") 
+  by _time span=5m Filesystem.dest Filesystem.user
+  Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.file_create_time 
+  | `drop_dm_object_name(Filesystem)` 
+  | rex field="file_name" "\.(?<extension>[^\.]*$)" 
+  | where isnull(extension)
+  | join process_guid 
+  [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+      by _time span=5m Processes.process_name Processes.dest Processes.process_guid
+      Processes.user 
+  | `drop_dm_object_name(Processes)`] 
+  | stats count min(_time) as firstTime max(_time)
+  as lastTime by dest process_name process_guid file_name file_path file_create_time user 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_file_without_extension_in_critical_folder_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: Unknown at this point
+references:
+-  https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+tags:
+  analytic_story:
+  - Data Destruction
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1485
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time 
+  - Filesystem.process_id 
+  - Filesystem.file_name 
+  - Filesystem.user 
+  - Filesystem.file_path 
+  - Filesystem.dest
+  - Processes.process_name 
+  - Processes.dest 
+  - Processes.process_guid
+  - Processes.user 
+  security_domain: endpoint
+  impact: 90
+  confidence: 100 
+  # (impact * confidence)/100
+  risk_score: 90
+  context: 
+  - Source:Endpoint
+  - Stage:Persistence
+  - Privilege Escalation
+  message: Driver file with out file extension drop in $file_path$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/windows_raw_access_to_disk_volume_partition.yml

@@ -0,0 +1,68 @@
+name: Windows Raw Access To Disk Volume Partition
+id: a85aa37e-9647-11ec-90c5-acde48001122
+version: 1
+date: '2022-02-25'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious raw access read to device disk partition of the host machine.
+  This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the boot sector of each partition  
+  as part of their impact payload for example the "hermeticwiper" malware. 
+  This detection is a good indicator that there is a process try to read or write on boot sector.
+search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image Device ProcessGuid ProcessId EventDescription EventCode Computer 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_raw_access_to_disk_volume_partition_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: This event is really notable but we found minimal number of normal application from system32 folder like 
+  svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
+references:
+-  https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+tags:
+  analytic_story:
+  - Data Destruction
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1561.002
+  - T1561
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer 
+  - Image 
+  - Device 
+  - ProcessGuid 
+  - ProcessId 
+  - EventDescription 
+  - EventCode
+  security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context: 
+  - Source:Endpoint
+  - Stage:Impact
+  message: Process accessing disk partition $device$ in $dest$
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

tests/endpoint/windows_file_without_extension_in_critical_folder.test.yml

@@ -0,0 +1,12 @@
+name: Windows File Without Extension In Critical Folder Unit Test
+tests:
+- name: Windows File Without Extension In Critical Folder
+  file: endpoint/windows_file_without_extension_in_critical_folder.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_raw_access_to_disk_volume_partition.test.yml

@@ -0,0 +1,12 @@
+name: Windows Raw Access To Disk Volume Partition Unit Test
+tests:
+- name: Windows Raw Access To Disk Volume Partition
+  file: endpoint/windows_raw_access_to_disk_volume_partition.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog