From 6bee5b4a60d40e9faa13406febe9f78442bc2764 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 25 Feb 2022 15:00:42 +0100 Subject: [PATCH 1/5] hermetic_wiper --- ...e_without_extension_in_critical_folder.yml | 69 +++++++++++++++++++ ...hout_extension_in_critical_folder.test.yml | 12 ++++ 2 files changed, 81 insertions(+) create mode 100644 detections/endpoint/windows_file_without_extension_in_critical_folder.yml create mode 100644 tests/endpoint/windows_file_without_extension_in_critical_folder.test.yml diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml new file mode 100644 index 0000000000..e79ee8c115 --- /dev/null +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -0,0 +1,69 @@ +name: Windows File Without Extension In Critical Folder +id: 0dbcac64-963c-11ec-bf04-acde48001122 +version: 1 +date: '2022-02-25' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to look for suspicious file creation in Critical folder like "System32\Drivers" folder without file extension. + This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) + and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive + malware that wipes the boot sector of the system. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.dest + | `drop_dm_object_name(Filesystem)` + | rex field="file_name" "\.(?[^\.]*$)" + | where isnull(extension) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_without_extension_in_critical_folder_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: +- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html +tags: + analytic_story: + - Data Destruction + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + - Filesystem.dest + security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - source:endpoint + - stage:Persistence + - Privilege Escalation + message: driver file with out file extension drop in $file_path$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/windows_file_without_extension_in_critical_folder.test.yml b/tests/endpoint/windows_file_without_extension_in_critical_folder.test.yml new file mode 100644 index 0000000000..50ffe7b951 --- /dev/null +++ b/tests/endpoint/windows_file_without_extension_in_critical_folder.test.yml @@ -0,0 +1,12 @@ +name: Windows File Without Extension In Critical Folder Unit Test +tests: +- name: Windows File Without Extension In Critical Folder + file: endpoint/windows_file_without_extension_in_critical_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From b7ad4e7c588990901e794ebd6cf768c3c28954ac Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 25 Feb 2022 15:36:41 +0100 Subject: [PATCH 2/5] hermetic_wiper --- ...e_without_extension_in_critical_folder.yml | 2 +- ...ws_raw_access_to_disk_volume_partition.yml | 68 +++++++++++++++++++ ...w_access_to_disk_volume_partition.test.yml | 12 ++++ 3 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/windows_raw_access_to_disk_volume_partition.yml create mode 100644 tests/endpoint/windows_raw_access_to_disk_volume_partition.test.yml diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index e79ee8c115..dabea9ca53 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to look for suspicious file creation in Critical folder like "System32\Drivers" folder without file extension. +description: This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive malware that wipes the boot sector of the system. diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml new file mode 100644 index 0000000000..c9a164a9af --- /dev/null +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -0,0 +1,68 @@ +name: Windows Raw Access To Disk Volume Partition +id: a85aa37e-9647-11ec-90c5-acde48001122 +version: 1 +date: '2022-02-25' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to look for suspicious raw access read to device disk partition of the host machine. + This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the boot sector of each partition + as part of their impact payload for example the "hermeticwiper" malware. + This detection is a good indicator that there is a process try to read or write on boot sector. +search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image Device ProcessGuid ProcessId EventDescription EventCode Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_raw_access_to_disk_volume_partition_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: This event is really notable but we found minimal number of normal application from system32 folder like + svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection. +references: +- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html +tags: + analytic_story: + - Data Destruction + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1561.002 + - T1561 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - Image + - Device + - ProcessGuid + - ProcessId + - EventDescription + - EventCode + security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - source:endpoint + - stage:Impact + message: process accessing disk partition $device$ in $dest$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/windows_raw_access_to_disk_volume_partition.test.yml b/tests/endpoint/windows_raw_access_to_disk_volume_partition.test.yml new file mode 100644 index 0000000000..bb308e5f8b --- /dev/null +++ b/tests/endpoint/windows_raw_access_to_disk_volume_partition.test.yml @@ -0,0 +1,12 @@ +name: Windows Raw Access To Disk Volume Partition Unit Test +tests: +- name: Windows Raw Access To Disk Volume Partition + file: endpoint/windows_raw_access_to_disk_volume_partition.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 2c84bcd37da8271de5517d4b296654e9350e516a Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 25 Feb 2022 20:19:56 +0100 Subject: [PATCH 3/5] hermetic_wiper --- ...e_without_extension_in_critical_folder.yml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index dabea9ca53..f2b2cb9510 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -2,7 +2,7 @@ name: Windows File Without Extension In Critical Folder id: 0dbcac64-963c-11ec-bf04-acde48001122 version: 1 date: '2022-02-25' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Bhavin Patel, Splunk type: TTP datamodel: - Endpoint @@ -10,14 +10,21 @@ description: This analytic is to look for suspicious file creation in the critic This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory both the compressed(without file extension) and the actual driver component (with .sys file extension). This TTP is really a good indication that a host might be compromised by this destructive malware that wipes the boot sector of the system. -search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.dest +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") + by _time span=5m Filesystem.dest Filesystem.user + Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` - | rex field="file_name" "\.(?[^\.]*$)" + | rex field="file_name" "\.(?[^\.]*$)" | where isnull(extension) + | join process_guid + [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=5m Processes.process_name Processes.dest Processes.process_guid + Processes.user + | `drop_dm_object_name(Processes)`] + | stats count min(_time) as firstTime max(_time) + as lastTime by dest process_name process_guid file_name file_path file_create_time user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from From a57caed90599a3841d2bf89c4485e71dd6a07678 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 1 Mar 2022 10:38:11 -0800 Subject: [PATCH 4/5] Update windows_file_without_extension_in_critical_folder.yml --- ...s_file_without_extension_in_critical_folder.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index f2b2cb9510..aa1a544d87 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -29,7 +29,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: unknown +known_false_positives: Unknown at this point references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html tags: @@ -53,16 +53,20 @@ tags: - Filesystem.user - Filesystem.file_path - Filesystem.dest + - Processes.process_name + - Processes.dest + - Processes.process_guid + - Processes.user security_domain: endpoint impact: 90 confidence: 100 # (impact * confidence)/100 risk_score: 90 context: - - source:endpoint - - stage:Persistence + - Source:Endpoint + - Stage:Persistence - Privilege Escalation - message: driver file with out file extension drop in $file_path$ in $dest$ + message: Driver file with out file extension drop in $file_path$ in $dest$ observable: - name: user type: User @@ -73,4 +77,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From be0e84c008e0cc4a635c339521ac39a2a0fa5f4c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 1 Mar 2022 10:39:01 -0800 Subject: [PATCH 5/5] Update windows_raw_access_to_disk_volume_partition.yml --- .../windows_raw_access_to_disk_volume_partition.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index c9a164a9af..5473f738bd 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -52,9 +52,9 @@ tags: # (impact * confidence)/100 risk_score: 90 context: - - source:endpoint - - stage:Impact - message: process accessing disk partition $device$ in $dest$ + - Source:Endpoint + - Stage:Impact + message: Process accessing disk partition $device$ in $dest$ observable: - name: ComputerName type: Hostname @@ -65,4 +65,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16