From f6f4c306fd84ebaaf66c813cd8510b936459fff5 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 11:39:58 -0500 Subject: [PATCH 01/10] Update powershell_fileless_script_contains_base64_encoded_content.yml Renamed risk object ComputerName to Computer Removed User from risk object (UserID is the proper field, but the SID isn't part of assets/identities, so just full on removed the part of the stanza for User) Removes the 's' off EventCodes --- ...ll_fileless_script_contains_base64_encoded_content.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 6be2fe62a8..0e2ca3b843 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -52,14 +52,10 @@ tags: - T1027 - T1059.001 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -70,7 +66,7 @@ tags: - Opcode - Computer - UserID - - EventCodes + - EventCode risk_score: 56 security_domain: endpoint asset_type: Endpoint From 4f774be1b4caf6c7e400a72e2b14a42b7ddfba95 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 12:04:36 -0500 Subject: [PATCH 02/10] Update powershell_fileless_script_contains_base64_encoded_content.yml Updated risk message to the new field names. --- ...rshell_fileless_script_contains_base64_encoded_content.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 0e2ca3b843..fbf87bc0fe 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -45,8 +45,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains base64 command in $Message$ with - EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with + EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1059 - T1027 From 330a31e9f244bd6087c3bc73ca64129f6cb588fc Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 12:32:23 -0500 Subject: [PATCH 03/10] Update windows_service_created_with_suspicious_service_path.yml Updated field names to match, and added dest and user_id to the query for investigation purposes. --- ...e_created_with_suspicious_service_path.yml | 25 +++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 259310edec..acdd3f8638 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -11,10 +11,10 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services. -search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*.exe" NOT (Service_File_Name +search: ' `wineventlog_system` EventCode=7045 ImagePath = "*.exe" NOT (ImagePath IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name - Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath + ServiceName StartType ServiceType dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type @@ -40,13 +40,17 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A service $Service_File_Name$ was created from a non-standard path using - $Service_Name$ + message: A service $ImagePath$ was created from a non-standard path using + $ServiceName$ mitre_attack_id: - T1569 - T1569.002 observable: - - name: Service_File_Name + - name: dest + type: Hostname + role: + - Victim + - name: ImagePath type: Other role: - Other @@ -60,11 +64,12 @@ tags: - Splunk Cloud required_fields: - EventCode - - Service_File_Name - - Service_Type + - ImagePath + - ServiceType - _time - - Service_Name - - Service_Start_Type + - ServiceName + - StartType + - dest risk_score: 56 security_domain: endpoint asset_type: Endpoint From e8cd643c407cf36fc7df16c3c9c189f7009df4ed Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 16:10:33 -0500 Subject: [PATCH 04/10] Update create_local_admin_accounts_using_net_exe.yml Added parent_process_name into the query, as the rest of the yaml wanted it. --- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index f7d2a8d1fd..6e8026e954 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for the creation of local administrator accounts using net.exe . search: '| tstats `security_content_summariesonly` count values(Processes.user) as - user values(Processes.parent_process) as parent_process min(_time) as firstTime + user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR From a056d1beceeba03c01f8328838e9203d7aaefd36 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 16:25:43 -0500 Subject: [PATCH 05/10] Update delete_shadowcopy_with_powershell.yml Observable User was changed to UserID. I don't think this is useful as it's the SID, and not sure if all folks will capture SID for the assets & identities, so maybe deleting the part of the stanza for the Victim User is better. --- detections/endpoint/delete_shadowcopy_with_powershell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index df1edaec4a..1e9d7c6d33 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -42,7 +42,7 @@ tags: mitre_attack_id: - T1490 observable: - - name: User + - name: UserID type: User role: - Victim From 76b53a64a2f486b4c81b94eae3bfc60a764b2781 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Mon, 6 Feb 2023 21:22:37 -0500 Subject: [PATCH 06/10] Update windows_service_created_with_suspicious_service_path.yml Aftering syncing branch, the missing pipe (between the lastTime macro and the filter macro) was replaced. Verified code runs on own instance. From add6570b67c13aa5f3d0570bdb70db8389cac54d Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Tue, 7 Feb 2023 16:01:04 -0500 Subject: [PATCH 07/10] Update windows_service_created_with_suspicious_service_path.yml Reverted back to Classic format fields per request. --- ...e_created_with_suspicious_service_path.yml | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index acdd3f8638..a1c31ce7b4 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -11,10 +11,10 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services. -search: ' `wineventlog_system` EventCode=7045 ImagePath = "*.exe" NOT (ImagePath +search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*.exe" NOT (Service_File_Name IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath - ServiceName StartType ServiceType dest user_id | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name + Service_Name Service_Start_Type Service_Type dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type @@ -40,8 +40,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A service $ImagePath$ was created from a non-standard path using - $ServiceName$ + message: A service $Service_File_Name$ was created from a non-standard path using + $Service_Name $ mitre_attack_id: - T1569 - T1569.002 @@ -50,7 +50,7 @@ tags: type: Hostname role: - Victim - - name: ImagePath + - name: Service_File_Name type: Other role: - Other @@ -64,11 +64,11 @@ tags: - Splunk Cloud required_fields: - EventCode - - ImagePath - - ServiceType + - Service_File_Name + - Service_Type - _time - - ServiceName - - StartType + - Service_Name + - Service_Start_Type - dest risk_score: 56 security_domain: endpoint From d1fb0e3767685b0cccded347d186be705460ceff Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Tue, 7 Feb 2023 16:02:33 -0500 Subject: [PATCH 08/10] Update windows_service_created_with_suspicious_service_path.yml --- .../windows_service_created_with_suspicious_service_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index a1c31ce7b4..27c75d6109 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -41,7 +41,7 @@ tags: kill_chain_phases: - Exploitation message: A service $Service_File_Name$ was created from a non-standard path using - $Service_Name $ + $Service_Name$ mitre_attack_id: - T1569 - T1569.002 @@ -67,7 +67,7 @@ tags: - Service_File_Name - Service_Type - _time - - Service_Name + - Service_Name - Service_Start_Type - dest risk_score: 56 From 64f1b2ecaafbb9c9df3bd9733a858d0e853837d6 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Tue, 7 Feb 2023 16:03:16 -0500 Subject: [PATCH 09/10] Update windows_service_created_with_suspicious_service_path.yml --- .../windows_service_created_with_suspicious_service_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 27c75d6109..ed455f4d72 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -14,7 +14,7 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*.exe" NOT (Service_File_Name IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name - Service_Name Service_Start_Type Service_Type dest user_id | `security_content_ctime(firstTime)` + Service_Name Service_Start_Type Service_Type dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type From 376e204af1c15c30fa7a71f94962474373afd533 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Tue, 7 Feb 2023 16:09:51 -0500 Subject: [PATCH 10/10] Update windows_service_created_with_suspicious_service_path.yml --- .../windows_service_created_with_suspicious_service_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index ed455f4d72..8b33f20a1e 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -14,7 +14,7 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa search: ' `wineventlog_system` EventCode=7045 Service_File_Name = "*.exe" NOT (Service_File_Name IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name - Service_Name Service_Start_Type Service_Type dest user_id | `security_content_ctime(firstTime)` + Service_Name Service_Start_Type Service_Type dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type