From d84019ce5a53a4c183557450e9f0aa0b1977fc87 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 30 Sep 2024 10:35:12 -0600 Subject: [PATCH 1/8] PSWA Updates --- ...ible_lateral_movement_powershell_spawn.yml | 1 + ...dentify_powershell_web_access_iis_pool.yml | 71 +++++++++++++++++++ ...windows_iis_server_pswa_console_access.yml | 61 ++++++++++++++++ stories/cisa_aa24_241a.yml | 3 + 4 files changed, 136 insertions(+) create mode 100644 detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml create mode 100644 detections/web/windows_iis_server_pswa_console_access.yml diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index ffa2ba48c5..f59d9d10de 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -50,6 +50,7 @@ tags: - Hermetic Wiper - Data Destruction - Scheduled Tasks + - CISA AA24-241A asset_type: Endpoint confidence: 50 impact: 90 diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml new file mode 100644 index 0000000000..dc39beb84b --- /dev/null +++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml @@ -0,0 +1,71 @@ +name: Windows Identify PowerShell Web Access IIS Pool +id: d8419343-f0f8-4d8e-91cc-18bb531df87d +version: 1 +date: '2024-09-09' +author: Michael Haag, Splunk +data_sources: +- Windows Security 4648 +type: Hunting +status: production +description: This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool. +search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4625) SubjectUserName="pswa_pool" + | fields EventCode, SubjectUserName, TargetUserName, Computer, TargetDomainName, ProcessName, LogonType + | rename Computer as dest + | stats + count(eval(EventCode=4648)) as "Connection Attempts", + count(eval(EventCode=4624)) as "Successful Logons", + count(eval(EventCode=4625)) as "Unsuccessful Logons", + dc(TargetUserName) as "Unique Target Accounts", + values(dest) as "PSWA Host", + dc(TargetDomainName) as "Unique Target Domains", + values(ProcessName) as "PSWA Process", + values(TargetUserName) as "Target Users List", + values(TargetServerName) as "Target Servers List", + values(LogonType) as "Logon Types" + | eval + PSWA_Running = "Yes", + "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1) + | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types" + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `windows_identify_powershell_web_access_iis_pool_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event logs, specifically Event ID 4648 (A logon was attempted using explicit credentials). Ensure that your Windows systems are configured to audit logon events and that these logs are being forwarded to your SIEM or log management solution. You may need to enable advanced audit policy settings in Windows to capture these events. Additionally, make sure that your environment is set up to capture the necessary fields such as SubjectUserName, TargetUserName, Computer, TargetServerName, and ProcessName from these events. If you're using Splunk, ensure that you have the appropriate Windows TA installed and configured to collect these security logs. +known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity. +references: +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a +- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 +tags: + analytic_story: + - CISA AA24-241A + asset_type: Endpoint + confidence: 80 + impact: 80 + message: PowerShell Web Access (PSWA) activity detected on $dest$. + mitre_attack_id: + - T1190 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - SubjectUserName + - TargetUserName + - dest + - TargetServerName + - ProcessName + risk_score: 64 + security_domain: endpoint + cve: [] +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_pswa_pool.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/detections/web/windows_iis_server_pswa_console_access.yml b/detections/web/windows_iis_server_pswa_console_access.yml new file mode 100644 index 0000000000..ff8d524563 --- /dev/null +++ b/detections/web/windows_iis_server_pswa_console_access.yml @@ -0,0 +1,61 @@ +name: Windows IIS Server PSWA Console Access +id: 914ab191-fa8a-48cb-83a6-0565e061f934 +version: 1 +date: '2024-09-30' +author: Michael Haag, Splunk +data_sources: +- Windows IIS +type: Hunting +status: production +description: This analytic detects access attempts to the PowerShell Web Access (PSWA) console on Windows IIS servers. It monitors web traffic for requests to PSWA-related URIs, which could indicate legitimate administrative activity or potential unauthorized access attempts. By tracking source IP, HTTP status, URI path, and HTTP method, it helps identify suspicious patterns or brute-force attacks targeting PSWA. This detection is crucial for maintaining the security of remote PowerShell management interfaces and preventing potential exploitation of this powerful administrative tool. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.dest IN ("/pswa/*") + by Web.src Web.status Web.uri_path Web.dest Web.http_method + Web.uri_query | `drop_dm_object_name("Web")`| `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_iis_server_pswa_console_access_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. + In addition, confirm the latest CIM App 4.20 or higher is installed. +known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity. +references: +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a +tags: + analytic_story: + - CISA AA24-241A + asset_type: Web Server + confidence: 80 + impact: 40 + message: Access to the PowerShell Web Access (PSWA) console detected from $src$. + mitre_attack_id: + - T1190 + observable: + - name: src + type: IP Address + role: + - Attacker + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Web.src + - Web.status + - Web.uri_path + - Web.dest + - Web.http_method + - Web.uri_query + risk_score: 32 + security_domain: network + cve: [] +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/iis_pswaaccess.log + sourcetype: ms:iis:splunk + source: ms:iis:splunk diff --git a/stories/cisa_aa24_241a.yml b/stories/cisa_aa24_241a.yml index 63f341a44f..3e5732f6e4 100644 --- a/stories/cisa_aa24_241a.yml +++ b/stories/cisa_aa24_241a.yml @@ -8,6 +8,9 @@ narrative: As of August 2024, Iran-based cyber actors continue to exploit organi references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41 + - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/want-remote-powershell-management-from-your-browser-see-how-pswa/ba-p/255764 + - https://learn.microsoft.com/en-us/powershell/module/powershellwebaccess/?view=winserver2012r2-ps + - https://arz101.medium.com/hackthebox-acute-ee0308b9b443 tags: category: - Adversary Tactics From 58f24d3680056aadaaaa1f3d50f7e168a67389c4 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 4 Oct 2024 09:35:04 -0600 Subject: [PATCH 2/8] try that --- .../windows_identify_powershell_web_access_iis_pool.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml index dc39beb84b..645f8d79bc 100644 --- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml +++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml @@ -40,11 +40,11 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: PowerShell Web Access (PSWA) activity detected on $dest$. + message: PowerShell Web Access (PSWA) activity detected on $PSWA Host$. mitre_attack_id: - T1190 observable: - - name: dest + - name: PSWA Host type: Hostname role: - Victim From 2d336d3af696d6c081884b4a08d76307638db39f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 4 Oct 2024 09:46:24 -0600 Subject: [PATCH 3/8] try again --- .../windows_identify_powershell_web_access_iis_pool.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml index 645f8d79bc..e669de0369 100644 --- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml +++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml @@ -25,7 +25,7 @@ search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4 | eval PSWA_Running = "Yes", "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1) - | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types" + | fields PSWA_Running, dest, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types" | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_identify_powershell_web_access_iis_pool_filter`' @@ -40,11 +40,11 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: PowerShell Web Access (PSWA) activity detected on $PSWA Host$. + message: PowerShell Web Access (PSWA) IIS Application Pool activity detected on $dest$. mitre_attack_id: - T1190 observable: - - name: PSWA Host + - name: dest type: Hostname role: - Victim From e60c831b29e3403a2eb55947b152a3245f64065c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 7 Oct 2024 12:04:10 -0600 Subject: [PATCH 4/8] Update windows_identify_powershell_web_access_iis_pool.yml updated dataset --- .../windows_identify_powershell_web_access_iis_pool.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml index e669de0369..65b5115b9b 100644 --- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml +++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml @@ -66,6 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_pswa_pool.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_4624_pswa_pool.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Security From 55415915f05c3ab71b23e4d2bc7f9578a2b69d15 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 7 Oct 2024 12:50:32 -0600 Subject: [PATCH 5/8] updated today --- .../windows_identify_powershell_web_access_iis_pool.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml index 65b5115b9b..80d7e103ad 100644 --- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml +++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml @@ -25,7 +25,7 @@ search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4 | eval PSWA_Running = "Yes", "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1) - | fields PSWA_Running, dest, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types" + | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types" | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_identify_powershell_web_access_iis_pool_filter`' @@ -40,11 +40,11 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: PowerShell Web Access (PSWA) IIS Application Pool activity detected on $dest$. + message: PowerShell Web Access (PSWA) IIS Application Pool activity detected on $PSWA Host$. mitre_attack_id: - T1190 observable: - - name: dest + - name: PSWA Host type: Hostname role: - Victim From 9544a896e757e3702cca99dc10bde5108e7508de Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Oct 2024 14:30:37 -0700 Subject: [PATCH 6/8] data source --- .../windows_identify_powershell_web_access_iis_pool.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml index 80d7e103ad..742ec1cc44 100644 --- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml +++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml @@ -4,7 +4,7 @@ version: 1 date: '2024-09-09' author: Michael Haag, Splunk data_sources: -- Windows Security 4648 +- Windows Event Log Security 4648 type: Hunting status: production description: This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool. From a3534c0eaf6e10b8bb3c604fc8cc6e2500b782d7 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Oct 2024 14:31:23 -0700 Subject: [PATCH 7/8] Update possible_lateral_movement_powershell_spawn.yml --- .../endpoint/possible_lateral_movement_powershell_spawn.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index f59d9d10de..cbe7e81e3b 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -1,7 +1,7 @@ name: Possible Lateral Movement PowerShell Spawn id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 5 -date: '2024-06-18' +version: 6 +date: '2024-10-07' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP From 5b21374fc9d7e7199fb93591120c5eb7fa093e26 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Oct 2024 14:31:49 -0700 Subject: [PATCH 8/8] Update cisa_aa24_241a.yml --- stories/cisa_aa24_241a.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/cisa_aa24_241a.yml b/stories/cisa_aa24_241a.yml index 3e5732f6e4..1a7eba2bdf 100644 --- a/stories/cisa_aa24_241a.yml +++ b/stories/cisa_aa24_241a.yml @@ -1,7 +1,7 @@ name: CISA AA24-241A id: f075adb6-76a6-4476-b24a-ce9d471a1bdc -version: 1 -date: '2024-09-03' +version: 2 +date: '2024-10-07' author: Michael Haag, Splunk description: This story covers the tactics of Iran-based cyber actors exploiting U.S. and foreign organizations across multiple sectors, as detailed in CISA Alert AA24-241A. It focuses on their methods of gaining initial access, establishing persistence, and enabling ransomware attacks through vulnerabilities in public-facing networking devices. narrative: As of August 2024, Iran-based cyber actors continue to exploit organizations across several U.S. sectors and other countries. The FBI assesses that a significant percentage of these operations aim to obtain network access for collaboration with ransomware affiliates. The actors typically use Shodan to identify vulnerable devices, then exploit public-facing networking equipment such as Citrix Netscaler, F5 BIG-IP, and various VPNs. They deploy webshells, create local accounts, and manipulate existing ones to maintain access. Post-exploitation, they repurpose credentials, disable security software, and use remote access tools. The group collaborates with ransomware affiliates like NoEscape, Ransomhouse, and ALPHV, actively participating in network lockdowns and extortion strategies. Defenders should prioritize patching public-facing devices, monitoring for unauthorized accounts and suspicious PowerShell activity, implementing strong access controls, and regularly reviewing logs for signs of compromise. @@ -25,4 +25,4 @@ tags: - CVE-2019-19781 - CVE-2023-3519 - CVE-2022-1388 - - CVE-2024-21887 \ No newline at end of file + - CVE-2024-21887