Branch was auto-updated.

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
   - Living Off The Land
+  - AgentTesla
   asset_type: Endpoint
   cis20:
   - CIS 8
@@ -96,3 +97,4 @@ tags:
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+  

detections/endpoint/excessive_usage_of_taskkill.yml

@@ -22,10 +22,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: Unknown. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://www.joesandbox.com/analysis/702680/0/html
 tags:
   analytic_story:
   - XMRig
   - Azorult
+  - AgentTesla
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: This analytic will identify suspicious executable or scripts (known file
-  extensions) in list of suspicious file path in Windows. This technique is used by
+  extensions) in a list of suspicious file paths in Windows. This technique is used by
   adversaries to evade detection. The suspicious file path are known paths used in
   the wild and are not common to have executable or scripts.
 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
@@ -45,6 +45,7 @@ tags:
   - Azorult
   - DarkCrystal RAT
   - Brute Ratel C4
+  - AgentTesla
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This search is to detect an anomaly event of non-chrome process accessing
+description: This search is to detect an anomaly event of a non-chrome process accessing
   the files in chrome user default folder. This folder contains all the sqlite database
   of the chrome browser related to users login, history, cookies and etc. Most of
   the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - FIN7
   - Remcos
+  - AgentTesla
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This search is to detect an anomaly event of non-firefox process accessing
-  the files in  profile folder. This folder contains all the sqlite database of the
+description: This search is to detect an anomaly event of a non-firefox process accessing
+  the files in the profile folder. This folder contains all the sqlite database of the
   firefox browser related to users login, history, cookies and etc. Most of the RAT,
   trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect
   information on the compromised host. This SACL Event (4663) need to be enabled to
@@ -30,6 +30,7 @@ tags:
   - FIN7
   - Remcos
   - Azorult
+  - AgentTesla
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/office_application_drop_executable.yml

@@ -6,8 +6,8 @@ author: Teoderick Contreras, Michael Haag Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious MS office application that drop
-  or create executables or script in the host. This behavior is commonly seen in spear
+description: This search is to detect a suspicious MS office application that drops
+  or creates executables or scripts in a Windows Operating System. This behavior is commonly seen in spear
   phishing office attachment where it drop malicious files or script to compromised
   the host. It might be some normal macro may drop script or tools as part of automation
   but still this behavior is reallly suspicious and not commonly seen in normal office
@@ -33,9 +33,11 @@ known_false_positives: office macro for automation may do this behavior
 references:
 - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
 - https://attack.mitre.org/groups/G0046/
+- https://www.joesandbox.com/analysis/702680/0/html
 tags:
   analytic_story:
   - FIN7
+  - AgentTesla
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: this detection was designed to identifies suspicious spawned process
-  of known MS office application due to macro or malicious code. this technique can
-  be seen in so many malware like trickbot that used MS office as its weapon or attack
-  vector to initially infect the machines.
+description: This detection was designed to identify suspicious spawned processes of known MS office 
+  applications due to macro or malicious code. this technique can be seen in so many malware 
+  like trickbot that used MS office as its weapon or attack vector to initially infect the machines.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
@@ -26,11 +25,13 @@ known_false_positives: unknown
 references:
 - https://any.run/malware-trends/trickbot
 - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
+- https://www.joesandbox.com/analysis/702680/0/html
 tags:
   analytic_story:
   - Spearphishing Attachments
   - Trickbot
   - IcedID
+  - AgentTesla
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/office_document_executing_macro_code.yml

@@ -25,12 +25,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: Normal Office Document macro use for automation
 references:
 - https://www.joesandbox.com/analysis/386500/0/html
+- https://www.joesandbox.com/analysis/702680/0/html
 tags:
   analytic_story:
   - Spearphishing Attachments
   - Trickbot
   - IcedID
   - DarkCrystal RAT
+  - AgentTesla
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml

@@ -41,6 +41,7 @@ tags:
   - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
   - HAFNIUM Group
   - Log4Shell CVE-2021-44228
+  - AgentTesla
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -25,6 +25,7 @@ known_false_positives: It is possible scripts or administrators may trigger this
   Filter as needed based on parent process, application.
 references:
 - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
+- https://www.joesandbox.com/analysis/691823/0/html
 tags:
   analytic_story:
   - DHS Report TA18-074A
@@ -34,6 +35,7 @@ tags:
   - Azorult
   - DarkCrystal RAT
   - CISA AA22-257A
+  - AgentTesla
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/suspicious_process_file_path.yml

@@ -41,6 +41,7 @@ tags:
   - Industroyer2
   - DarkCrystal RAT
   - Brute Ratel C4
+  - AgentTesla
   automated_detection_testing: passed
   confidence: 50
   context:

stories/agenttesla.yml

@@ -0,0 +1,26 @@
+name: AgentTesla
+id: 9bb6077a-843e-418b-b134-c57ef997103c
+version: 1
+date: '2022-04-12'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the AgentTesla malware including .chm application child process, ftp/smtp connection, persistence and many more.
+  AgentTesla is one of the advanced remote access trojans (RAT) that are capable of stealing sensitive information from the infected or targeted host machine. 
+  It can collect various types of data, including browser profile information, keystrokes, capture screenshots and vpn credentials. 
+  AgentTesla has been active malware since 2014 and often delivered as a malicious attachment in phishing emails.It is also the top malware in 2021 based on the CISA report.
+narrative: Adversaries or threat actor may use this malware to maximize the impact of infection on the target organization in operations where network wide availability interruption
+  is the goal. 
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
+- https://cert.gov.ua/article/861292
+- https://www.cisa.gov/uscert/ncas/alerts/aa22-216a
+- https://www.joesandbox.com/analysis/702680/0/html
+tags:
+  analytic_story: AgentTesla
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection