diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index ce9659c565..9e03ad7f21 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Suspicious Compiled HTML Activity - Living Off The Land + - AgentTesla asset_type: Endpoint cis20: - CIS 8 @@ -96,3 +97,4 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 22c82d5e96..da3a507a86 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -22,10 +22,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - XMRig - Azorult + - AgentTesla confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 248106dffb..7aab201436 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This analytic will identify suspicious executable or scripts (known file - extensions) in list of suspicious file path in Windows. This technique is used by + extensions) in a list of suspicious file paths in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts. search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as @@ -45,6 +45,7 @@ tags: - Azorult - DarkCrystal RAT - Brute Ratel C4 + - AgentTesla automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 89b066794c..989bc63449 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect an anomaly event of non-chrome process accessing +description: This search is to detect an anomaly event of a non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database @@ -29,6 +29,7 @@ tags: analytic_story: - FIN7 - Remcos + - AgentTesla confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 57f268f033..02678b1579 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect an anomaly event of non-firefox process accessing - the files in profile folder. This folder contains all the sqlite database of the +description: This search is to detect an anomaly event of a non-firefox process accessing + the files in the profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to @@ -30,6 +30,7 @@ tags: - FIN7 - Remcos - Azorult + - AgentTesla confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 8fa06d009e..d3f6c51466 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Michael Haag Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious MS office application that drop - or create executables or script in the host. This behavior is commonly seen in spear +description: This search is to detect a suspicious MS office application that drops + or creates executables or scripts in a Windows Operating System. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office @@ -33,9 +33,11 @@ known_false_positives: office macro for automation may do this behavior references: - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation - https://attack.mitre.org/groups/G0046/ +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - FIN7 + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 41028c03bb..f0e0c7590b 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this detection was designed to identifies suspicious spawned process - of known MS office application due to macro or malicious code. this technique can - be seen in so many malware like trickbot that used MS office as its weapon or attack - vector to initially infect the machines. +description: This detection was designed to identify suspicious spawned processes of known MS office + applications due to macro or malicious code. this technique can be seen in so many malware + like trickbot that used MS office as its weapon or attack vector to initially infect the machines. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name @@ -26,11 +25,13 @@ known_false_positives: unknown references: - https://any.run/malware-trends/trickbot - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - Spearphishing Attachments - Trickbot - IcedID + - AgentTesla confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index d072573d39..e97203d479 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -25,12 +25,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Normal Office Document macro use for automation references: - https://www.joesandbox.com/analysis/386500/0/html +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - Spearphishing Attachments - Trickbot - IcedID - DarkCrystal RAT + - AgentTesla confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index dfa2a7cc75..578d68baf2 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -41,6 +41,7 @@ tags: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - HAFNIUM Group - Log4Shell CVE-2021-44228 + - AgentTesla asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index fbf982672e..c82272cb34 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -25,6 +25,7 @@ known_false_positives: It is possible scripts or administrators may trigger this Filter as needed based on parent process, application. references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ +- https://www.joesandbox.com/analysis/691823/0/html tags: analytic_story: - DHS Report TA18-074A @@ -34,6 +35,7 @@ tags: - Azorult - DarkCrystal RAT - CISA AA22-257A + - AgentTesla asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 1bb5a1c902..4b9db6014b 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -41,6 +41,7 @@ tags: - Industroyer2 - DarkCrystal RAT - Brute Ratel C4 + - AgentTesla automated_detection_testing: passed confidence: 50 context: diff --git a/stories/agenttesla.yml b/stories/agenttesla.yml new file mode 100644 index 0000000000..f16e2d8b4e --- /dev/null +++ b/stories/agenttesla.yml @@ -0,0 +1,26 @@ +name: AgentTesla +id: 9bb6077a-843e-418b-b134-c57ef997103c +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the AgentTesla malware including .chm application child process, ftp/smtp connection, persistence and many more. + AgentTesla is one of the advanced remote access trojans (RAT) that are capable of stealing sensitive information from the infected or targeted host machine. + It can collect various types of data, including browser profile information, keystrokes, capture screenshots and vpn credentials. + AgentTesla has been active malware since 2014 and often delivered as a malicious attachment in phishing emails.It is also the top malware in 2021 based on the CISA report. +narrative: Adversaries or threat actor may use this malware to maximize the impact of infection on the target organization in operations where network wide availability interruption + is the goal. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla +- https://cert.gov.ua/article/861292 +- https://www.cisa.gov/uscert/ncas/alerts/aa22-216a +- https://www.joesandbox.com/analysis/702680/0/html +tags: + analytic_story: AgentTesla + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file