From 888a148bbbe3d79f02074a01564a1b4fe808e880 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 19 Sep 2022 11:28:07 +0200 Subject: [PATCH 1/8] agent-with-tesla-1 --- .../detect_html_help_spawn_child_process.yml | 1 + .../endpoint/excessive_usage_of_taskkill.yml | 2 ++ ..._or_script_creation_in_suspicious_path.yml | 1 + ...e_process_accessing_chrome_default_dir.yml | 1 + ...fox_process_access_firefox_profile_dir.yml | 1 + .../office_application_drop_executable.yml | 2 ++ ...ice_application_spawn_rundll32_process.yml | 2 ++ .../office_document_executing_macro_code.yml | 2 ++ ...connect_to_internet_with_hidden_window.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 2 ++ .../endpoint/suspicious_process_file_path.yml | 1 + stories/agenttesla.yml | 26 +++++++++++++++++++ 12 files changed, 42 insertions(+) create mode 100644 stories/agenttesla.yml diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index ce9659c565..641d50b773 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Suspicious Compiled HTML Activity - Living Off The Land + - AgentTesla asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 22c82d5e96..da3a507a86 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -22,10 +22,12 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - XMRig - Azorult + - AgentTesla confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 248106dffb..7db30ee98e 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -45,6 +45,7 @@ tags: - Azorult - DarkCrystal RAT - Brute Ratel C4 + - AgentTesla automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 89b066794c..a382229cc4 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -29,6 +29,7 @@ tags: analytic_story: - FIN7 - Remcos + - AgentTesla confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 57f268f033..226edf1be7 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -30,6 +30,7 @@ tags: - FIN7 - Remcos - Azorult + - AgentTesla confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 8fa06d009e..6eda04b14d 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -33,9 +33,11 @@ known_false_positives: office macro for automation may do this behavior references: - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation - https://attack.mitre.org/groups/G0046/ +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - FIN7 + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 41028c03bb..3b92cc64fe 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -26,11 +26,13 @@ known_false_positives: unknown references: - https://any.run/malware-trends/trickbot - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - Spearphishing Attachments - Trickbot - IcedID + - AgentTesla confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index d072573d39..e97203d479 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -25,12 +25,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Normal Office Document macro use for automation references: - https://www.joesandbox.com/analysis/386500/0/html +- https://www.joesandbox.com/analysis/702680/0/html tags: analytic_story: - Spearphishing Attachments - Trickbot - IcedID - DarkCrystal RAT + - AgentTesla confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index dfa2a7cc75..578d68baf2 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -41,6 +41,7 @@ tags: - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - HAFNIUM Group - Log4Shell CVE-2021-44228 + - AgentTesla asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index fbf982672e..c82272cb34 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -25,6 +25,7 @@ known_false_positives: It is possible scripts or administrators may trigger this Filter as needed based on parent process, application. references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ +- https://www.joesandbox.com/analysis/691823/0/html tags: analytic_story: - DHS Report TA18-074A @@ -34,6 +35,7 @@ tags: - Azorult - DarkCrystal RAT - CISA AA22-257A + - AgentTesla asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 1bb5a1c902..4b9db6014b 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -41,6 +41,7 @@ tags: - Industroyer2 - DarkCrystal RAT - Brute Ratel C4 + - AgentTesla automated_detection_testing: passed confidence: 50 context: diff --git a/stories/agenttesla.yml b/stories/agenttesla.yml new file mode 100644 index 0000000000..f16e2d8b4e --- /dev/null +++ b/stories/agenttesla.yml @@ -0,0 +1,26 @@ +name: AgentTesla +id: 9bb6077a-843e-418b-b134-c57ef997103c +version: 1 +date: '2022-04-12' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the AgentTesla malware including .chm application child process, ftp/smtp connection, persistence and many more. + AgentTesla is one of the advanced remote access trojans (RAT) that are capable of stealing sensitive information from the infected or targeted host machine. + It can collect various types of data, including browser profile information, keystrokes, capture screenshots and vpn credentials. + AgentTesla has been active malware since 2014 and often delivered as a malicious attachment in phishing emails.It is also the top malware in 2021 based on the CISA report. +narrative: Adversaries or threat actor may use this malware to maximize the impact of infection on the target organization in operations where network wide availability interruption + is the goal. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla +- https://cert.gov.ua/article/861292 +- https://www.cisa.gov/uscert/ncas/alerts/aa22-216a +- https://www.joesandbox.com/analysis/702680/0/html +tags: + analytic_story: AgentTesla + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 8c40b9c5fc29ffb8205d1b79182f9b0cf43389f2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 19 Sep 2022 11:35:19 +0200 Subject: [PATCH 2/8] agent-with-tesla-1 --- detections/endpoint/detect_html_help_spawn_child_process.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 641d50b773..9e03ad7f21 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -97,3 +97,4 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + From 28d6d6a52933763b2ec4ac0e3b4bc996c64287cd Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 12:41:59 +0200 Subject: [PATCH 3/8] Update non_chrome_process_accessing_chrome_default_dir.yml --- .../non_chrome_process_accessing_chrome_default_dir.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index a382229cc4..989bc63449 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect an anomaly event of non-chrome process accessing +description: This search is to detect an anomaly event of a non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database From 6d842523083d3693c4349ad7e8c4de30098ee12f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 12:42:41 +0200 Subject: [PATCH 4/8] Update executables_or_script_creation_in_suspicious_path.yml --- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 7db30ee98e..c11a43439a 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This analytic will identify suspicious executable or scripts (known file - extensions) in list of suspicious file path in Windows. This technique is used by + extensions) in a list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts. search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as From 2b0a406ed88fcc7c3e30bb19aa4c6ee8e7005361 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 12:44:36 +0200 Subject: [PATCH 5/8] Update non_firefox_process_access_firefox_profile_dir.yml --- .../non_firefox_process_access_firefox_profile_dir.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 226edf1be7..02678b1579 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect an anomaly event of non-firefox process accessing - the files in profile folder. This folder contains all the sqlite database of the +description: This search is to detect an anomaly event of a non-firefox process accessing + the files in the profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to From 66cb904a184339e94f2adfca7f8d64517012c46c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 12:46:26 +0200 Subject: [PATCH 6/8] Update office_application_drop_executable.yml --- detections/endpoint/office_application_drop_executable.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 6eda04b14d..d3f6c51466 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Michael Haag Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious MS office application that drop - or create executables or script in the host. This behavior is commonly seen in spear +description: This search is to detect a suspicious MS office application that drops + or creates executables or scripts in a Windows Operating System. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office From 859a79ccf5a03f1758df5e4fe0b665ce3c95c851 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 12:48:16 +0200 Subject: [PATCH 7/8] Update executables_or_script_creation_in_suspicious_path.yml --- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index c11a43439a..7aab201436 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This analytic will identify suspicious executable or scripts (known file - extensions) in a list of suspicious file path in Windows. This technique is used by + extensions) in a list of suspicious file paths in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts. search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as From 45e7fb8e40a7cc9627411d81ddff83cd1c84d5a6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 12:52:00 +0200 Subject: [PATCH 8/8] Update office_application_spawn_rundll32_process.yml --- .../endpoint/office_application_spawn_rundll32_process.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 3b92cc64fe..f0e0c7590b 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this detection was designed to identifies suspicious spawned process - of known MS office application due to macro or malicious code. this technique can - be seen in so many malware like trickbot that used MS office as its weapon or attack - vector to initially infect the machines. +description: This detection was designed to identify suspicious spawned processes of known MS office + applications due to macro or malicious code. this technique can be seen in so many malware + like trickbot that used MS office as its weapon or attack vector to initially infect the machines. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name