Branch was auto-updated.

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -11,13 +11,16 @@ description: This search looks for AWS CloudTrail events wherein a console login
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
-  where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
-  | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime)
-  as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=relative_time(now(),"-24h@h"),
-  "First Time Logging into AWS Console", "Previously Seen User") |where userStatus="First
-  Time Logging into AWS Console" |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
-  `detect_aws_console_login_by_new_user_filter`'
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user 
+| `drop_dm_object_name(Authentication)` 
+| join user type=outer 
+    [ inputlookup previously_seen_users_console_logins 
+    | stats min(firstTime) as earliestseen by user] 
+| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User") 
+| where userStatus="First Time Logging into AWS Console" 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `detect_aws_console_login_by_new_user_filter`'
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
   5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
   to the Authentication data model for cloud use cases. Run the `Previously Seen Users

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
   firstTime lastTime user City | join user  type=outer [| inputlookup previously_seen_users_console_logins
-  | stats earliest(firstTime) AS earliestseen by user City | fields earliestseen user
+  | stats min(firstTime) AS earliestseen by user City | fields earliestseen user
   City] | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously
   Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h")
   OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
   firstTime lastTime user Country | join user  type=outer [| inputlookup previously_seen_users_console_logins
-  | stats earliest(firstTime) AS earliestseen by user Country | fields earliestseen
+  | stats min(firstTime) AS earliestseen by user Country | fields earliestseen
   user Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"),
   "New Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h")
   OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country"

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
   firstTime lastTime user Region | join user  type=outer [| inputlookup previously_seen_users_console_logins
-  | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen
+  | stats min(firstTime) AS earliestseen by user Region | fields earliestseen
   user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New
   Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(),
   "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New

detections/endpoint/detect_html_help_renamed.yml

@@ -20,7 +20,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest
   Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_html_help_renamed_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/detect_rclone_command_line_usage.yml

@@ -1,7 +1,7 @@
 name: Detect RClone Command-Line Usage
 id: 32e0baea-b3f1-11eb-a2ce-acde48001122
-version: 1
-date: '2021-05-13'
+version: 2
+date: '2021-11-29'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -14,21 +14,24 @@ description: This analytic identifies commonly used command-line arguments used
   event, exfiltration is about to occur or has already. Isolate the endpoint and continue
   investigating by review file modifications and parallel processes.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*",
-  "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*",
+  as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process
+  IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*",
   "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*")  by
-  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process   Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  |  `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`'
+  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` |  `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: There is potential for false positives as these arguments may
-  be used by other applications. Filter or tune the analytic as needed.
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited as this is restricted to
+  the Rclone process name. Filter or tune the analytic as needed.
 references:
 - https://redcanary.com/blog/rclone-mega-extortion/
 - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
 - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -78,5 +81,6 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
+  - Processes.original_file_name
   risk_score: 35
   security_domain: endpoint

macros/process_rclone.yml

@@ -0,0 +1,3 @@
+definition: (Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)
+description: Matches the process with its original file name.
+name: process_rclone