diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 406cfcff48..7fb1eafe28 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -11,13 +11,16 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` - | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) - as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=relative_time(now(),"-24h@h"), - "First Time Logging into AWS Console", "Previously Seen User") |where userStatus="First - Time Logging into AWS Console" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `detect_aws_console_login_by_new_user_filter`' +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user +| `drop_dm_object_name(Authentication)` +| join user type=outer + [ inputlookup previously_seen_users_console_logins + | stats min(firstTime) as earliestseen by user] +| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User") +| where userStatus="First Time Logging into AWS Console" +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_aws_console_login_by_new_user_filter`' how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index e4cc5ea1a1..2cfcd78cd9 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user City | fields earliestseen user + | stats min(firstTime) AS earliestseen by user City | fields earliestseen user City] | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index e0de730c05..0b1236d9f1 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user Country | fields earliestseen + | stats min(firstTime) AS earliestseen by user Country | fields earliestseen user Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country" diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 806537ad99..0d9af9a4bd 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen + | stats min(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 22dce62ed2..93840b2101 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -20,7 +20,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 08e0895696..0417b7d8c3 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,7 +1,7 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: 1 -date: '2021-05-13' +version: 2 +date: '2021-11-29' author: Michael Haag, Splunk type: TTP datamodel: @@ -14,21 +14,24 @@ description: This analytic identifies commonly used command-line arguments used event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*", - "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", + as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process + IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: There is potential for false positives as these arguments may - be used by other applications. Filter or tune the analytic as needed. + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as this is restricted to + the Rclone process name. Filter or tune the analytic as needed. references: - https://redcanary.com/blog/rclone-mega-extortion/ - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ tags: analytic_story: - DarkSide Ransomware @@ -78,5 +81,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id + - Processes.original_file_name risk_score: 35 security_domain: endpoint diff --git a/macros/process_rclone.yml b/macros/process_rclone.yml new file mode 100644 index 0000000000..ed64ce1f95 --- /dev/null +++ b/macros/process_rclone.yml @@ -0,0 +1,3 @@ +definition: (Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe) +description: Matches the process with its original file name. +name: process_rclone \ No newline at end of file