From bbc913faaa34e89db5e871171a02a7e827fe1ca8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 19 Nov 2021 11:16:11 -0800 Subject: [PATCH 1/7] first 3 detections --- .../cloud/detect_aws_console_login_by_user_from_new_city.yml | 2 +- .../cloud/detect_aws_console_login_by_user_from_new_country.yml | 2 +- .../cloud/detect_aws_console_login_by_user_from_new_region.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index e4cc5ea1a1..2cfcd78cd9 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user City | fields earliestseen user + | stats min(firstTime) AS earliestseen by user City | fields earliestseen user City] | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index e0de730c05..0b1236d9f1 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user Country | fields earliestseen + | stats min(firstTime) AS earliestseen by user Country | fields earliestseen user Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country" diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 806537ad99..0d9af9a4bd 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -15,7 +15,7 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen + | stats min(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New From a6ee98620d0c6d59ec131ddba9155e5f2eaa1ab4 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 19 Nov 2021 11:18:36 -0800 Subject: [PATCH 2/7] user login update --- .../detect_aws_console_login_by_new_user.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 406cfcff48..7fb1eafe28 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -11,13 +11,16 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` - | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) - as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=relative_time(now(),"-24h@h"), - "First Time Logging into AWS Console", "Previously Seen User") |where userStatus="First - Time Logging into AWS Console" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `detect_aws_console_login_by_new_user_filter`' +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user +| `drop_dm_object_name(Authentication)` +| join user type=outer + [ inputlookup previously_seen_users_console_logins + | stats min(firstTime) as earliestseen by user] +| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously Seen User") +| where userStatus="First Time Logging into AWS Console" +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_aws_console_login_by_new_user_filter`' how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users From fe7817f28afc5108c547534f8b127fa2daa7ceea Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 29 Nov 2021 13:43:41 -0700 Subject: [PATCH 3/7] Update detect_html_help_renamed.yml Fixing issue #1849 --- detections/endpoint/detect_html_help_renamed.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 22dce62ed2..93840b2101 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -20,7 +20,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' how_to_implement: To successfully implement this search you need to be ingesting information From 81e952185eecf04e4d9e7cf76be813fd8f96aa12 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 29 Nov 2021 15:55:38 -0700 Subject: [PATCH 4/7] Rclone Haagrid --- .../detect_rclone_command_line_usage.yml | 25 +++++++++---------- macros/process_rclone.yml | 3 +++ 2 files changed, 15 insertions(+), 13 deletions(-) create mode 100644 macros/process_rclone.yml diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 08e0895696..00d22ef4e7 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,34 +1,32 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: 1 -date: '2021-05-13' +version: 2 +date: '2021-11-29' author: Michael Haag, Splunk type: TTP datamodel: - Endpoint description: This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are - specific to the configuration used by adversaries. In particular, an adversary may + specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*", + as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: There is potential for false positives as these arguments may - be used by other applications. Filter or tune the analytic as needed. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed. references: -- https://redcanary.com/blog/rclone-mega-extortion/ -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + - https://redcanary.com/blog/rclone-mega-extortion/ + - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ tags: analytic_story: - DarkSide Ransomware @@ -78,5 +76,6 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id + - Processes.original_file_name risk_score: 35 security_domain: endpoint diff --git a/macros/process_rclone.yml b/macros/process_rclone.yml new file mode 100644 index 0000000000..e48ac559db --- /dev/null +++ b/macros/process_rclone.yml @@ -0,0 +1,3 @@ +definition: (Processes.original_file_name=rclone.exe AND Processes.process_name=rclone.exe) +description: Matches the process with its original file name. +name: process_rclone \ No newline at end of file From bae2e35b1ca8ae9fe2f8bf79cb6458dd6c8c0b94 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 29 Nov 2021 16:19:21 -0700 Subject: [PATCH 5/7] fix --- detections/endpoint/detect_rclone_command_line_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 00d22ef4e7..b276e55572 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. From b87061f7946e64f97d72ea30f625f5fe372d3a18 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 30 Nov 2021 05:34:29 -0700 Subject: [PATCH 6/7] rookie mistake --- macros/process_rclone.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/process_rclone.yml b/macros/process_rclone.yml index e48ac559db..ed64ce1f95 100644 --- a/macros/process_rclone.yml +++ b/macros/process_rclone.yml @@ -1,3 +1,3 @@ -definition: (Processes.original_file_name=rclone.exe AND Processes.process_name=rclone.exe) +definition: (Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe) description: Matches the process with its original file name. name: process_rclone \ No newline at end of file From e1947f155a1bbe161914be44456010e7db9fe814 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 30 Nov 2021 12:56:06 +0000 Subject: [PATCH 7/7] Added detection testing service results inDetect RClone Command-Line Usage --- .../detect_rclone_command_line_usage.yml | 29 +++++++++++-------- 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index b276e55572..0417b7d8c3 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -8,25 +8,30 @@ datamodel: - Endpoint description: This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are - specific to the configuration used by adversaries. In particular, an adversary may + specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process IN ("*copy*", - "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", + as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process + IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed. + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as this is restricted to + the Rclone process name. Filter or tune the analytic as needed. references: - - https://redcanary.com/blog/rclone-mega-extortion/ - - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ +- https://redcanary.com/blog/rclone-mega-extortion/ +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ tags: analytic_story: - DarkSide Ransomware