From 31621ad399ba20318d5598693fe51d4bca372848 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 8 Jan 2025 14:57:50 -0500 Subject: [PATCH 01/47] Add files via upload --- ..._sharepoint_suspicious_search_behavior.yml | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 detections/cloud/o365_sharepoint_suspicious_search_behavior.yml diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml new file mode 100644 index 0000000000..e538e1ee20 --- /dev/null +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -0,0 +1,73 @@ +name: O365 SharePoint Suspicious Search Behavior +id: 6ca919db-52f3-4c95-a4e9-7b189e8a043d +version: 1 +date: '2024-12-11' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic identifies when the O365 SharePoint users search for suspicious keywords or have an excessive number of queries within a limited timeframe. This behavior may indicate malicious actor enumeration of SharePoint based data within O365. +data_source: +- Office 365 Universal Audit Log +search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* +| where NOT (match(SearchQueryText, "\*") OR match(SearchQueryText,"(\*)")) +| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='EventData', command = SearchQueryText, -time = _time +| bin _time span=1hr +| stats values(object_name) as object_name values(command) as command, values(src) as src, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time +| where count > 20 OR match(command, "(?i)password|credential|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing") +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_sharepoint_suspicious_search_behavior_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds and match terms set within the analytic are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. +known_false_positives: Users searching excessively or possible false positives related to matching conditions. +references: +- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a +- https://attack.mitre.org/techniques/T1213/002/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate search behavior by $user$ + search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = $user|s$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Azure Active Directory Persistence + - Office 365 Account Takeover + - CISA AA22-320A + asset_type: O365 Tenant + confidence: 50 + impact: 50 + message: The SharePoint Online was searched suspiciously by $user$ + mitre_attack_id: + - T1213.002 + - T1552 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Workload + - Operation + - SearchQueryText + - EventData + - UserId + - _time + risk_score: 25 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.log + source: o365 + sourcetype: o365:management:activity \ No newline at end of file From 9eac24221c46dcd12e7292c3da529ffaf6c1299e Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 8 Jan 2025 15:21:40 -0500 Subject: [PATCH 02/47] Update o365_sharepoint_suspicious_search_behavior.yml --- detections/cloud/o365_sharepoint_suspicious_search_behavior.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml index e538e1ee20..528257fb2e 100644 --- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -70,4 +70,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.log source: o365 - sourcetype: o365:management:activity \ No newline at end of file + sourcetype: o365:management:activity From fd1b9e87d99f4bbaad597b42077e44623481fc27 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 8 Jan 2025 15:36:10 -0500 Subject: [PATCH 03/47] Update o365_sharepoint_suspicious_search_behavior.yml --- detections/cloud/o365_sharepoint_suspicious_search_behavior.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml index 528257fb2e..8b7ab1fd7c 100644 --- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -1,7 +1,7 @@ name: O365 SharePoint Suspicious Search Behavior id: 6ca919db-52f3-4c95-a4e9-7b189e8a043d version: 1 -date: '2024-12-11' +date: '2025-01-08' author: Steven Dick status: production type: Anomaly From 0adf9772461806599cdc66ecfcb307bf47efbf50 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 8 Jan 2025 15:39:12 -0500 Subject: [PATCH 04/47] Update o365_sharepoint_suspicious_search_behavior.yml --- detections/cloud/o365_sharepoint_suspicious_search_behavior.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml index 8b7ab1fd7c..5a3e714a8b 100644 --- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -10,7 +10,7 @@ data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* | where NOT (match(SearchQueryText, "\*") OR match(SearchQueryText,"(\*)")) -| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='EventData', command = SearchQueryText, -time = _time +| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=EventData, command = SearchQueryText, -time = _time | bin _time span=1hr | stats values(object_name) as object_name values(command) as command, values(src) as src, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time | where count > 20 OR match(command, "(?i)password|credential|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing") From fb41db923a14a4aad1677aff87afaf3ed97ef449 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 15 Jan 2025 13:55:06 -0500 Subject: [PATCH 05/47] Update o365_sharepoint_suspicious_search_behavior.yml --- detections/cloud/o365_sharepoint_suspicious_search_behavior.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml index 5a3e714a8b..b27959a2f6 100644 --- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -32,7 +32,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate search behavior by $user$ - search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = $user|s$' + search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: From 5ceb8c36e75adc70ad56db7d3daa0058f431f3a5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Jan 2025 14:42:01 +0100 Subject: [PATCH 06/47] analytics_enhancement --- ...ind_credentials_from_password_managers.yml | 6 +++--- ...ows_security_and_backup_services_stop.yml} | 21 +++++++++---------- macros/normalized_service_binary_field.yml | 4 ++++ 3 files changed, 17 insertions(+), 14 deletions(-) rename detections/endpoint/{known_services_killed_by_ransomware.yml => windows_security_and_backup_services_stop.yml} (73%) create mode 100644 macros/normalized_service_binary_field.yml diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 2a345f75c0..99b2e6bd55 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,7 +1,7 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-23' author: Teoderick Contreras, Splunk status: production type: TTP @@ -18,7 +18,7 @@ data_source: search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, - "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR + "%.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/windows_security_and_backup_services_stop.yml similarity index 73% rename from detections/endpoint/known_services_killed_by_ransomware.yml rename to detections/endpoint/windows_security_and_backup_services_stop.yml index 38760a26ef..6b76fd7c15 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/windows_security_and_backup_services_stop.yml @@ -1,7 +1,7 @@ -name: Known Services Killed by Ransomware +name: Windows Security And Backup Services Stop id: 3070f8e0-c528-11eb-b2a0-acde48001122 -version: 7 -date: '2024-12-10' +version: 8 +date: '2025-01-23' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,14 +15,13 @@ description: The following analytic detects the suspicious termination of known disruption and data loss. data_source: - Windows Event Log System 7036 -search: '`wineventlog_system` EventCode=7036 param1 IN ("*Volume Shadow Copy*","*VSS*", - "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch", - "ccEvtMgr", "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS", - "QBCFMonitorService", "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExec*", - "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend", "wscsvc", "Sense", "sppsvc", - "SecurityHealthService") param2="stopped" | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode param1 dest | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' +search: '`wineventlog_system` `normalized_service_binary_field` + | where param2="stopped" AND (match(service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") + OR match(binary_field, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode param1 dest service_name binary_field + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_security_and_backup_services_stop_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. known_false_positives: Admin activities or installing related updates may do a sudden diff --git a/macros/normalized_service_binary_field.yml b/macros/normalized_service_binary_field.yml new file mode 100644 index 0000000000..bc95ca8e35 --- /dev/null +++ b/macros/normalized_service_binary_field.yml @@ -0,0 +1,4 @@ +definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval binary_field = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)' +description: customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution. + Replace the macro definition with configurations for your Splunk Environment. +name: normalized_service_binary_field \ No newline at end of file From 13561988d378f00596a085935337acfbc6f10726 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 27 Jan 2025 12:17:39 +0100 Subject: [PATCH 07/47] analytics_enhancement --- ...mission_modification_using_takeown_app.yml | 8 +- .../suspicious_driver_loaded_path.yml | 10 +-- .../windows_driver_load_non_standard_path.yml | 4 +- .../windows_process_execution_in_temp_dir.yml | 88 +++++++++++++++++++ ... windows_suspicious_process_file_path.yml} | 29 +++--- 5 files changed, 113 insertions(+), 26 deletions(-) create mode 100644 detections/endpoint/windows_process_execution_in_temp_dir.yml rename detections/endpoint/{suspicious_process_file_path.yml => windows_suspicious_process_file_path.yml} (80%) diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 4d45a2bdcb..969495c055 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -1,10 +1,10 @@ name: Permission Modification using Takeown App id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the modification of file or directory permissions using the takeown.exe Windows application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include @@ -56,7 +56,7 @@ rba: risk_objects: - field: dest type: system - score: 56 + score: 30 threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 91196704e5..e8fa9850ab 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -1,7 +1,7 @@ -name: Suspicious Driver Loaded Path +name: Windows Suspicious Driver Loaded Path id: f880acd4-a8f1-11eb-a53b-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,7 +16,7 @@ description: The following analytic detects the loading of drivers from suspicio data_source: - Sysmon EventID 6 search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", - "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as + "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*","*:\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature Signed| rename ImageLoaded as file_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter`' @@ -47,7 +47,7 @@ rba: risk_objects: - field: dest type: system - score: 63 + score: 60 threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index bf5adb05b7..e4450d03c3 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -1,7 +1,7 @@ name: Windows Driver Load Non-Standard Path id: 9216ef3d-066a-4958-8f27-c84589465e62 version: 5 -date: '2024-11-13' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -17,7 +17,7 @@ data_source: - Windows Event Log System 7045 search: >- `wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" - | regex ImagePath!="(?i)^(\w:\\\\Windows\\\\|\w:\\\\Program\sFile|\\\\systemroot\\\\|%SystemRoot%|system32\\\\)" + | regex ImagePath!="(?i)^(\w:\\\\Windows\\\\|\w:\\\\Program\sFile|\\\\systemroot\\\\|%SystemRoot%|system32\\\\|\\\\ProgramData\\\\Microsoft\\\\Windows\sDefender\\\\Definition\sUpdates\\\\)" | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_driver_load_non_standard_path_filter` diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml new file mode 100644 index 0000000000..388e594cb6 --- /dev/null +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -0,0 +1,88 @@ +name: Windows Process Execution in Temp Dir +id: f6fbe929-4187-4ba4-901e-8a34be838443 +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies processes running from %temp% directory file paths. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint + data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_path IN("*\\temp\\*") + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_execution_in_temp_dir_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators may allow execution of specific binaries in + non-standard paths. Filter as needed. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious process $process_name$ running from temp directory- + $process_path$ on host- $dest$ + risk_objects: + - field: dest + type: system + score: 30 + threat_objects: + - field: process_path + type: process_name +tags: + analytic_story: + - WannaCry + - Ryuk + - TrickBot + - Qakbot + - AgentTesla + - Remcos + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1543 + - T1036 + - T1036.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/process_temp_path/process_temp_path.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml similarity index 80% rename from detections/endpoint/suspicious_process_file_path.yml rename to detections/endpoint/windows_suspicious_process_file_path.yml index 6686bd987c..81e681bfbe 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,7 +1,7 @@ -name: Suspicious Process File Path +name: Windows Suspicious Process File Path id: 9be25988-ad82-11eb-a14f-acde48001122 -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -19,16 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" - OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" - OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path = "*\\Users\\Administrator\\Music\\*" - OR Processes.process_path = "*\\Windows\\servicing\\*" OR Processes.process_path - = "*\\Users\\Default\\*" OR Processes.process_path = "*Recycle.bin*" OR Processes.process_path - = "*\\Windows\\Media\\*" OR Processes.process_path = "\\Windows\\repair\\*" OR Processes.process_path - = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" by Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `suspicious_process_file_path_filter`' + as lastTime from datamodel=Endpoint.Processes + where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -66,7 +63,7 @@ rba: risk_objects: - field: dest type: system - score: 35 + score: 60 threat_objects: - field: process_path type: process_name @@ -109,6 +106,8 @@ tags: asset_type: Endpoint mitre_attack_id: - T1543 + - T1036 + - T1036.005 product: - Splunk Enterprise - Splunk Enterprise Security @@ -118,6 +117,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog From 1de61a05778f04a768dcc5d0e3be2f603913c0f8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 27 Jan 2025 12:33:50 +0100 Subject: [PATCH 08/47] analytics_enhancement --- ...ux_auditd_file_permissions_modification_via_chattr.yml | 8 ++++---- ...linux_auditd_hidden_files_and_directories_creation.yml | 8 ++++---- detections/endpoint/linux_auditd_service_started.yml | 8 ++++---- detections/endpoint/linux_auditd_stop_services.yml | 8 ++++---- 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 3618f2cc1d..840d19b584 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,10 +1,10 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can @@ -53,7 +53,7 @@ rba: risk_objects: - field: dest type: system - score: 49 + score: 30 threat_objects: [] tags: analytic_story: diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 524c1ae9b6..04103e6e6b 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,10 +1,10 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection @@ -56,7 +56,7 @@ rba: risk_objects: - field: dest type: system - score: 64 + score: 30 threat_objects: [] tags: analytic_story: diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 2e878c1779..c6d354c32b 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,10 +1,10 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the suspicious service started. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious @@ -53,7 +53,7 @@ rba: risk_objects: - field: dest type: system - score: 64 + score: 30 threat_objects: [] tags: analytic_story: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 3715e29558..caf014d606 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,10 +1,10 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects attempts to stop or clear a service on Linux systems. It leverages data from Linux Auditd, focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. This activity is significant as @@ -52,7 +52,7 @@ rba: risk_objects: - field: dest type: system - score: 49 + score: 30 threat_objects: [] tags: analytic_story: From f7565834e9394d23e9a67873299ae016adf649f7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 30 Jan 2025 10:53:52 +0100 Subject: [PATCH 09/47] analytics_enhancement --- .../endpoint/windows_security_and_backup_services_stop.yml | 7 ++++--- macros/normalized_service_binary_field.yml | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_security_and_backup_services_stop.yml b/detections/endpoint/windows_security_and_backup_services_stop.yml index 6b76fd7c15..87474dc771 100644 --- a/detections/endpoint/windows_security_and_backup_services_stop.yml +++ b/detections/endpoint/windows_security_and_backup_services_stop.yml @@ -16,9 +16,10 @@ description: The following analytic detects the suspicious termination of known data_source: - Windows Event Log System 7036 search: '`wineventlog_system` `normalized_service_binary_field` - | where param2="stopped" AND (match(service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") - OR match(binary_field, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)")) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode param1 dest service_name binary_field + | rename param1 as display_name + | where param2="stopped" AND (match(display_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") + OR match(normalized_service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode display_name dest normalized_service_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_security_and_backup_services_stop_filter`' diff --git a/macros/normalized_service_binary_field.yml b/macros/normalized_service_binary_field.yml index bc95ca8e35..5053c86e94 100644 --- a/macros/normalized_service_binary_field.yml +++ b/macros/normalized_service_binary_field.yml @@ -1,4 +1,4 @@ -definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval binary_field = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)' +definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval normalized_service_name = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)' description: customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution. Replace the macro definition with configurations for your Splunk Environment. name: normalized_service_binary_field \ No newline at end of file From 97b27a672f974b043bb54af2d3df7e252c4e5fe8 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Sun, 2 Feb 2025 12:52:02 -0500 Subject: [PATCH 10/47] Update o365_sharepoint_suspicious_search_behavior.yml update to v5 yaml spec / update search yaml for better readability / remove single quote in SPL issues --- ..._sharepoint_suspicious_search_behavior.yml | 39 +++++++++---------- 1 file changed, 19 insertions(+), 20 deletions(-) diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml index b27959a2f6..559ace3f3b 100644 --- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -8,15 +8,16 @@ type: Anomaly description: The following analytic identifies when the O365 SharePoint users search for suspicious keywords or have an excessive number of queries within a limited timeframe. This behavior may indicate malicious actor enumeration of SharePoint based data within O365. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* -| where NOT (match(SearchQueryText, "\*") OR match(SearchQueryText,"(\*)")) -| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=EventData, command = SearchQueryText, -time = _time -| bin _time span=1hr -| stats values(object_name) as object_name values(command) as command, values(src) as src, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time -| where count > 20 OR match(command, "(?i)password|credential|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing") -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `o365_sharepoint_suspicious_search_behavior_filter`' +search: |- + `o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* + | where NOT (match(SearchQueryText, "\*") OR match(SearchQueryText,"(\*)")) + | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=EventData, command = SearchQueryText, -time = _time + | bin _time span=1hr + | stats values(object_name) as object_name values(command) as command, values(src) as src, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time + | where count > 20 OR match(command, "(?i)password|credential|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_sharepoint_suspicious_search_behavior_filter` how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds and match terms set within the analytic are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. known_false_positives: Users searching excessively or possible false positives related to matching conditions. references: @@ -35,15 +36,21 @@ drilldown_searches: search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: The SharePoint Online was searched suspiciously by $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: + - field: src + type: ip_address tags: analytic_story: - Azure Active Directory Persistence - Office 365 Account Takeover - CISA AA22-320A asset_type: O365 Tenant - confidence: 50 - impact: 50 - message: The SharePoint Online was searched suspiciously by $user$ mitre_attack_id: - T1213.002 - T1552 @@ -56,14 +63,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - Workload - - Operation - - SearchQueryText - - EventData - - UserId - - _time - risk_score: 25 security_domain: threat tests: - name: True Positive Test From d11d2df008b96ac47277be3b64a9debae6aac40f Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Sun, 2 Feb 2025 12:59:26 -0500 Subject: [PATCH 11/47] Update o365_sharepoint_suspicious_search_behavior.yml --- .../cloud/o365_sharepoint_suspicious_search_behavior.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml index 559ace3f3b..52449ed52b 100644 --- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml +++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml @@ -54,11 +54,6 @@ tags: mitre_attack_id: - T1213.002 - T1552 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security From a7ee87891106b5a76fbcc1058979987fc1d7503f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 3 Feb 2025 18:10:20 +0100 Subject: [PATCH 12/47] analytics_enhancement --- ...le_permissions_modification_via_chattr.yml | 40 +++------------ ...ind_credentials_from_password_managers.yml | 46 +++-------------- ..._hidden_files_and_directories_creation.yml | 43 +++------------- .../endpoint/linux_auditd_service_started.yml | 4 +- .../endpoint/linux_auditd_stop_services.yml | 50 ++++--------------- 5 files changed, 32 insertions(+), 151 deletions(-) diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 840d19b584..dbcde5f6e5 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,36 +1,16 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a version: 4 -date: '2025-01-27' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious file permissions modifications - using the chattr command, which may indicate an attacker attempting to manipulate - file attributes to evade detection or prevent alteration. The chattr command can - be used to make files immutable or restrict deletion, which can be leveraged to - protect malicious files or disrupt system operations. By monitoring for unusual - or unauthorized chattr usage, this analytic helps identify potential tampering with - critical files, enabling security teams to quickly respond to and mitigate threats - associated with unauthorized file attribute changes. +description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host - as dest | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") - | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle - normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_file_permissions_modification_via_chattr_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -39,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 99b2e6bd55..f7208fb980 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,42 +1,16 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 version: 4 -date: '2025-01-23' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find credentials - stored in password managers, which may indicate an attacker's effort to retrieve - sensitive login information. Password managers are often targeted by adversaries - seeking to access stored passwords for further compromise or lateral movement within - a network. By monitoring for unusual or unauthorized access to password manager - files or processes, this analytic helps identify potential credential theft attempts, - enabling security teams to respond quickly to protect critical accounts and prevent - further unauthorized access. +description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, - "%.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR - LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE - (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, - "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR - LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, - "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_find_credentials_from_password_managers_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -46,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -80,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 04103e6e6b..483150c621 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,39 +1,16 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 version: 5 -date: '2025-01-27' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious creation of hidden files and - directories, which may indicate an attacker's attempt to conceal malicious activities - or unauthorized data. Hidden files and directories are often used to evade detection - by security tools and administrators, providing a stealthy means for storing malware, - logs, or sensitive information. By monitoring for unusual or unauthorized creation - of hidden files and directories, this analytic helps identify potential attempts - to hide or unauthorized creation of hidden files and directories, this analytic - helps identify potential attempts to hide malicious operations, enabling security - teams to uncover and address hidden threats effectively. +description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR - LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano - %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," - /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_hidden_files_and_directories_creation_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -43,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -75,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index c6d354c32b..b7f231d583 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a version: 4 -date: '2025-01-27' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,7 +53,7 @@ rba: risk_objects: - field: dest type: system - score: 30 + score: 40 threat_objects: [] tags: analytic_story: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index caf014d606..23004f47e1 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,34 +1,16 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 -version: 4 -date: '2025-01-27' +version: 3 +date: '2024-12-16' author: Teoderick Contreras, Splunk status: production -type: Anomaly -description: The following analytic detects attempts to stop or clear a service on - Linux systems. It leverages data from Linux Auditd, focusing on processes like "systemctl," - "service," and "svcadm" executing stop commands. This activity is significant as - adversaries often terminate security or critical services to disable defenses or - disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, - this could lead to the disabling of security mechanisms, allowing attackers to persist, - escalate privileges, or deploy destructive payloads, severely impacting system integrity - and availability. +type: Hunting +description: The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 @@ -38,22 +20,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop or - disable a service. - risk_objects: - - field: dest - type: system - score: 30 - threat_objects: [] tags: analytic_story: - Industroyer2 @@ -71,7 +40,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log source: /var/log/audit/audit.log sourcetype: linux:audit From 37db646b29ef15a8c7526c441c70a77ad6565a07 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Jan 2025 14:42:01 +0100 Subject: [PATCH 13/47] analytics_enhancement --- ...ind_credentials_from_password_managers.yml | 29 +++++++++++++++---- ...ows_security_and_backup_services_stop.yml} | 21 +++++++------- macros/normalized_service_binary_field.yml | 4 +++ 3 files changed, 38 insertions(+), 16 deletions(-) rename detections/endpoint/{known_services_killed_by_ransomware.yml => windows_security_and_backup_services_stop.yml} (73%) create mode 100644 macros/normalized_service_binary_field.yml diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index f42a173862..e47547fad1 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,16 +1,35 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 -version: 3 -date: '2025-01-16' +version: 4 +date: '2025-01-23' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, + "%.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR + LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE + (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, + "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR + LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, + "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc + process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_find_credentials_from_password_managers_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/windows_security_and_backup_services_stop.yml similarity index 73% rename from detections/endpoint/known_services_killed_by_ransomware.yml rename to detections/endpoint/windows_security_and_backup_services_stop.yml index 38760a26ef..6b76fd7c15 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/windows_security_and_backup_services_stop.yml @@ -1,7 +1,7 @@ -name: Known Services Killed by Ransomware +name: Windows Security And Backup Services Stop id: 3070f8e0-c528-11eb-b2a0-acde48001122 -version: 7 -date: '2024-12-10' +version: 8 +date: '2025-01-23' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,14 +15,13 @@ description: The following analytic detects the suspicious termination of known disruption and data loss. data_source: - Windows Event Log System 7036 -search: '`wineventlog_system` EventCode=7036 param1 IN ("*Volume Shadow Copy*","*VSS*", - "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch", - "ccEvtMgr", "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS", - "QBCFMonitorService", "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExec*", - "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend", "wscsvc", "Sense", "sppsvc", - "SecurityHealthService") param2="stopped" | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode param1 dest | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' +search: '`wineventlog_system` `normalized_service_binary_field` + | where param2="stopped" AND (match(service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") + OR match(binary_field, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode param1 dest service_name binary_field + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_security_and_backup_services_stop_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. known_false_positives: Admin activities or installing related updates may do a sudden diff --git a/macros/normalized_service_binary_field.yml b/macros/normalized_service_binary_field.yml new file mode 100644 index 0000000000..bc95ca8e35 --- /dev/null +++ b/macros/normalized_service_binary_field.yml @@ -0,0 +1,4 @@ +definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval binary_field = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)' +description: customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution. + Replace the macro definition with configurations for your Splunk Environment. +name: normalized_service_binary_field \ No newline at end of file From 07cc1e4ca0325e0d7303c246d62fcd9a21280deb Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 27 Jan 2025 12:17:39 +0100 Subject: [PATCH 14/47] analytics_enhancement --- ...mission_modification_using_takeown_app.yml | 8 +- .../suspicious_driver_loaded_path.yml | 10 +-- .../windows_driver_load_non_standard_path.yml | 4 +- .../windows_process_execution_in_temp_dir.yml | 88 +++++++++++++++++++ ... windows_suspicious_process_file_path.yml} | 82 ++++++++--------- 5 files changed, 141 insertions(+), 51 deletions(-) create mode 100644 detections/endpoint/windows_process_execution_in_temp_dir.yml rename detections/endpoint/{suspicious_process_file_path.yml => windows_suspicious_process_file_path.yml} (80%) diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 8beee2753c..cb60ecf027 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -1,10 +1,10 @@ name: Permission Modification using Takeown App id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the modification of file or directory permissions using the takeown.exe Windows application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include @@ -56,7 +56,7 @@ rba: risk_objects: - field: dest type: system - score: 56 + score: 30 threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 91196704e5..e8fa9850ab 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -1,7 +1,7 @@ -name: Suspicious Driver Loaded Path +name: Windows Suspicious Driver Loaded Path id: f880acd4-a8f1-11eb-a53b-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,7 +16,7 @@ description: The following analytic detects the loading of drivers from suspicio data_source: - Sysmon EventID 6 search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", - "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as + "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*","*:\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature Signed| rename ImageLoaded as file_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter`' @@ -47,7 +47,7 @@ rba: risk_objects: - field: dest type: system - score: 63 + score: 60 threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index bf5adb05b7..e4450d03c3 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -1,7 +1,7 @@ name: Windows Driver Load Non-Standard Path id: 9216ef3d-066a-4958-8f27-c84589465e62 version: 5 -date: '2024-11-13' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -17,7 +17,7 @@ data_source: - Windows Event Log System 7045 search: >- `wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" - | regex ImagePath!="(?i)^(\w:\\\\Windows\\\\|\w:\\\\Program\sFile|\\\\systemroot\\\\|%SystemRoot%|system32\\\\)" + | regex ImagePath!="(?i)^(\w:\\\\Windows\\\\|\w:\\\\Program\sFile|\\\\systemroot\\\\|%SystemRoot%|system32\\\\|\\\\ProgramData\\\\Microsoft\\\\Windows\sDefender\\\\Definition\sUpdates\\\\)" | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_driver_load_non_standard_path_filter` diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml new file mode 100644 index 0000000000..388e594cb6 --- /dev/null +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -0,0 +1,88 @@ +name: Windows Process Execution in Temp Dir +id: f6fbe929-4187-4ba4-901e-8a34be838443 +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies processes running from %temp% directory file paths. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint + data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_path IN("*\\temp\\*") + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_execution_in_temp_dir_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators may allow execution of specific binaries in + non-standard paths. Filter as needed. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious process $process_name$ running from temp directory- + $process_path$ on host- $dest$ + risk_objects: + - field: dest + type: system + score: 30 + threat_objects: + - field: process_path + type: process_name +tags: + analytic_story: + - WannaCry + - Ryuk + - TrickBot + - Qakbot + - AgentTesla + - Remcos + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1543 + - T1036 + - T1036.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/process_temp_path/process_temp_path.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml similarity index 80% rename from detections/endpoint/suspicious_process_file_path.yml rename to detections/endpoint/windows_suspicious_process_file_path.yml index 1d636ec76c..81e681bfbe 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,7 +1,7 @@ -name: Suspicious Process File Path +name: Windows Suspicious Process File Path id: 9be25988-ad82-11eb-a14f-acde48001122 -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -17,14 +17,15 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", - "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", - "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", - "*\\temp\\*" , "*\\PerfLogs\\*","*\\windows\\tasks\\*", "*:\\programdata\\*") by - Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_path Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes + where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -62,50 +63,51 @@ rba: risk_objects: - field: dest type: system - score: 35 + score: 60 threat_objects: - field: process_path type: process_name tags: analytic_story: - - Volt Typhoon - - LockBit Ransomware - - Data Destruction - - XMRig - - DarkGate Malware - - Chaos Ransomware - Double Zero Destructor - - Hermetic Wiper - - Warzone RAT - - Phemedrone Stealer - - Prestige Ransomware - Graceful Wipe Out Attack - - BlackByte Ransomware - - IcedID - - Handala Wiper - - Meduza Stealer - - CISA AA23-347A - AsyncRAT - - Amadey - - Industroyer2 - - ValleyRAT - - Rhysida Ransomware - - DarkCrystal RAT - - Crypto Stealer - - Azorult - - Swift Slicer + - WhisperGate + - Prestige Ransomware + - DarkGate Malware - AgentTesla - - Qakbot - - Remcos - - Trickbot - Brute Ratel C4 - RedLine Stealer + - Rhysida Ransomware + - Swift Slicer + - IcedID + - DarkCrystal RAT + - Chaos Ransomware - PlugX + - Industroyer2 + - Azorult + - Remcos + - XMRig + - Qakbot + - Volt Typhoon + - Hermetic Wiper + - Warzone RAT + - Trickbot + - Amadey + - BlackByte Ransomware + - LockBit Ransomware + - CISA AA23-347A + - Data Destruction + - Phemedrone Stealer + - Handala Wiper - MoonPeak - - WhisperGate + - ValleyRAT + - Meduza Stealer asset_type: Endpoint mitre_attack_id: - T1543 + - T1036 + - T1036.005 product: - Splunk Enterprise - Splunk Enterprise Security @@ -115,6 +117,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog From 756b229e154259d6c1320583ff663cd21014771f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 27 Jan 2025 12:33:50 +0100 Subject: [PATCH 15/47] analytics_enhancement --- ...ile_permissions_modification_via_chattr.yml | 17 ++++++++++++----- ...d_hidden_files_and_directories_creation.yml | 18 +++++++++++++----- .../endpoint/linux_auditd_service_started.yml | 8 ++++---- 3 files changed, 29 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 84bb8beef4..27809ac12f 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,11 +1,18 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a -version: 3 -date: '2025-01-16' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes. +type: Anomaly +description: The following analytic detects suspicious file permissions modifications + using the chattr command, which may indicate an attacker attempting to manipulate + file attributes to evade detection or prevent alteration. The chattr command can + be used to make files immutable or restrict deletion, which can be leveraged to + protect malicious files or disrupt system operations. By monitoring for unusual + or unauthorized chattr usage, this analytic helps identify potential tampering with + critical files, enabling security teams to quickly respond to and mitigate threats + associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' @@ -28,7 +35,7 @@ rba: risk_objects: - field: dest type: system - score: 49 + score: 30 threat_objects: [] tags: analytic_story: diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index f888933bba..62f66f5597 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,11 +1,19 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 -version: 4 -date: '2025-01-16' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. +type: Anomaly +description: The following analytic detects suspicious creation of hidden files and + directories, which may indicate an attacker's attempt to conceal malicious activities + or unauthorized data. Hidden files and directories are often used to evade detection + by security tools and administrators, providing a stealthy means for storing malware, + logs, or sensitive information. By monitoring for unusual or unauthorized creation + of hidden files and directories, this analytic helps identify potential attempts + to hide or unauthorized creation of hidden files and directories, this analytic + helps identify potential attempts to hide malicious operations, enabling security + teams to uncover and address hidden threats effectively. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' @@ -28,7 +36,7 @@ rba: risk_objects: - field: dest type: system - score: 64 + score: 30 threat_objects: [] tags: analytic_story: diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 2e878c1779..c6d354c32b 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,10 +1,10 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the suspicious service started. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious @@ -53,7 +53,7 @@ rba: risk_objects: - field: dest type: system - score: 64 + score: 30 threat_objects: [] tags: analytic_story: From f78bd48e7ce8be2486dd067e54d56f4c1130e474 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 30 Jan 2025 10:53:52 +0100 Subject: [PATCH 16/47] analytics_enhancement --- .../endpoint/windows_security_and_backup_services_stop.yml | 7 ++++--- macros/normalized_service_binary_field.yml | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_security_and_backup_services_stop.yml b/detections/endpoint/windows_security_and_backup_services_stop.yml index 6b76fd7c15..87474dc771 100644 --- a/detections/endpoint/windows_security_and_backup_services_stop.yml +++ b/detections/endpoint/windows_security_and_backup_services_stop.yml @@ -16,9 +16,10 @@ description: The following analytic detects the suspicious termination of known data_source: - Windows Event Log System 7036 search: '`wineventlog_system` `normalized_service_binary_field` - | where param2="stopped" AND (match(service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") - OR match(binary_field, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)")) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode param1 dest service_name binary_field + | rename param1 as display_name + | where param2="stopped" AND (match(display_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") + OR match(normalized_service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode display_name dest normalized_service_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_security_and_backup_services_stop_filter`' diff --git a/macros/normalized_service_binary_field.yml b/macros/normalized_service_binary_field.yml index bc95ca8e35..5053c86e94 100644 --- a/macros/normalized_service_binary_field.yml +++ b/macros/normalized_service_binary_field.yml @@ -1,4 +1,4 @@ -definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval binary_field = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)' +definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval normalized_service_name = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)' description: customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution. Replace the macro definition with configurations for your Splunk Environment. name: normalized_service_binary_field \ No newline at end of file From 191f94eb3d245d74d5eaedb76646d476737404f1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 3 Feb 2025 18:10:20 +0100 Subject: [PATCH 17/47] analytics_enhancement --- ...le_permissions_modification_via_chattr.yml | 11 ++------ ...ind_credentials_from_password_managers.yml | 27 +++---------------- ..._hidden_files_and_directories_creation.yml | 12 ++------- .../endpoint/linux_auditd_service_started.yml | 4 +-- 4 files changed, 10 insertions(+), 44 deletions(-) diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 27809ac12f..dbcde5f6e5 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,18 +1,11 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a version: 4 -date: '2025-01-27' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious file permissions modifications - using the chattr command, which may indicate an attacker attempting to manipulate - file attributes to evade detection or prevent alteration. The chattr command can - be used to make files immutable or restrict deletion, which can be leveraged to - protect malicious files or disrupt system operations. By monitoring for unusual - or unauthorized chattr usage, this analytic helps identify potential tampering with - critical files, enabling security teams to quickly respond to and mitigate threats - associated with unauthorized file attribute changes. +description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index e47547fad1..f7208fb980 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,35 +1,16 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 version: 4 -date: '2025-01-23' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, - "%.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR - LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE - (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, - "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR - LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, - "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_find_credentials_from_password_managers_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 62f66f5597..483150c621 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,19 +1,11 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 version: 5 -date: '2025-01-27' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious creation of hidden files and - directories, which may indicate an attacker's attempt to conceal malicious activities - or unauthorized data. Hidden files and directories are often used to evade detection - by security tools and administrators, providing a stealthy means for storing malware, - logs, or sensitive information. By monitoring for unusual or unauthorized creation - of hidden files and directories, this analytic helps identify potential attempts - to hide or unauthorized creation of hidden files and directories, this analytic - helps identify potential attempts to hide malicious operations, enabling security - teams to uncover and address hidden threats effectively. +description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index c6d354c32b..b7f231d583 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a version: 4 -date: '2025-01-27' +date: '2025-02-03' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,7 +53,7 @@ rba: risk_objects: - field: dest type: system - score: 30 + score: 40 threat_objects: [] tags: analytic_story: From 8b3d6685f02752f59fec424965c7060d3f81e14e Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 3 Feb 2025 18:57:08 +0100 Subject: [PATCH 18/47] CI fixes --- .../suspicious_driver_loaded_path.yml | 10 +-- .../windows_process_execution_in_temp_dir.yml | 6 +- .../windows_suspicious_driver_loaded_path.yml | 76 +++++++++++++++++++ 3 files changed, 84 insertions(+), 8 deletions(-) rename detections/{endpoint => deprecated}/suspicious_driver_loaded_path.yml (92%) create mode 100644 detections/endpoint/windows_suspicious_driver_loaded_path.yml diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/deprecated/suspicious_driver_loaded_path.yml similarity index 92% rename from detections/endpoint/suspicious_driver_loaded_path.yml rename to detections/deprecated/suspicious_driver_loaded_path.yml index e8fa9850ab..3231ca26e8 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/deprecated/suspicious_driver_loaded_path.yml @@ -1,9 +1,9 @@ -name: Windows Suspicious Driver Loaded Path +name: Suspicious Driver Loaded Path id: f880acd4-a8f1-11eb-a53b-acde48001122 version: 5 -date: '2025-01-27' +date: '2025-02-03' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners @@ -16,7 +16,7 @@ description: The following analytic detects the loading of drivers from suspicio data_source: - Sysmon EventID 6 search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", - "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*","*:\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*")) | stats min(_time) as + "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature Signed| rename ImageLoaded as file_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter`' @@ -47,7 +47,7 @@ rba: risk_objects: - field: dest type: system - score: 60 + score: 63 threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml index 388e594cb6..9d62c1e72a 100644 --- a/detections/endpoint/windows_process_execution_in_temp_dir.yml +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -62,13 +62,13 @@ rba: type: process_name tags: analytic_story: - - WannaCry - - Ryuk - - TrickBot + - Ryuk Ransomware + - Trickbot - Qakbot - AgentTesla - Remcos - NjRAT + - Ransomware asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/windows_suspicious_driver_loaded_path.yml b/detections/endpoint/windows_suspicious_driver_loaded_path.yml new file mode 100644 index 0000000000..34f30e0ca3 --- /dev/null +++ b/detections/endpoint/windows_suspicious_driver_loaded_path.yml @@ -0,0 +1,76 @@ +name: Windows Suspicious Driver Loaded Path +id: 2ca1c4a1-8342-4750-9363-905650e0c933 +version: 1 +date: '2025-02-03' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects the loading of drivers from suspicious + paths, which is a technique often used by malicious software such as coin miners + (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard + directories. This activity is significant because legitimate drivers typically reside + in specific system directories, and deviations may indicate malicious activity. + If confirmed malicious, this could allow an attacker to execute code at the kernel + level, potentially leading to privilege escalation, persistence, or further system + compromise. +data_source: +- Sysmon EventID 6 +search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", + "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*","*:\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*")) | stats min(_time) as + firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature + Signed| rename ImageLoaded as file_name | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `windows_suspicious_driver_loaded_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Limited false positives will be present. Some applications + do load drivers +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious driver $file_name$ on $dest$ + risk_objects: + - field: dest + type: system + score: 60 + threat_objects: + - field: file_name + type: file_name +tags: + analytic_story: + - XMRig + - CISA AA22-320A + - AgentTesla + - BlackByte Ransomware + - Snake Keylogger + asset_type: Endpoint + mitre_attack_id: + - T1543.003 + - T1543 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog From 988fd0f1e424e886363dfcdac9a62e63a6822e2b Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 07:52:12 -0500 Subject: [PATCH 19/47] Update detect_remote_access_software_usage_dns.yml --- .../network/detect_remote_access_software_usage_dns.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index e01bd31544..2f09884750 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -52,6 +52,10 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +- name: Investigate traffic to $query$ + search: '| from datamodel:Network_Resolution.DNS | search src=$src$ query=$query$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A domain for a known remote access software $query$ was contacted by $src$. risk_objects: From d73c82d75f080b46b02e2ae137b2d273d715aedf Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 07:53:20 -0500 Subject: [PATCH 20/47] Add files via upload --- ...ote_monitoring_and_management_software.yml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 stories/remote_monitoring_and_management_software.yml diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml new file mode 100644 index 0000000000..6027d0d472 --- /dev/null +++ b/stories/remote_monitoring_and_management_software.yml @@ -0,0 +1,20 @@ +name: Remote Monitoring and Management Software +id: e405907a-273c-41c9-928c-768c9355c1f7 +version: 1 +date: '2035-01-14' +author: Steven Dick +description: Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM). +narrative: Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators. +references: +- https://attack.mitre.org/techniques/T1219/ +- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ +- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ +tags: + category: + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring \ No newline at end of file From 8b0bf13a10b1eef289f67837e0fc76249c898658 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 07:53:56 -0500 Subject: [PATCH 21/47] Update detect_remote_access_software_usage_dns.yml --- detections/network/detect_remote_access_software_usage_dns.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 2f09884750..d7501d2270 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -71,6 +71,7 @@ tags: - Command And Control - Ransomware - CISA AA24-241A + - Remote Monitoring and Management Software asset_type: Endpoint mitre_attack_id: - T1219 From db40375a6b7e0d532d66615ffc43b154df0f07e5 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 07:55:50 -0500 Subject: [PATCH 22/47] Update detect_remote_access_software_usage_traffic.yml --- .../detect_remote_access_software_usage_traffic.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index aeb0b45f21..26c57fe5b8 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 5 +version: 6 date: '2024-11-15' author: Steven Dick status: production @@ -52,6 +52,10 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +- name: Investigate application traffic for $app$ + search: '| from datamodel:Network_Traffic.All_Traffic | search src=$src$ app=$app$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: Application traffic for a known remote access software [$signature$] was detected from $src$. @@ -59,12 +63,15 @@ rba: - field: src type: system score: 25 - threat_objects: [] + threat_objects: + - field: signature + type: signature tags: analytic_story: - Insider Threat - Command And Control - Ransomware + - Remote Monitoring and Management Software asset_type: Network mitre_attack_id: - T1219 From 2447329ea9bec889c7cb3e0e5b9de1b83812b71a Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 07:56:12 -0500 Subject: [PATCH 23/47] Update detect_remote_access_software_usage_dns.yml --- detections/network/detect_remote_access_software_usage_dns.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index d7501d2270..73c0110bc3 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 5 +version: 6 date: '2024-11-15' author: Steven Dick status: production From 7773664924de1d4f222c5e7252bdf27b10190c17 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 07:57:46 -0500 Subject: [PATCH 24/47] Update detect_remote_access_software_usage_url.yml --- detections/web/detect_remote_access_software_usage_url.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 4e51d42198..f47dee1569 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 6 +version: 7 date: '2024-11-15' author: Steven Dick status: production @@ -52,6 +52,10 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +- name: Investigate traffic to $url_domain$ + search: '| from datamodel:Web | search src=$src$ url_domain=$url_domain$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A domain for a known remote access software $url_domain$ was contacted by $src$. @@ -71,6 +75,7 @@ tags: - Command And Control - Ransomware - CISA AA24-241A + - Remote Monitoring and Management Software asset_type: Network mitre_attack_id: - T1219 From dea4448a4f3f800357cb682facc5287dfb791c3d Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 07:58:47 -0500 Subject: [PATCH 25/47] Update detect_remote_access_software_usage_file.yml --- .../endpoint/detect_remote_access_software_usage_file.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index a9d1005364..8dd08118de 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick status: production @@ -54,6 +54,10 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +- name: Investigate files on $dest$ + search: '| from datamodel:Endpoint.Filesystem | search dest=$dest$ file_name=$file_name$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$. @@ -74,6 +78,7 @@ tags: - Ransomware - Gozi Malware - CISA AA24-241A + - Remote Monitoring and Management Software asset_type: Endpoint mitre_attack_id: - T1219 From 38af78103f4f9ea2895dfd36a11ecb29f4c80f8c Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:00:27 -0500 Subject: [PATCH 26/47] Update detect_remote_access_software_usage_fileinfo.yml --- .../detect_remote_access_software_usage_fileinfo.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 8286572d72..f62fa7e159 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick status: production @@ -47,6 +47,10 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +- name: Investigate processes on $dest$ + search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A file attributes for known a remote access software [$process_name$] was detected on $dest$ @@ -54,6 +58,9 @@ rba: - field: dest type: system score: 25 + - field: user + type: user + score: 25 threat_objects: - field: process_name type: process_name @@ -63,6 +70,7 @@ tags: - Command And Control - Ransomware - Gozi Malware + - Remote Monitoring and Management Software asset_type: Endpoint mitre_attack_id: - T1219 From 778d7fa7cd4d3031216339eddea988ca34723ee7 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:01:53 -0500 Subject: [PATCH 27/47] Update detect_remote_access_software_usage_process.yml --- .../detect_remote_access_software_usage_process.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 8a5dfd6d64..e0417a4071 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick status: production @@ -59,6 +59,10 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +- name: Investigate processes on $dest$ + search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: message: A process for a known remote access software $process_name$ was identified on $dest$. @@ -72,6 +76,8 @@ rba: threat_objects: - field: process_name type: process_name + - field: signature + type: signature tags: analytic_story: - Insider Threat @@ -79,6 +85,7 @@ tags: - Ransomware - Gozi Malware - CISA AA24-241A + - Remote Monitoring and Management Software asset_type: Endpoint mitre_attack_id: - T1219 From b85aacf75fcdfc50830560f4432970b4f98575e0 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:02:38 -0500 Subject: [PATCH 28/47] Update detect_remote_access_software_usage_registry.yml --- .../endpoint/detect_remote_access_software_usage_registry.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index 93e927f108..a757b157c9 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 2 +version: 3 date: '2025-01-10' author: Steven Dick status: production @@ -60,6 +60,7 @@ tags: - Ransomware - Gozi Malware - CISA AA24-241A + - Remote Monitoring and Management Software asset_type: Endpoint mitre_attack_id: - T1219 From f4a78d9f60130d2f1d7e8e4c5911f3e623bc7c52 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:03:25 -0500 Subject: [PATCH 29/47] Update detect_remote_access_software_usage_fileinfo.yml --- .../endpoint/detect_remote_access_software_usage_fileinfo.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index f62fa7e159..b1a9ef4f84 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -64,6 +64,8 @@ rba: threat_objects: - field: process_name type: process_name + - field: signature + type: signature tags: analytic_story: - Insider Threat From 0885f557bb491b2bf881523f20c5d453eb8fe9ca Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:03:56 -0500 Subject: [PATCH 30/47] Update detect_remote_access_software_usage_file.yml --- .../endpoint/detect_remote_access_software_usage_file.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 8dd08118de..25292e24c2 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -71,6 +71,8 @@ rba: threat_objects: - field: file_name type: file_name + - field: signature + type: signature tags: analytic_story: - Insider Threat From 41c92476b9714ab9d8375bc835633ec296f5f540 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:04:38 -0500 Subject: [PATCH 31/47] Update detect_remote_access_software_usage_url.yml --- detections/web/detect_remote_access_software_usage_url.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index f47dee1569..6f186e9379 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -69,6 +69,8 @@ rba: threat_objects: - field: url_domain type: domain + - field: signature + type: signature tags: analytic_story: - Insider Threat From 8d3da805575c3cb0f894ab6e9dbfbfad8d718891 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:05:27 -0500 Subject: [PATCH 32/47] Update detect_remote_access_software_usage_dns.yml --- detections/network/detect_remote_access_software_usage_dns.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 73c0110bc3..8da3b18104 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -65,6 +65,8 @@ rba: threat_objects: - field: query type: domain + - field: signature + type: signature tags: analytic_story: - Insider Threat From f5160eba6f4a2ad441dd303420e75986dbb83510 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:06:29 -0500 Subject: [PATCH 33/47] Update detect_remote_access_software_usage_traffic.yml --- .../network/detect_remote_access_software_usage_traffic.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 26c57fe5b8..526fe6f906 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -63,6 +63,9 @@ rba: - field: src type: system score: 25 + - field: user + type: user + score: 25 threat_objects: - field: signature type: signature From ef5eca5bd17ceb4327a9977280d2b7d4ab2c85ee Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:07:31 -0500 Subject: [PATCH 34/47] Update detect_remote_access_software_usage_dns.yml --- detections/network/detect_remote_access_software_usage_dns.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 8da3b18104..f7744a4f63 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -61,7 +61,7 @@ rba: risk_objects: - field: src type: system - score: 4 + score: 25 threat_objects: - field: query type: domain From 911ebe61fd3062f4f7e2db8e54e217f3a9be20c7 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:18:05 -0500 Subject: [PATCH 35/47] Update remote_monitoring_and_management_software.yml --- stories/remote_monitoring_and_management_software.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml index 6027d0d472..8050fdefc7 100644 --- a/stories/remote_monitoring_and_management_software.yml +++ b/stories/remote_monitoring_and_management_software.yml @@ -3,8 +3,12 @@ id: e405907a-273c-41c9-928c-768c9355c1f7 version: 1 date: '2035-01-14' author: Steven Dick -description: Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM). -narrative: Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators. +description: |- + Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM). +narrative: |- + Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators. + + Be sure to leverage the "RMM Software Tracking" dashboard provided with this story for a convienent way to vizualize RMM usage in your enviroment. references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -17,4 +21,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Security Monitoring \ No newline at end of file + usecase: Security Monitoring From 30edc65d040d38391805027db661db136b9c19a9 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:18:27 -0500 Subject: [PATCH 36/47] Update remote_monitoring_and_management_software.yml --- stories/remote_monitoring_and_management_software.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml index 8050fdefc7..d49b11948a 100644 --- a/stories/remote_monitoring_and_management_software.yml +++ b/stories/remote_monitoring_and_management_software.yml @@ -1,7 +1,7 @@ name: Remote Monitoring and Management Software id: e405907a-273c-41c9-928c-768c9355c1f7 version: 1 -date: '2035-01-14' +date: '2025-01-14' author: Steven Dick description: |- Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM). From 9658514c13464dab6ea8aca00c701f3701119568 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Thu, 6 Feb 2025 08:24:08 -0500 Subject: [PATCH 37/47] Update remote_monitoring_and_management_software.yml --- stories/remote_monitoring_and_management_software.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml index d49b11948a..f76cde7141 100644 --- a/stories/remote_monitoring_and_management_software.yml +++ b/stories/remote_monitoring_and_management_software.yml @@ -3,6 +3,7 @@ id: e405907a-273c-41c9-928c-768c9355c1f7 version: 1 date: '2025-01-14' author: Steven Dick +status: production description: |- Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM). narrative: |- From f97787306f0adcbf7f49b184d6a305d1c1255bdb Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Thu, 6 Feb 2025 17:02:59 +0100 Subject: [PATCH 38/47] Update suspicious_driver_loaded_path.yml --- detections/deprecated/suspicious_driver_loaded_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/deprecated/suspicious_driver_loaded_path.yml b/detections/deprecated/suspicious_driver_loaded_path.yml index 3231ca26e8..e185b811b3 100644 --- a/detections/deprecated/suspicious_driver_loaded_path.yml +++ b/detections/deprecated/suspicious_driver_loaded_path.yml @@ -1,7 +1,7 @@ name: Suspicious Driver Loaded Path id: f880acd4-a8f1-11eb-a53b-acde48001122 -version: 5 -date: '2025-02-03' +version: 6 +date: '2025-02-06' author: Teoderick Contreras, Splunk status: deprecated type: TTP From 636e63d4924c60c9c971c9fcc0b20c07d861547c Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Thu, 6 Feb 2025 17:42:14 +0100 Subject: [PATCH 39/47] Update windows_driver_load_non_standard_path.yml --- detections/endpoint/windows_driver_load_non_standard_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index e4450d03c3..e36e98bcbd 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows Driver Load Non-Standard Path id: 9216ef3d-066a-4958-8f27-c84589465e62 -version: 5 +version: 6 date: '2025-01-27' author: Michael Haag, Splunk status: production From abd24d63bcdff207a7c34b67a825cdec2112904d Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Thu, 6 Feb 2025 18:59:01 +0100 Subject: [PATCH 40/47] Update windows_security_and_backup_services_stop.yml --- .../endpoint/windows_security_and_backup_services_stop.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_security_and_backup_services_stop.yml b/detections/endpoint/windows_security_and_backup_services_stop.yml index 87474dc771..779bb96d51 100644 --- a/detections/endpoint/windows_security_and_backup_services_stop.yml +++ b/detections/endpoint/windows_security_and_backup_services_stop.yml @@ -53,7 +53,7 @@ rba: type: system score: 72 threat_objects: - - field: param1 + - field: display_name type: service tags: analytic_story: From f33a18e9cf916380f3990cc489d2e24f64288ddf Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 7 Feb 2025 09:49:06 +0100 Subject: [PATCH 41/47] analytics_enhancement --- .../known_services_killed_by_ransomware.yml | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 detections/deprecated/known_services_killed_by_ransomware.yml diff --git a/detections/deprecated/known_services_killed_by_ransomware.yml b/detections/deprecated/known_services_killed_by_ransomware.yml new file mode 100644 index 0000000000..3eb02e567b --- /dev/null +++ b/detections/deprecated/known_services_killed_by_ransomware.yml @@ -0,0 +1,78 @@ +name: Known Services Killed by Ransomware +id: 3070f8e0-c528-11eb-b2a0-acde48001122 +version: 7 +date: '2024-12-10' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic detects the suspicious termination of known services + commonly targeted by ransomware before file encryption. It leverages Windows System + Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow + Copy, backup, and antivirus services are stopped. This activity is significant because + ransomware often disables these services to avoid errors and ensure successful file + encryption. If confirmed malicious, this behavior could lead to widespread data + encryption, rendering files inaccessible and potentially causing significant operational + disruption and data loss. +data_source: +- Windows Event Log System 7036 +search: '`wineventlog_system` EventCode=7036 param1 IN ("*Volume Shadow Copy*","*VSS*", + "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch", + "ccEvtMgr", "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS", + "QBCFMonitorService", "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExec*", + "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc", "WinDefend", "wscsvc", "Sense", "sppsvc", + "SecurityHealthService") param2="stopped" | stats count min(_time) as firstTime + max(_time) as lastTime by EventCode param1 dest | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. +known_false_positives: Admin activities or installing related updates may do a sudden + stop to list of services we monitor. +references: +- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Known services $param1$ terminated by a potential ransomware on $dest$ + risk_objects: + - field: dest + type: system + score: 72 + threat_objects: + - field: param1 + type: service +tags: + analytic_story: + - LockBit Ransomware + - Ransomware + - Compromised Windows Host + - BlackMatter Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/windows-xml.log + source: XmlWinEventLog:System + sourcetype: XmlWinEventLog \ No newline at end of file From 153871c33ff676d26484cfb947c005b139042fda Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 7 Feb 2025 09:53:03 +0100 Subject: [PATCH 42/47] analytics_enhancement --- .../endpoint/windows_security_and_backup_services_stop.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_security_and_backup_services_stop.yml b/detections/endpoint/windows_security_and_backup_services_stop.yml index 779bb96d51..47e8f2e8cf 100644 --- a/detections/endpoint/windows_security_and_backup_services_stop.yml +++ b/detections/endpoint/windows_security_and_backup_services_stop.yml @@ -1,7 +1,7 @@ name: Windows Security And Backup Services Stop -id: 3070f8e0-c528-11eb-b2a0-acde48001122 -version: 8 -date: '2025-01-23' +id: 9c24aef6-cad9-4931-acce-74318aa5663b +version: 1 +date: '2025-02-07' author: Teoderick Contreras, Splunk status: production type: TTP From 1ed454b5bc1435f2b446261f93151a64dd3e326c Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 7 Feb 2025 09:56:32 +0100 Subject: [PATCH 43/47] analytics_enhancement --- detections/deprecated/known_services_killed_by_ransomware.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/deprecated/known_services_killed_by_ransomware.yml b/detections/deprecated/known_services_killed_by_ransomware.yml index 3eb02e567b..6f7810a803 100644 --- a/detections/deprecated/known_services_killed_by_ransomware.yml +++ b/detections/deprecated/known_services_killed_by_ransomware.yml @@ -1,7 +1,7 @@ name: Known Services Killed by Ransomware id: 3070f8e0-c528-11eb-b2a0-acde48001122 -version: 7 -date: '2024-12-10' +version: 8 +date: '2025-02-07' author: Teoderick Contreras, Splunk status: deprecated type: TTP From 67844bec4e0e5f563ace95f289aed089f68ed266 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 10 Feb 2025 09:36:32 +0100 Subject: [PATCH 44/47] analytics_enhancement --- .../suspicious_process_file_path.yml | 120 ++++++++++++++++++ 1 file changed, 120 insertions(+) create mode 100644 detections/deprecated/suspicious_process_file_path.yml diff --git a/detections/deprecated/suspicious_process_file_path.yml b/detections/deprecated/suspicious_process_file_path.yml new file mode 100644 index 0000000000..49ad0f470f --- /dev/null +++ b/detections/deprecated/suspicious_process_file_path.yml @@ -0,0 +1,120 @@ +name: Suspicious Process File Path +id: 9be25988-ad82-11eb-a14f-acde48001122 +version: 6 +date: '2024-12-10' +author: Teoderick Contreras, Splunk +status: deprecated +type: +description: The following analytic identifies processes running from file paths not + typically associated with legitimate software. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on specific process paths within the Endpoint + data model. This activity is significant because adversaries often use unconventional + file paths to execute malicious code without requiring administrative privileges. + If confirmed malicious, this behavior could indicate an attempt to bypass security + controls, leading to unauthorized software execution, potential system compromise, + and further malicious activities within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", + "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", + "*\\temp\\*" , "*\\PerfLogs\\*","*\\windows\\tasks\\*", "*:\\programdata\\*") by + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_path Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators may allow execution of specific binaries in + non-standard paths. Filter as needed. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious process $process_name$ running from a suspicious process path- + $process_path$ on host- $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: + - field: process_path + type: process_name +tags: + analytic_story: + - Volt Typhoon + - LockBit Ransomware + - Data Destruction + - XMRig + - DarkGate Malware + - Chaos Ransomware + - Double Zero Destructor + - Hermetic Wiper + - Warzone RAT + - Phemedrone Stealer + - Prestige Ransomware + - Graceful Wipe Out Attack + - BlackByte Ransomware + - IcedID + - Handala Wiper + - Meduza Stealer + - CISA AA23-347A + - AsyncRAT + - Amadey + - Industroyer2 + - ValleyRAT + - Rhysida Ransomware + - DarkCrystal RAT + - Crypto Stealer + - Azorult + - Swift Slicer + - AgentTesla + - Qakbot + - Remcos + - Trickbot + - Brute Ratel C4 + - RedLine Stealer + - PlugX + - MoonPeak + - WhisperGate + asset_type: Endpoint + mitre_attack_id: + - T1543 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file From 51ae906f15c78fddf71f877fa7f71a1b0b529f66 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 10 Feb 2025 09:39:53 +0100 Subject: [PATCH 45/47] analytics_enhancement --- detections/deprecated/suspicious_process_file_path.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/deprecated/suspicious_process_file_path.yml b/detections/deprecated/suspicious_process_file_path.yml index 49ad0f470f..ca7a50a91f 100644 --- a/detections/deprecated/suspicious_process_file_path.yml +++ b/detections/deprecated/suspicious_process_file_path.yml @@ -1,10 +1,10 @@ name: Suspicious Process File Path id: 9be25988-ad82-11eb-a14f-acde48001122 -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-02-10' author: Teoderick Contreras, Splunk status: deprecated -type: +type: TTP description: The following analytic identifies processes running from file paths not typically associated with legitimate software. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint From b09110908d058a8ff66c8208d3f0d0d728004721 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 10 Feb 2025 09:43:20 +0100 Subject: [PATCH 46/47] analytics_enhancement --- detections/endpoint/windows_suspicious_process_file_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 81e681bfbe..07575cad56 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Windows Suspicious Process File Path -id: 9be25988-ad82-11eb-a14f-acde48001122 +id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 version: 7 -date: '2025-01-27' +date: '2025-02-10' author: Teoderick Contreras, Splunk status: production type: TTP From 15ab58b7981c4832e14dec3b1665a0e0e85bcfc5 Mon Sep 17 00:00:00 2001 From: research-bot Date: Mon, 10 Feb 2025 14:02:05 -0800 Subject: [PATCH 47/47] updating descirption --- detections/deprecated/known_services_killed_by_ransomware.yml | 2 +- detections/deprecated/suspicious_driver_loaded_path.yml | 2 +- detections/deprecated/suspicious_process_file_path.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/deprecated/known_services_killed_by_ransomware.yml b/detections/deprecated/known_services_killed_by_ransomware.yml index 6f7810a803..5ca93f96d4 100644 --- a/detections/deprecated/known_services_killed_by_ransomware.yml +++ b/detections/deprecated/known_services_killed_by_ransomware.yml @@ -5,7 +5,7 @@ date: '2025-02-07' author: Teoderick Contreras, Splunk status: deprecated type: TTP -description: The following analytic detects the suspicious termination of known services +description: This analytic has been deprecated in favor of a new analytic - Windows Security And Backup Services Stop. The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because diff --git a/detections/deprecated/suspicious_driver_loaded_path.yml b/detections/deprecated/suspicious_driver_loaded_path.yml index e185b811b3..fe85558d6d 100644 --- a/detections/deprecated/suspicious_driver_loaded_path.yml +++ b/detections/deprecated/suspicious_driver_loaded_path.yml @@ -5,7 +5,7 @@ date: '2025-02-06' author: Teoderick Contreras, Splunk status: deprecated type: TTP -description: The following analytic detects the loading of drivers from suspicious +description: This search has been deprecated in favour of - Windows Suspicious Driver Loaded Path. The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard directories. This activity is significant because legitimate drivers typically reside diff --git a/detections/deprecated/suspicious_process_file_path.yml b/detections/deprecated/suspicious_process_file_path.yml index ca7a50a91f..d7cd62534f 100644 --- a/detections/deprecated/suspicious_process_file_path.yml +++ b/detections/deprecated/suspicious_process_file_path.yml @@ -5,7 +5,7 @@ date: '2025-02-10' author: Teoderick Contreras, Splunk status: deprecated type: TTP -description: The following analytic identifies processes running from file paths not +description: This search has been deprecated in favour of - Windows Suspicious Process File Path. The following analytic identifies processes running from file paths not typically associated with legitimate software. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional