diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 4508894ffc..1b87b6e3f7 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This particular behavior is typically executed when an adversaries or - malware gains access to an endpoint and beings to perform execution and to evade - detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled +description: This particular behavior is typically executed when an adversary or + malware gains access to an endpoint and begins to perform execution and to evade + detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry @@ -33,7 +33,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Windows Registry Abuse confidence: 70 context: diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 0d0c0f0518..ede167e758 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of registry to disable - windows defender feature. This technique is to bypassed or evade detection from - Windows Defender AV product specially the BlockAtFirstSeen feature where it block - suspicious file first seen in the host. +description: This analytic is intended to detect a suspicious modification of the Windows registry to disable + a Windows Defender feature. This technique is intended to bypass or evade detection from + Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks + suspicious files the first time seen on the host. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h @@ -32,7 +32,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Windows Registry Abuse - Azorult confidence: 70 diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index c0a2da5e5f..0af4d6d4bf 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of registry to disable - windows defender feature. This technique is to bypassed or evade detection from - Windows Defender AV product specially the Enhanced Notification feature wher user - or admin set to show or display alerts. +description: This analytic is intended to detect a suspicious modification of registry to disable + windows defender features. This technique attempts to bypass or evade detection from + Windows Defender AV, specifically the Enhanced Notification feature where a user + or admin would receive alerts. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time @@ -32,7 +32,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Windows Registry Abuse - Azorult confidence: 70 diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index e615625cef..eadc698c90 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This particular behavior is typically executed when an adversaries or - malware gains access to an endpoint and beings to perform execution and to evade - detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled +description: This particular behavior is typically executed when an adversary or + malware gains access to an endpoint and begins to perform execution and to evade + detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry @@ -33,7 +33,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Windows Registry Abuse confidence: 70 context: diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index fdf6f86f27..b8bd66a4da 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of registry to disable - windows defender feature. This technique is to bypassed or evade detection from - Windows Defender AV product specially the spynet reporting for its telemetry. +description: This analytic is intended to detect a suspicious modification of registry to disable + Windows Defender feature. This technique is intended to bypass or evade detection from + Windows Defender AV product, specifically the spynet reporting for Defender telemetry. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest @@ -31,7 +31,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Windows Registry Abuse - Azorult confidence: 70 diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index e6444b3401..516d974a65 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of registry to disable - windows defender feature. This technique is to bypassed or evade detection from - Windows Defender AV product specially the submit samples feature for further analysis.. +description: This analytic is intended to detect a suspicious modification of the Windows registry to disable + a Windows Defender feature. This technique is intended to bypass or evade detection from + Windows Defender AV, specifically the feature that submits samples for further analysis. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h @@ -31,7 +31,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Windows Registry Abuse - Azorult confidence: 70 diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index d222d57b32..5557698c0c 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This analytic is to detect a suspicious commandline to disable existing - schedule task. This technique is used by adversaries or commodity malware like IceID + schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 8d7c5fc76e..e82bdcb7b3 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -34,7 +34,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Windows Registry Abuse confidence: 70 context: diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 5bee38d8e6..ccf975cf98 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -37,7 +37,7 @@ references: tags: analytic_story: - Suspicious Regsvr32 Activity - - Iceid + - Icedid - Living Off The Land asset_type: Endpoint cis20: diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index d0ebb2b3e7..cede6d0a8a 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search is to detect a suspicious rundll32.exe process with plugininit - parameter. This technique is commonly seen in IceID malware to execute its initial + parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*PluginInit* diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index f49e493d6a..abd97200a0 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -34,7 +34,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md tags: analytic_story: - - IceID + - IcedID - Ingress Tool Transfer confidence: 100 context: diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml index b8c8dc98d8..f5988a8cd5 100644 --- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -7,7 +7,7 @@ type: Hunting datamodel: - Endpoint description: This analytic indentifies WMIC command-line attempting to uninstall - application non-interactively. This technique was seen in IceID to uninstall AV + application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third @@ -31,7 +31,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID - Azorult confidence: 50 context: diff --git a/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml b/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml index 403547a5c0..cdf5bb40e0 100644 --- a/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml +++ b/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml @@ -32,7 +32,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ tags: analytic_story: - - IceID + - IcedID automated_detection_testing: passed confidence: 70 context: