diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 31f9611618..a147b17a02 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -4,7 +4,8 @@ version: 2 date: '2021-09-16' author: Michael Haag, Splunk type: Hunting -datamodel: [] +datamodel: +- Endpoint description: The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index f9a9f25a0f..3736b1281d 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -4,7 +4,8 @@ version: 4 date: '2020-11-18' author: David Dorsey, Patrick Bareiss, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 99441750e0..bbcccc4b3c 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -4,7 +4,8 @@ version: 3 date: '2020-01-28' author: Bhavin Patel, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 683af89e3c..32d8041943 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -1,10 +1,12 @@ name: Outbound Network Connection from Java Using Default Ports id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 1 -date: '2021-12-13' -author: Mauricio Velazco, Splunk +version: 2 +date: '2022-06-28' +author: Mauricio Velazco, Lou Stella, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint +- Network_Traffic description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving @@ -12,16 +14,7 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR - Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports - where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR - Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name - process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by _time Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port| `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -59,15 +52,15 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_guid + - Processes.process_id - Processes.process_name - Processes.dest - Processes.process_path - Processes.process - Processes.parent_process_name - - Ports.process_guid - - Ports.dest - - Ports.dest_port + - All_Traffic.process_id + - All_Traffic.dest + - All_Traffic.dest_port risk_score: 54 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 7ef622f83c..9df5124d27 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -4,7 +4,8 @@ version: 4 date: '2020-01-28' author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 414f1aad14..31b20c5995 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -4,7 +4,8 @@ version: 5 date: '2022-01-26' author: David Dorsey, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index dd311918ac..fbe835cad6 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 092eee4b9d..4803568843 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -4,7 +4,8 @@ version: 3 date: '2020-12-08' author: David Dorsey, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 76a082c0ef..a9e4bad569 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -4,7 +4,8 @@ version: 4 date: '2020-07-22' author: Rico Valdez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search detects writes to the recycle bin by a process other than explorer.exe. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index a9d567de0d..74575c024c 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -4,7 +4,8 @@ version: 1 date: '2022-03-28' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: [] +datamodel: +- Endpoint description: This analytic is to detect deletion of registry with suspicious process file path. This technique was seen in Double Zero wiper malware where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index dcfd0b95d0..8a79d7c9e5 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)