From cf86f899b64de05541a47e6f874107b0974349ac Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 28 Jun 2022 12:03:12 -0500 Subject: [PATCH 1/4] Added Datamodel values --- detections/endpoint/detect_renamed_rclone.yml | 3 ++- detections/endpoint/disabling_remote_user_account_control.yml | 3 ++- .../endpoint/monitor_registry_keys_for_print_monitors.yml | 3 ++- ...tbound_network_connection_from_java_using_default_ports.yml | 3 ++- .../endpoint/registry_keys_for_creating_shim_databases.yml | 3 ++- .../endpoint/registry_keys_used_for_privilege_escalation.yml | 3 ++- detections/endpoint/ryuk_test_files_detected.yml | 3 ++- detections/endpoint/shim_database_file_creation.yml | 3 ++- .../endpoint/suspicious_writes_to_windows_recycle_bin.yml | 3 ++- ...ws_deleted_registry_by_a_non_critical_process_file_path.yml | 3 ++- .../endpoint/windows_security_account_manager_stopped.yml | 3 ++- 11 files changed, 22 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 31f9611618..a147b17a02 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -4,7 +4,8 @@ version: 2 date: '2021-09-16' author: Michael Haag, Splunk type: Hunting -datamodel: [] +datamodel: +- Endpoint description: The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index cec67662fe..e229e77942 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -4,7 +4,8 @@ version: 4 date: '2020-11-18' author: David Dorsey, Patrick Bareiss, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 99441750e0..bbcccc4b3c 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -4,7 +4,8 @@ version: 3 date: '2020-01-28' author: Bhavin Patel, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 683af89e3c..8ee668b754 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -4,7 +4,8 @@ version: 1 date: '2021-12-13' author: Mauricio Velazco, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 7ef622f83c..9df5124d27 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -4,7 +4,8 @@ version: 4 date: '2020-01-28' author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 414f1aad14..31b20c5995 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -4,7 +4,8 @@ version: 5 date: '2022-01-26' author: David Dorsey, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index dd311918ac..fbe835cad6 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 092eee4b9d..4803568843 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -4,7 +4,8 @@ version: 3 date: '2020-12-08' author: David Dorsey, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 76a082c0ef..a9e4bad569 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -4,7 +4,8 @@ version: 4 date: '2020-07-22' author: Rico Valdez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: This search detects writes to the recycle bin by a process other than explorer.exe. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index a9d567de0d..74575c024c 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -4,7 +4,8 @@ version: 1 date: '2022-03-28' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: [] +datamodel: +- Endpoint description: This analytic is to detect deletion of registry with suspicious process file path. This technique was seen in Double Zero wiper malware where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index dcfd0b95d0..8a79d7c9e5 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) From 12b174f7d781892f340925c98a0cb09bb7bb4323 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 28 Jun 2022 14:53:32 -0500 Subject: [PATCH 2/4] Changed to Network_Traffic, joining on process_id --- ...twork_connection_from_java_using_default_ports.yml | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 8ee668b754..12f9c5d415 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -13,16 +13,7 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR - Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports - where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR - Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` - | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name - process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by _time Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port| `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. From 9290c8c03d2440a88a773473ea39bf640a393f8f Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 28 Jun 2022 14:59:51 -0500 Subject: [PATCH 3/4] Updated DM and fields --- ...ork_connection_from_java_using_default_ports.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 12f9c5d415..f22b7b1dee 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -1,11 +1,12 @@ name: Outbound Network Connection from Java Using Default Ports id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 1 -date: '2021-12-13' -author: Mauricio Velazco, Splunk +version: 2 +date: '2022-06-28' +author: Mauricio Velazco, Lou Stella, Splunk type: TTP datamodel: - Endpoint +- Network_Traffic description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving @@ -57,9 +58,9 @@ tags: - Processes.process_path - Processes.process - Processes.parent_process_name - - Ports.process_guid - - Ports.dest - - Ports.dest_port + - All_Traffic.process_id + - All_Traffic.dest + - All_Traffic.dest_port risk_score: 54 security_domain: endpoint asset_type: Endpoint From 8a790869330b4fa128a8fb90d498920cf8616fc5 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 28 Jun 2022 16:01:51 -0500 Subject: [PATCH 4/4] Missed one --- ...utbound_network_connection_from_java_using_default_ports.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index f22b7b1dee..32d8041943 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -52,7 +52,7 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_guid + - Processes.process_id - Processes.process_name - Processes.dest - Processes.process_path