diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml new file mode 100644 index 0000000000..24c9d0db46 --- /dev/null +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -0,0 +1,69 @@ +name: Windows Powershell Cryptography Namespace +id: f8b482f4-6d62-49fa-a905-dfa15698317b +version: 1 +date: '2023-01-26' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies suspicious PowerShell script execution + via EventCode 4104 that is processing cryptography namespace library. + This technique was seen in several powershell malware, loader, downloader and stager that will decrypt or decode the next malicious stager or the actual payload. + This Anomaly detection can be a good indicator that a powershell process to decrypt code. We recommend to further check the parent_process_name, the file or data + it tries to decrypt, network connection and user who execute the script. +search: '`powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_cryptography_namespace_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A suspicious powershell script contains cryptography command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ + mitre_attack_id: + - T1059.001 + - T1059 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: UserID + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Opcode + - Computer + - UserID + - EventCodes + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml new file mode 100644 index 0000000000..62488a1eca --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml @@ -0,0 +1,76 @@ +name: Windows Scheduled Task with Highest Privileges +id: 2f15e1a4-0fc2-49dd-919e-cbbe60699218 +version: 1 +date: '2023-01-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies Schtasks.exe creating a new task with highest privilege execution. + This techniques was seen in asyncrat where it uses the scheduled task as part of it persistence and privilege escalation. + AsyncRAT will setup a scheduled task with parameter '/rl' and 'highest' to trigger this technique. This TTP detection can be a + good indicator of malware or adversaries trying to gain persistence and privilege escalation through scheduled task. We recommend to always + check and monitoring this type of events even filtering is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "schtasks.exe" Processes.process = "*/rl *" Processes.process = "* highest *" + by Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_scheduled_task_with_highest_privileges_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +known_false_positives: False positives will be limited to legitimate applications + creating a task to run as SYSTEM. Filter as needed based on parent process, or modify + the query to have world writeable paths to restrict it. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a $process_name$ creating a schedule task $process$ with highest run level privilege in $dest$ + mitre_attack_id: + - T1053 + - T1053.005 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/windows_powershell_cryptography_namespace.test.yml b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml new file mode 100644 index 0000000000..d8b74bc1b7 --- /dev/null +++ b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml @@ -0,0 +1,13 @@ +name: Windows Powershell Cryptography Namespace Unit Test +tests: +- name: Windows Powershell Cryptography Namespace + file: endpoint/windows_powershell_cryptography_namespace.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml new file mode 100644 index 0000000000..b527dbd01d --- /dev/null +++ b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml @@ -0,0 +1,13 @@ +name: Windows Scheduled Task with Highest Privileges Unit Test +tests: +- name: Windows Scheduled Task with Highest Privileges + file: endpoint/windows_scheduled_task_with_highest_privileges.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true