mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -10,4 +10,4 @@ jobs:
|
||||
- uses: ahmadnassri/action-dependabot-auto-merge@v2
|
||||
with:
|
||||
target: minor
|
||||
github-token: ${{ secrets.AUTOMERGE }}
|
||||
github-token: ${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }}
|
||||
|
||||
@@ -32,6 +32,6 @@ jobs:
|
||||
steps:
|
||||
- uses: docker://chinthakagodawita/autoupdate-action:v1
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}"
|
||||
GITHUB_TOKEN: "${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }}"
|
||||
DRY_RUN: "false"
|
||||
MERGE_MSG: "Branch was auto-updated."
|
||||
|
||||
@@ -306,7 +306,7 @@ jobs:
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
token: ${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}
|
||||
token: ${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }}
|
||||
ref: 'develop'
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
|
||||
Vendored
+1
-1
@@ -5,7 +5,7 @@
|
||||
"id": {
|
||||
"group": null,
|
||||
"name": "DA-ESS-ContentUpdate",
|
||||
"version": "0.0.000003"
|
||||
"version": "3.49.1"
|
||||
},
|
||||
"author": [
|
||||
{
|
||||
|
||||
+11
-11
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2022-09-27T18:37:47 UTC
|
||||
# On Date: 2022-09-28T16:43:01 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -3115,7 +3115,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = admin or user may choose to disable windows defender product
|
||||
@@ -3125,7 +3125,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
|
||||
explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = admin or user may choose to disable windows defender product
|
||||
@@ -3135,7 +3135,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
|
||||
explanation = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = user may choose to disable windows defender AV
|
||||
@@ -3145,7 +3145,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = admin or user may choose to disable windows defender product
|
||||
@@ -3155,7 +3155,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
|
||||
explanation = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = admin or user may choose to disable windows defender product
|
||||
@@ -3165,7 +3165,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
|
||||
explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = admin or user may choose to disable windows defender product
|
||||
@@ -3205,7 +3205,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = admin may disable problematic schedule task
|
||||
@@ -7388,7 +7388,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
|
||||
known_false_positives = third party application may used this dll export name to execute function.
|
||||
@@ -9314,7 +9314,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
|
||||
type = detection
|
||||
asset_type = Endpoint
|
||||
confidence = medium
|
||||
explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
|
||||
explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
|
||||
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
known_false_positives = Third party application may use this approach to uninstall applications.
|
||||
@@ -10613,7 +10613,7 @@ version = 1
|
||||
references = ["https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/", "https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/"]
|
||||
maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
|
||||
spec_version = 3
|
||||
searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"]
|
||||
searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"]
|
||||
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.
|
||||
narrative = IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains "license.dat" which is the actual core icedid bot.
|
||||
|
||||
|
||||
Vendored
+2
-2
@@ -4,7 +4,7 @@
|
||||
is_configured = false
|
||||
state = enabled
|
||||
state_change_requires_restart = false
|
||||
build = 10124
|
||||
build = 10110
|
||||
|
||||
[triggers]
|
||||
reload.analytic_stories = simple
|
||||
@@ -20,7 +20,7 @@ reload.es_investigations = simple
|
||||
|
||||
[launcher]
|
||||
author = Splunk
|
||||
version = 0.0.000003
|
||||
version = 3.49.1
|
||||
description = Explore the Analytic Stories included with ES Content Updates.
|
||||
|
||||
[ui]
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2022-09-27T18:37:47 UTC
|
||||
# On Date: 2022-09-28T16:43:01 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
+1
-1
@@ -1,2 +1,2 @@
|
||||
[content-version]
|
||||
version = 0.0.000003
|
||||
version = 3.49.1
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2022-09-27T18:37:47 UTC
|
||||
# On Date: 2022-09-28T16:43:01 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2022-09-27T18:37:47 UTC
|
||||
# On Date: 2022-09-28T16:43:01 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
Vendored
+47
-47
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2022-09-27T18:37:47 UTC
|
||||
# On Date: 2022-09-28T16:43:01 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
@@ -13263,10 +13263,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
|
||||
[ESCU - Disable Defender AntiVirus Registry - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.known_false_positives = admin or user may choose to disable windows defender product
|
||||
action.escu.creation_date = 2022-01-26
|
||||
@@ -13276,7 +13276,7 @@ action.escu.full_search_name = ESCU - Disable Defender AntiVirus Registry - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
|
||||
action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
||||
@@ -13287,11 +13287,11 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Disable Defender AntiVirus Registry - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.notable.param.rule_title = Disable Defender AntiVirus Registry
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -13309,10 +13309,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
|
||||
[ESCU - Disable Defender BlockAtFirstSeen Feature - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
|
||||
description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
|
||||
action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.known_false_positives = admin or user may choose to disable windows defender product
|
||||
action.escu.creation_date = 2022-01-26
|
||||
@@ -13322,7 +13322,7 @@ action.escu.full_search_name = ESCU - Disable Defender BlockAtFirstSeen Feature
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
|
||||
action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
||||
@@ -13333,11 +13333,11 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Disable Defender BlockAtFirstSeen Feature - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
|
||||
action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
|
||||
action.notable.param.rule_title = Disable Defender BlockAtFirstSeen Feature
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -13355,10 +13355,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
|
||||
[ESCU - Disable Defender Enhanced Notification - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
|
||||
description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
|
||||
action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.known_false_positives = user may choose to disable windows defender AV
|
||||
action.escu.creation_date = 2022-01-26
|
||||
@@ -13368,7 +13368,7 @@ action.escu.full_search_name = ESCU - Disable Defender Enhanced Notification - R
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
|
||||
action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
||||
@@ -13379,11 +13379,11 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Disable Defender Enhanced Notification - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
|
||||
action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
|
||||
action.notable.param.rule_title = Disable Defender Enhanced Notification
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -13401,10 +13401,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
|
||||
[ESCU - Disable Defender MpEngine Registry - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.known_false_positives = admin or user may choose to disable windows defender product
|
||||
action.escu.creation_date = 2022-01-26
|
||||
@@ -13414,7 +13414,7 @@ action.escu.full_search_name = ESCU - Disable Defender MpEngine Registry - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
|
||||
action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
||||
@@ -13425,11 +13425,11 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Disable Defender MpEngine Registry - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
|
||||
action.notable.param.rule_title = Disable Defender MpEngine Registry
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -13447,10 +13447,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
|
||||
[ESCU - Disable Defender Spynet Reporting - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
|
||||
description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
|
||||
action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.known_false_positives = admin or user may choose to disable windows defender product
|
||||
action.escu.creation_date = 2022-01-26
|
||||
@@ -13460,7 +13460,7 @@ action.escu.full_search_name = ESCU - Disable Defender Spynet Reporting - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
|
||||
action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
||||
@@ -13471,11 +13471,11 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Disable Defender Spynet Reporting - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
|
||||
action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
|
||||
action.notable.param.rule_title = Disable Defender Spynet Reporting
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -13493,10 +13493,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
|
||||
[ESCU - Disable Defender Submit Samples Consent Feature - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
|
||||
description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
|
||||
action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.known_false_positives = admin or user may choose to disable windows defender product
|
||||
action.escu.creation_date = 2022-01-26
|
||||
@@ -13506,7 +13506,7 @@ action.escu.full_search_name = ESCU - Disable Defender Submit Samples Consent Fe
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
|
||||
action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
||||
@@ -13517,11 +13517,11 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Disable Defender Submit Samples Consent Feature - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
|
||||
action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
|
||||
action.notable.param.rule_title = Disable Defender Submit Samples Consent Feature
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -13677,10 +13677,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
|
||||
[ESCU - Disable Schedule Task - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
action.escu.known_false_positives = admin may disable problematic schedule task
|
||||
action.escu.creation_date = 2021-10-18
|
||||
@@ -13705,7 +13705,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
|
||||
action.notable.param.rule_title = Disable Schedule Task
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -14196,7 +14196,7 @@ action.escu.full_search_name = ESCU - Disabling Defender Services - Rule
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
|
||||
action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
|
||||
@@ -14207,7 +14207,7 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Disabling Defender Services - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
@@ -31725,7 +31725,7 @@ action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Pa
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"]
|
||||
action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
|
||||
@@ -31736,7 +31736,7 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
@@ -31804,10 +31804,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
|
||||
[ESCU - Suspicious Rundll32 PluginInit - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
action.escu.known_false_positives = third party application may used this dll export name to execute function.
|
||||
action.escu.creation_date = 2021-07-26
|
||||
@@ -31832,7 +31832,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidenc
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
|
||||
action.notable.param.rule_title = Suspicious Rundll32 PluginInit
|
||||
action.notable.param.security_domain = endpoint
|
||||
action.notable.param.severity = high
|
||||
@@ -34057,7 +34057,7 @@ action.escu.full_search_name = ESCU - Windows Curl Download to Suspicious Path -
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Ingress Tool Transfer"]
|
||||
action.escu.analytic_story = ["IcedID", "Ingress Tool Transfer"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
|
||||
action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
|
||||
@@ -34068,7 +34068,7 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Windows Curl Download to Suspicious Path - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
|
||||
schedule_window = auto
|
||||
action.notable = 1
|
||||
action.notable.param.nes_fields = user,dest
|
||||
@@ -40124,10 +40124,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
|
||||
[ESCU - Wmic NonInteractive App Uninstallation - Rule]
|
||||
action.escu = 0
|
||||
action.escu.enabled = 1
|
||||
description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
|
||||
description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
|
||||
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
|
||||
action.escu.data_models = ["Endpoint"]
|
||||
action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
|
||||
action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
|
||||
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
action.escu.known_false_positives = Third party application may use this approach to uninstall applications.
|
||||
action.escu.creation_date = 2022-07-19
|
||||
@@ -40137,7 +40137,7 @@ action.escu.full_search_name = ESCU - Wmic NonInteractive App Uninstallation - R
|
||||
action.escu.search_type = detection
|
||||
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
|
||||
action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
|
||||
action.escu.analytic_story = ["IceID", "Azorult"]
|
||||
action.escu.analytic_story = ["IcedID", "Azorult"]
|
||||
action.risk = 1
|
||||
action.risk.param._risk_message = Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software.
|
||||
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
|
||||
@@ -40148,7 +40148,7 @@ dispatch.earliest_time = -70m@m
|
||||
dispatch.latest_time = -10m@m
|
||||
action.correlationsearch.enabled = 1
|
||||
action.correlationsearch.label = ESCU - Wmic NonInteractive App Uninstallation - Rule
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IceID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
|
||||
action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
|
||||
schedule_window = auto
|
||||
alert.digest_mode = 1
|
||||
disabled = true
|
||||
|
||||
Vendored
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2022-09-27T18:37:47 UTC
|
||||
# On Date: 2022-09-28T16:43:01 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: 2022-09-27T18:37:47 UTC
|
||||
# On Date: 2022-09-28T16:43:01 UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
|
||||
+1
-1
@@ -67,4 +67,4 @@ test:
|
||||
attack_data:
|
||||
- file_name: 4688_windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
|
||||
source: WinEventLog:Security
|
||||
source: XmlWinEventLog
|
||||
|
||||
Reference in New Issue
Block a user