diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index 96c30258b6..fe41c33997 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -10,4 +10,4 @@ jobs: - uses: ahmadnassri/action-dependabot-auto-merge@v2 with: target: minor - github-token: ${{ secrets.AUTOMERGE }} + github-token: ${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }} diff --git a/.github/workflows/auto-update.yml b/.github/workflows/auto-update.yml index 2a4f7bc8d9..3bac079e4a 100644 --- a/.github/workflows/auto-update.yml +++ b/.github/workflows/auto-update.yml @@ -32,6 +32,6 @@ jobs: steps: - uses: docker://chinthakagodawita/autoupdate-action:v1 env: - GITHUB_TOKEN: "${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}" + GITHUB_TOKEN: "${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }}" DRY_RUN: "false" MERGE_MSG: "Branch was auto-updated." diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index b4f6489170..c1d0e09a88 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -306,7 +306,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 with: - token: ${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }} + token: ${{ secrets.SECURITY_CONTENT_ADMIN_TASKS }} ref: 'develop' - uses: actions/setup-python@v2 diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 72139cad90..55abc3f4fb 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "0.0.000003" + "version": "3.49.1" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 4c56ff22df..79c101c566 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-09-27T18:37:47 UTC +# On Date: 2022-09-28T16:43:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -3115,7 +3115,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin or user may choose to disable windows defender product @@ -3125,7 +3125,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host. +explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host. how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin or user may choose to disable windows defender product @@ -3135,7 +3135,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts. +explanation = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts. how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = user may choose to disable windows defender AV @@ -3145,7 +3145,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin or user may choose to disable windows defender product @@ -3155,7 +3155,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. +explanation = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry. how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin or user may choose to disable windows defender product @@ -3165,7 +3165,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. +explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis. how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin or user may choose to disable windows defender product @@ -3205,7 +3205,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. +explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable problematic schedule task @@ -7388,7 +7388,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. +explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} known_false_positives = third party application may used this dll export name to execute function. @@ -9314,7 +9314,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response" type = detection asset_type = Endpoint confidence = medium -explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why. +explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = Third party application may use this approach to uninstall applications. @@ -10613,7 +10613,7 @@ version = 1 references = ["https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/", "https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] spec_version = 3 -searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"] +searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection. narrative = IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains "license.dat" which is the actual core icedid bot. diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index f4bdeba677..561a2c458c 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 10124 +build = 10110 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 0.0.000003 +version = 3.49.1 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index cc9a97e218..62fcb76729 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-09-27T18:37:47 UTC +# On Date: 2022-09-28T16:43:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 7f68cd1562..fd1c542b7a 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 0.0.000003 +version = 3.49.1 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 0fe78c4c30..d576a61c96 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-09-27T18:37:47 UTC +# On Date: 2022-09-28T16:43:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index b26874dee6..e3dfbb1b9f 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-09-27T18:37:47 UTC +# On Date: 2022-09-28T16:43:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 2239412dbf..438964a1f2 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-09-27T18:37:47 UTC +# On Date: 2022-09-28T16:43:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -13263,10 +13263,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Disable Defender AntiVirus Registry - Rule] action.escu = 0 action.escu.enabled = 1 -description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = admin or user may choose to disable windows defender product action.escu.creation_date = 2022-01-26 @@ -13276,7 +13276,7 @@ action.escu.full_search_name = ESCU - Disable Defender AntiVirus Registry - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Windows Registry Abuse"] +action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"] action.risk = 1 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -13287,11 +13287,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Defender AntiVirus Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.notable.param.rule_title = Disable Defender AntiVirus Registry action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13309,10 +13309,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint [ESCU - Disable Defender BlockAtFirstSeen Feature - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host. +description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host. +action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = admin or user may choose to disable windows defender product action.escu.creation_date = 2022-01-26 @@ -13322,7 +13322,7 @@ action.escu.full_search_name = ESCU - Disable Defender BlockAtFirstSeen Feature action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"] +action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"] action.risk = 1 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -13333,11 +13333,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Defender BlockAtFirstSeen Feature - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host. +action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host. action.notable.param.rule_title = Disable Defender BlockAtFirstSeen Feature action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13355,10 +13355,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint [ESCU - Disable Defender Enhanced Notification - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts. +description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts. +action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = user may choose to disable windows defender AV action.escu.creation_date = 2022-01-26 @@ -13368,7 +13368,7 @@ action.escu.full_search_name = ESCU - Disable Defender Enhanced Notification - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"] +action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"] action.risk = 1 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -13379,11 +13379,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Defender Enhanced Notification - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts. +action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts. action.notable.param.rule_title = Disable Defender Enhanced Notification action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13401,10 +13401,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint [ESCU - Disable Defender MpEngine Registry - Rule] action.escu = 0 action.escu.enabled = 1 -description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = admin or user may choose to disable windows defender product action.escu.creation_date = 2022-01-26 @@ -13414,7 +13414,7 @@ action.escu.full_search_name = ESCU - Disable Defender MpEngine Registry - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Windows Registry Abuse"] +action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"] action.risk = 1 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -13425,11 +13425,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Defender MpEngine Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. +action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.notable.param.rule_title = Disable Defender MpEngine Registry action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13447,10 +13447,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint [ESCU - Disable Defender Spynet Reporting - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. +description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. +action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = admin or user may choose to disable windows defender product action.escu.creation_date = 2022-01-26 @@ -13460,7 +13460,7 @@ action.escu.full_search_name = ESCU - Disable Defender Spynet Reporting - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"] +action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"] action.risk = 1 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -13471,11 +13471,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Defender Spynet Reporting - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. +action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry. action.notable.param.rule_title = Disable Defender Spynet Reporting action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13493,10 +13493,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint [ESCU - Disable Defender Submit Samples Consent Feature - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. +description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. +action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = admin or user may choose to disable windows defender product action.escu.creation_date = 2022-01-26 @@ -13506,7 +13506,7 @@ action.escu.full_search_name = ESCU - Disable Defender Submit Samples Consent Fe action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"] +action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"] action.risk = 1 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -13517,11 +13517,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Defender Submit Samples Consent Feature - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. +action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis. action.notable.param.rule_title = Disable Defender Submit Samples Consent Feature action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -13677,10 +13677,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint [ESCU - Disable Schedule Task - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. +description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. +action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = admin may disable problematic schedule task action.escu.creation_date = 2021-10-18 @@ -13705,7 +13705,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. +action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too. action.notable.param.rule_title = Disable Schedule Task action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -14196,7 +14196,7 @@ action.escu.full_search_name = ESCU - Disabling Defender Services - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Windows Registry Abuse"] +action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"] action.risk = 1 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -14207,7 +14207,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Defender Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest @@ -31725,7 +31725,7 @@ action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Pa action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] @@ -31736,7 +31736,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest @@ -31804,10 +31804,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Suspicious Rundll32 PluginInit - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. +description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. +action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = third party application may used this dll export name to execute function. action.escu.creation_date = 2021-07-26 @@ -31832,7 +31832,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidenc schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. +action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine. action.notable.param.rule_title = Suspicious Rundll32 PluginInit action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -34057,7 +34057,7 @@ action.escu.full_search_name = ESCU - Windows Curl Download to Suspicious Path - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Ingress Tool Transfer"] +action.escu.analytic_story = ["IcedID", "Ingress Tool Transfer"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -34068,7 +34068,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Curl Download to Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest @@ -40124,10 +40124,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Wmic NonInteractive App Uninstallation - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why. +description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why. +action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Third party application may use this approach to uninstall applications. action.escu.creation_date = 2022-07-19 @@ -40137,7 +40137,7 @@ action.escu.full_search_name = ESCU - Wmic NonInteractive App Uninstallation - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"] -action.escu.analytic_story = ["IceID", "Azorult"] +action.escu.analytic_story = ["IcedID", "Azorult"] action.risk = 1 action.risk.param._risk_message = Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software. action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -40148,7 +40148,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wmic NonInteractive App Uninstallation - Rule -action.correlationsearch.annotations = {"analytic_story": ["IceID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto alert.digest_mode = 1 disabled = true diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 6bf44b2b2e..2908fc47e3 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-09-27T18:37:47 UTC +# On Date: 2022-09-28T16:43:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index d9a88b6201..49659b4094 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-09-27T18:37:47 UTC +# On Date: 2022-09-28T16:43:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 111da21cfc..6e7e5a60bd 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -67,4 +67,4 @@ test: attack_data: - file_name: 4688_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log - source: WinEventLog:Security + source: XmlWinEventLog