From cbc8c32b466ae9c367cdf0ca8cc755989cc36bd5 Mon Sep 17 00:00:00 2001 From: eelsetronning Date: Wed, 10 Apr 2024 13:29:09 +0200 Subject: [PATCH 1/4] Changing logic for searchterms, to make searches comply with title and intention --- detections/endpoint/curl_download_and_bash_execution.yml | 2 +- detections/endpoint/wget_download_and_bash_execution.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 40bfd9a650..f841230e3e 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl - (Processes.process="*-s *") OR (Processes.process="*|*" AND Processes.process="*bash*") + (Processes.process="*-s *") AND (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`' diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index d042f6bcca..9eef03d08d 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -13,7 +13,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wget (Processes.process="*-q *" OR Processes.process="*--quiet*" AND Processes.process="*-O- - *") OR (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest + *") AND (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wget_download_and_bash_execution_filter`' From 2c7979b8ebceb742acf237e3b0e3f93cac8f43d5 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 7 Nov 2024 12:20:17 -0700 Subject: [PATCH 2/4] Updated --- detections/endpoint/curl_download_and_bash_execution.yml | 2 ++ detections/endpoint/wget_download_and_bash_execution.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 6d4b2add3e..de11db60d3 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -38,6 +38,7 @@ references: - https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java - https://www.lunasec.io/docs/blog/log4j-zero-day/ - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 +- https://github.com/MHaggis/notes/blob/master/utilities/warp_pipe_tester.py tags: analytic_story: - Ingress Tool Transfer @@ -83,6 +84,7 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + manual_test: Due to current limitations in command line extraction capabilities with Sysmon for Linux, full CommandLine data cannot be collected for complete validation. Setting to manual test to prevent integration test failures. tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index 37fc59ec58..fcd325aa19 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -38,6 +38,7 @@ references: - https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java - https://www.lunasec.io/docs/blog/log4j-zero-day/ - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890 +- https://github.com/MHaggis/notes/blob/master/utilities/warp_pipe_tester.py tags: analytic_story: - Ingress Tool Transfer @@ -82,6 +83,7 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + manual_test: Due to current limitations in command line extraction capabilities with Sysmon for Linux, full CommandLine data cannot be collected for complete validation. Setting to manual test to prevent integration test failures. tests: - name: True Positive Test attack_data: From 7ef1c9f568159dc544e888435db4594b94449f13 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 7 Nov 2024 11:26:44 -0800 Subject: [PATCH 3/4] Update curl_download_and_bash_execution.yml --- detections/endpoint/curl_download_and_bash_execution.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 2b8e27169d..96b60c8939 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -1,8 +1,8 @@ name: Curl Download and Bash Execution id: 900bc324-59f3-11ec-9fb4-acde48001122 -version: 4 +version: 5 date: '2024-09-30' -author: Michael Haag, Splunk +author: Michael Haag, Splunk, DipsyTipsy status: production type: TTP description: The following analytic detects the use of curl on Linux or MacOS systems to download a file from a remote source and pipe it directly to bash for execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant as it is commonly associated with malicious actions such as coinminers and exploitation of vulnerabilities like CVE-2021-44228 in Log4j. If confirmed malicious, this behavior could lead to unauthorized code execution, system compromise, and further exploitation within the environment. From 845d484a3f6687db15ce7ed5075df9ae7b125e06 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 7 Nov 2024 11:27:14 -0800 Subject: [PATCH 4/4] Update wget_download_and_bash_execution.yml --- detections/endpoint/wget_download_and_bash_execution.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index 0209f72131..55268a2193 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -1,8 +1,8 @@ name: Wget Download and Bash Execution id: 35682718-5a85-11ec-b8f7-acde48001122 -version: 4 +version: 5 date: '2024-09-30' -author: Michael Haag, Splunk +author: Michael Haag, Splunk, DipsyTipsy status: production type: TTP description: The following analytic detects the use of wget on Linux or MacOS to download a file from a remote source and pipe it to bash. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.