From 81bf5653994de367c424d55ae1be4248f87f4be8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 21 Aug 2024 16:38:52 +0200 Subject: [PATCH] moon_peak_coverage --- .../allow_operation_with_consent_admin.yml | 1 + ...es_or_script_creation_in_suspicious_path.yml | 1 + .../powershell_processing_stream_of_data.yml | 1 + ...powershell_using_memory_as_backing_store.yml | 1 + ...owershell_webrequest_using_memory_stream.yml | 1 + .../recon_avproduct_through_pwh_or_wmi.yml | 1 + detections/endpoint/recon_using_wmi_class.yml | 1 + .../registry_keys_used_for_persistence.yml | 1 + ...cheduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/silentcleanup_uac_bypass.yml | 1 + .../endpoint/suspicious_process_file_path.yml | 1 + ...ous_scheduled_task_from_public_directory.yml | 1 + ...ntial_access_from_browser_password_store.yml | 1 + ..._password_stores_chrome_extension_access.yml | 1 + ...password_stores_chrome_localstate_access.yml | 1 + ...password_stores_chrome_login_data_access.yml | 1 + .../windows_scheduled_task_created_via_xml.yml | 1 + .../windows_system_reboot_commandline.yml | 1 + .../windows_system_shutdown_commandline.yml | 1 + detections/endpoint/wsreset_uac_bypass.yml | 1 + stories/moonpeak.yml | 17 +++++++++++++++++ 21 files changed, 37 insertions(+) create mode 100644 stories/moonpeak.yml diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 02a978d199..d8e68c1d61 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -37,6 +37,7 @@ tags: - Ransomware - Windows Registry Abuse - Azorult + - MoonPeak asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index c7b581eabe..50cad7d63d 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -74,6 +74,7 @@ tags: - Snake Keylogger - AcidPour - Handala Wiper + - MoonPeak asset_type: Endpoint confidence: 50 impact: 40 diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 56184299fa..6d990382d2 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -37,6 +37,7 @@ tags: - Hermetic Wiper - Data Destruction - IcedID + - MoonPeak asset_type: Endpoint confidence: 80 impact: 50 diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index af0da3f683..eb20c93a1b 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -38,6 +38,7 @@ tags: - Hermetic Wiper - Data Destruction - IcedID + - MoonPeak asset_type: Endpoint confidence: 80 impact: 50 diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 46e0715da3..05b9a8b6cd 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Malicious PowerShell + - MoonPeak asset_type: Endpoint confidence: 80 impact: 100 diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index eedc4ade5b..a4eec16c81 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -40,6 +40,7 @@ tags: - Prestige Ransomware - Malicious PowerShell - Data Destruction + - MoonPeak asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index c38b04e789..212af33b5a 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -45,6 +45,7 @@ tags: - LockBit Ransomware - Malicious PowerShell - Data Destruction + - MoonPeak asset_type: Endpoint confidence: 80 impact: 75 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 9c70a13351..c1bfa0cf48 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -76,6 +76,7 @@ tags: - BlackByte Ransomware - CISA AA23-347A - Snake Keylogger + - MoonPeak asset_type: Endpoint confidence: 95 impact: 80 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index ba5b4d7ec2..d54251bb8d 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -63,6 +63,7 @@ tags: - CISA AA23-347A - Phemedrone Stealer - ShrinkLocker + - MoonPeak asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index 8aca5c188e..d6d7e2066d 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -48,6 +48,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - MoonPeak asset_type: Endpoint confidence: 90 impact: 70 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 99bbcf2f49..980e515d27 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -79,6 +79,7 @@ tags: - Data Destruction - Phemedrone Stealer - Handala Wiper + - MoonPeak asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index bac243e316..46b3ca408b 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -49,6 +49,7 @@ tags: - Living Off The Land - DarkCrystal RAT - CISA AA23-347A + - MoonPeak asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 18dc559f24..8ea72e0b43 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Snake Keylogger + - MoonPeak asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index e340082a93..2231bf6cc5 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -35,6 +35,7 @@ tags: - Amadey - RedLine Stealer - Phemedrone Stealer + - MoonPeak asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index fa7a0cbff2..4600477107 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -36,6 +36,7 @@ tags: - DarkGate Malware - Phemedrone Stealer - Snake Keylogger + - MoonPeak asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 729c15e631..98e4cefe66 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -37,6 +37,7 @@ tags: - DarkGate Malware - Phemedrone Stealer - Snake Keylogger + - MoonPeak asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml index 89770fce58..2b0f5602f7 100644 --- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -42,6 +42,7 @@ tags: - Winter Vivern - CISA AA23-347A - Scheduled Tasks + - MoonPeak asset_type: Endpoint confidence: 70 dataset: diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 8fc6f31501..cfe7e66b64 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -44,6 +44,7 @@ tags: - DarkCrystal RAT - NjRAT - DarkGate Malware + - MoonPeak asset_type: Endpoint confidence: 50 impact: 60 diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index e08094384d..b864d2a59b 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -44,6 +44,7 @@ tags: - Sandworm Tools - NjRAT - DarkGate Malware + - MoonPeak asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index addf1d284f..fc148ac12c 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -47,6 +47,7 @@ tags: - Windows Defense Evasion Tactics - Living Off The Land - Windows Registry Abuse + - MoonPeak asset_type: Endpoint confidence: 90 impact: 70 diff --git a/stories/moonpeak.yml b/stories/moonpeak.yml new file mode 100644 index 0000000000..01e6ffb4b2 --- /dev/null +++ b/stories/moonpeak.yml @@ -0,0 +1,17 @@ +name: MoonPeak +id: b32c2bb4-ddb0-402f-a05d-9eae0ef4007a +version: 1 +date: '2024-08-21' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities linked to the MoonPeak malware, particularly focusing on command-and-control (C2) communications, data collection, file execution, and persistence mechanisms. Monitor network traffic for connections to known malicious IP addresses or domains associated with North Korean APT groups. Additionally, identify unexpected registry modifications and the presence of unauthorized binaries to uncover potential MoonPeak infections. +narrative: The MoonPeak malware is a sophisticated cyber threat attributed to North Korean advanced persistent threat (APT) groups. This malware is designed to infiltrate targeted systems, establish persistence, and communicate with command-and-control (C2) servers, enabling remote attackers to execute malicious activities. MoonPeak often evades detection by leveraging encryption and obfuscation techniques, making it challenging for traditional security measures to identify its presence. It primarily targets government entities, critical infrastructure, and organizations of strategic interest, with the ultimate goal of espionage, data exfiltration, and disruption of operations. Its evolving tactics highlight the growing complexity of nation-state cyber operations. +references: +- https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/ +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file