fixes and new

detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml

@@ -0,0 +1,40 @@
+name: Suspicious DLLHost no Command Line Arguments
+id: 74866830-75ff-11eb-886f-acde48001122
+version: 1
+date: '2021-02-23'
+author: Michael Haag, Splunk
+type: batch
+datamodel: []
+description: The following analytic identifies DLLHost.exe with no command line arguments.
+  It is unusual for DLLHost.exe to execute with no command line arguments present.
+  This particular behavior is common with malicious software, including Cobalt Strike. 
+  During investigation, identify any network connections and parallel processes. Identify
+  any suspicious module loads related to credential dumping or file writes. DLLHost.exe
+  is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '`sysmon` EventID=1 (process_name=dllhost.exe OR OriginalFileName=dllhost.exe)
+  | regex CommandLine="(dllhost\.exe.{0,4}$)" | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
+  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_dllhost_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
+references: 
+- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  

detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml

@@ -20,7 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: Limited false positives may be present in environments 
+known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process. 
 references: 
 - https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/

tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious DLLHost with no command line arguments Unit Test
+tests:
+- name: Suspicious DLLHost with no Command Line Arguments
+  file: endpoint/suspicious_dllhost_with_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml

@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog