From b02971df815812216da99847895671d05f401db6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 14 Jun 2023 14:37:53 +0200 Subject: [PATCH 1/3] recon_correlation --- ..._common_abused_cmd_shell_risk_behavior.yml | 85 +++++++++++++++++++ ...s_system_discovery_using_ldap_nslookup.yml | 8 +- ...m_network_config_discovery_display_dns.yml | 2 +- ...em_network_connections_discovery_netsh.yml | 2 +- 4 files changed, 91 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml new file mode 100644 index 0000000000..4370ba3bf2 --- /dev/null +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -0,0 +1,85 @@ +name: 'Windows Common Abused Cmd Shell Risk Behavior' +id: e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a +version: 1 +date: '2023-06-14' +author: Teoderick Contreras, Splunk +status: production +type: Correlation +data_source: [] +description: The following correlation is specific to several security content detection related to process command line that are + known to be being abused by several threat actors, adversaries or red teamers. This correlation search may help to catch a possible + threat attacks by monitoring a series/consecutive known command line in a compromised or targeted host. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime + sum(All_Risk.calculated_risk_score) as risk_score, + count(All_Risk.calculated_risk_score) as risk_event_count, + values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, + dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, + values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, + dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, + values(All_Risk.tag) as tag, values(source) as source, + dc(source) as source_count from datamodel=Risk.All_Risk + where source IN ("*Cmdline Tool Not Executed In CMD Shell*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Net Localgroup Discovery*", "*Create local admin accounts using net exe*", + "*Local Account Discovery with Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", + "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*") + by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic + | `drop_dm_object_name(All_Risk)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where source_count >= 4 + | `windows_common_abused_cmd_shell_risk_behavior_filter`' +how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, + modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, + but the number may need to be increased base on internal testing. In addition, + based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance. +known_false_positives: False positives will be present based on many factors. Tune + the correlation as needed to reduce too many triggers. +references: +- https://www.splunk.com/en_us/blog/security/from-macros-to-no-macros-continuous-malware-improvements-by-qakbot.html +- https://www.splunk.com/en_us/blog/security/dark-crystal-rat-agent-deep-dive.html +tags: + analytic_story: + - Netsh Abuse + - Disabling Security Tools + - Windows Post-Exploitation + - Qakbot + - Azorult + - Sandworm Tools + - Volt Typhoon + - FIN7 + - DarkCrystal RAT + - Windows Defense Evasion Tactics + asset_type: Endpoint + confidence: 70 + impact: 70 + message: series of process commandline being abused by threat actor have been identified on $risk_object$ + mitre_attack_id: + - T1222 + - T1049 + - T1033 + - T1529 + - T1016 + - T1059 + observable: + - name: risk_object + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - All_Risk.analyticstories + - All_Risk.risk_object_type + - All_Risk.risk_object + - All_Risk.annotations.mitre_attack.mitre_tactic + - source + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/risk_behavior/abused_commandline/risk_recon.log + source: risk + sourcetype: stash diff --git a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml index 9449e625dc..6224404d1d 100644 --- a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml +++ b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-10-21' author: Teoderick Contreras, Splunk status: production -type: Hunting +type: Anomaly description: The following analytic identifies the execution of nslookup.exe tool to get domain information. Nslookup.exe is a command-line tool that can display information to diagnose domain name systems. This Nslookup feature is being abused @@ -33,8 +33,8 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - confidence: 50 - impact: 50 + confidence: 10 + impact: 10 message: System nslookup domain discovery on $dest$ mitre_attack_id: - T1033 @@ -60,7 +60,7 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 25 + risk_score: 1 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml index ad444fbb84..b4b9802852 100644 --- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml +++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk status: production -type: Hunting +type: Anomaly description: The following analytic identifies a process command line that retrieves dns reply information using Windows OS built-in tool IPConfig. This technique is being abused by threat actors, adversaries and post exploitation tools like WINPEAS diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index 892002bbe0..d45d594282 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk status: production -type: Hunting +type: Anomaly description: The following analytic identifies a process execution of Windows OS built-in tool netsh.exe to show state, configuration and profile of host firewall. This tool is being used or abused by several adversaries or even post exploitation tool to From 1761687bf6ca8896bb5604e6170ac3c90da94938 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 12 Jul 2023 17:28:41 -0500 Subject: [PATCH 2/3] Update windows_common_abused_cmd_shell_risk_behavior.yml --- .../windows_common_abused_cmd_shell_risk_behavior.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml index 4370ba3bf2..0200e5a348 100644 --- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -1,4 +1,4 @@ -name: 'Windows Common Abused Cmd Shell Risk Behavior' +name: Windows Common Abused Cmd Shell Risk Behavior id: e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a version: 1 date: '2023-06-14' @@ -6,9 +6,8 @@ author: Teoderick Contreras, Splunk status: production type: Correlation data_source: [] -description: The following correlation is specific to several security content detection related to process command line that are - known to be being abused by several threat actors, adversaries or red teamers. This correlation search may help to catch a possible - threat attacks by monitoring a series/consecutive known command line in a compromised or targeted host. +description: +The following correlation identifies instances where four or more distinct detection analytics are associated with malicious command line behavior that is known to be exploited by multiple threat actors, adversaries, or red teamers on a specific host. By leveraging the Command Line Interface (CLI), attackers can execute malicious commands, gain access to sensitive data, install backdoors, and engage in various nefarious activities. The impact of such compromise can be severe, as attackers may gain unauthorized control over the compromised system, enabling them to exfiltrate valuable information, escalate privileges, or launch further attacks within the network. If this detection is triggered, there is a high level of confidence in the occurrence of suspicious command line activities on the host. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, From e4ef2171a4cf47b804adf540c79572372ba94cc9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 12 Jul 2023 17:32:12 -0500 Subject: [PATCH 3/3] Update windows_common_abused_cmd_shell_risk_behavior.yml --- .../endpoint/windows_common_abused_cmd_shell_risk_behavior.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml index 0200e5a348..283e70e4e7 100644 --- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Correlation data_source: [] -description: -The following correlation identifies instances where four or more distinct detection analytics are associated with malicious command line behavior that is known to be exploited by multiple threat actors, adversaries, or red teamers on a specific host. By leveraging the Command Line Interface (CLI), attackers can execute malicious commands, gain access to sensitive data, install backdoors, and engage in various nefarious activities. The impact of such compromise can be severe, as attackers may gain unauthorized control over the compromised system, enabling them to exfiltrate valuable information, escalate privileges, or launch further attacks within the network. If this detection is triggered, there is a high level of confidence in the occurrence of suspicious command line activities on the host. +description: The following correlation identifies instances where four or more distinct detection analytics are associated with malicious command line behavior that is known to be exploited by multiple threat actors, adversaries, or red teamers on a specific host. By leveraging the Command Line Interface (CLI), attackers can execute malicious commands, gain access to sensitive data, install backdoors, and engage in various nefarious activities. The impact of such compromise can be severe, as attackers may gain unauthorized control over the compromised system, enabling them to exfiltrate valuable information, escalate privileges, or launch further attacks within the network. If this detection is triggered, there is a high level of confidence in the occurrence of suspicious command line activities on the host. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,