From 85895e14a29940cd5c389d7576391b87805707e8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 19 Sep 2022 18:04:55 +0200 Subject: [PATCH 1/5] agent-with-tesla-2 --- .../endpoint/registry_keys_used_for_persistence.yml | 5 +++-- detections/endpoint/windows_iso_lnk_file_creation.yml | 9 +++++---- .../windows_phishing_recent_iso_exec_registry.yml | 8 +++++--- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d2c3184285..d8403bae72 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 8 -date: '2022-07-20' +version: 9 +date: '2022-09-19' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk type: TTP datamodel: @@ -10,6 +10,7 @@ description: The search looks for modifications to registry keys that can be use to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce + OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index 74a3df3852..c2c8f98add 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -1,15 +1,15 @@ name: Windows ISO LNK File Creation id: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32 -version: 1 -date: '2022-03-29' -author: Michael Haag, Splunk +version: 2 +date: '2022-09-19' +author: Michael Haag, Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint description: The following analytic identifies the use of a delivered ISO file that has been mounted and the afformention lnk or file opened within it. When the ISO file is opened, the files are saved in the %USER%\AppData\Local\Temp\\ path. The analytic identifies .iso.lnk written to the path. The name of the ISO file is prepended. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk", "*.img.lnk", "*.vhd.lnk", "*vhdx.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -23,6 +23,7 @@ tags: analytic_story: - Spearphishing Attachments - Brute Ratel C4 + - AgentTesla asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index b82b44feeb..cd534de3c2 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -1,7 +1,7 @@ name: Windows Phishing Recent ISO Exec Registry id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c -version: 1 -date: '2022-08-24' +version: 2 +date: '2022-09-19' author: Teoderick Contreras, Splunk type: Hunting datamodel: @@ -10,7 +10,8 @@ description: The following hunting analytic identifies registry artifacts when a As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" + where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" OR + Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` @@ -28,6 +29,7 @@ references: tags: analytic_story: - Brute Ratel C4 + - AgentTesla asset_type: Endpoint cis20: - CIS 3 From 16d4d226c30870910ff97703d33bfe21330ea3c5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 21 Sep 2022 10:27:23 +0200 Subject: [PATCH 2/5] agent-with-tesla-2 --- ...ding_dotnet_into_memory_via_reflection.yml | 1 + ...er_protocol_in_non_common_process_path.yml | 72 +++++++++++++++++++ ...il_protocol_in_non_common_process_path.yml | 72 +++++++++++++++++++ ...dows_multi_hop_proxy_tor_website_query.yml | 63 ++++++++++++++++ ...otocol_in_non_common_process_path.test.yml | 13 ++++ ...otocol_in_non_common_process_path.test.yml | 13 ++++ ...multi_hop_proxy_tor_website_query.test.yml | 13 ++++ 7 files changed, 247 insertions(+) create mode 100644 detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml create mode 100644 detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml create mode 100644 detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml create mode 100644 tests/endpoint/windows_file_transfer_protocol_in_non_common_process_path.test.yml create mode 100644 tests/endpoint/windows_mail_protocol_in_non_common_process_path.test.yml create mode 100644 tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index e63435e80d..d75da6a33f 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Hermetic Wiper - Malicious PowerShell + - AgentTesla confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml new file mode 100644 index 0000000000..2dfbef08c5 --- /dev/null +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -0,0 +1,72 @@ +name: Windows File Transfer Protocol In Non-Common Process Path +id: 0f43758f-1fe9-470a-a9e4-780acc4d5407 +version: 1 +date: '2022-09-16' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a possible windows application having a FTP connection + in a non common installation path in windows operating system.This network protocol is being used by adversaries, + threat actors and malware like AgentTesla as a command and control communication to transfer its collected stolen information + like the desktop screenshots, browser information and system information of a targeted or compromised host. +search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\windows\\system32\\*","*\\windows\\SysWOW64\\*")) + (DestinationPortName="ftp" OR DestinationPort=21) + | stats count min(_time) as firstTime max(_time) as lastTime by Image DestinationPort DestinationPortName DestinationHostname DestinationIp + SourcePort SourcePortName Protocol SourceHostname Computer user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_transfer_protocol_in_non_common_process_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and sysmon eventcode = 3 connection events from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: third party application may use this network protocol as part of its feature. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla +tags: + analytic_story: + - AgentTesla + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Command And Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_ftp/sysmon.log + impact: 30 + kill_chain_phases: + - Command & Control + message: a process $Image$ is having a FTP connection to $DestinationHostname$ in $Computer$ + mitre_attack_id: + - T1071.003 + - T1071 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - DestinationPort + - DestinationPortName + - DestinationHostname + - SourceHostname + - SourcePort + - SourcePortName + - Protocol + - DestinationIp + - Computer + - user + risk_score: 9 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml new file mode 100644 index 0000000000..3f515c348c --- /dev/null +++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml @@ -0,0 +1,72 @@ +name: Windows Mail Protocol In Non-Common Process Path +id: ac3311f5-661d-4e99-bd1f-3ec665b05441 +version: 1 +date: '2022-09-16' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a possible windows application having a SMTP connection + in a non common installation path in windows operating system.This network protocol is being used by adversaries, + threat actors and malware like AgentTesla as a command and control communication to transfer its collected stolen information + like the desktop screenshots, browser information and system information of a targeted or compromised host. +search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\windows\\system32\\*","*\\windows\\SysWOW64\\*")) + (DestinationPortName="smtp" OR DestinationPort=25) + | stats count min(_time) as firstTime max(_time) as lastTime by Image DestinationPort DestinationPortName DestinationHostname + SourceHostname SourcePort SourcePortName Protocol DestinationIp Computer user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_mail_protocol_in_non_common_process_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and sysmon eventcode = 3 connection events from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: third party application may use this network protocol as part of its feature. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla +tags: + analytic_story: + - AgentTesla + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Command And Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_smtp/sysmon.log + impact: 30 + kill_chain_phases: + - Command & Control + message: a process $Image$ is having a SMTP connection to $DestinationHostname$ in $Computer$ + mitre_attack_id: + - T1071.003 + - T1071 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - DestinationPort + - DestinationPortName + - DestinationHostname + - SourceHostname + - SourcePort + - SourcePortName + - Protocol + - DestinationIp + - Computer + - user + risk_score: 9 + security_domain: endpoint diff --git a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml new file mode 100644 index 0000000000..413dbe0b59 --- /dev/null +++ b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml @@ -0,0 +1,63 @@ +name: Windows Multi hop Proxy TOR Website Query +id: 4c2d198b-da58-48d7-ba27-9368732d0054 +version: 1 +date: '2022-09-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a dns query to a known TOR proxy website. + This technique was seen in several adversaries, threat actors and malware like AgentTesla + to To disguise the source of its malicious traffic. adversaries may chain together multiple proxies. + This Anomaly detection might be a good pivot for a process trying to download or use TOR proxies in a compromised host machine. +search: '`sysmon` EventCode=22 QueryName IN ("*.torproject.org", "www.theonionrouter.com") + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId Computer + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_multi_hop_proxy_tor_website_query_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and sysmon eventcode = 22 dns query events from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: third party application may use this proxies if allowed in production environment. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla +tags: + analytic_story: + - AgentTesla + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Command And Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon.log + impact: 50 + kill_chain_phases: + - Command & Control + message: a process $Image$ is having a dns query in a tor domain $QueryName$ in $Computer$ + mitre_attack_id: + - T1071.003 + - T1071 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - ProcessId + - Computer + risk_score: 25 + security_domain: endpoint diff --git a/tests/endpoint/windows_file_transfer_protocol_in_non_common_process_path.test.yml b/tests/endpoint/windows_file_transfer_protocol_in_non_common_process_path.test.yml new file mode 100644 index 0000000000..d1b76a9be9 --- /dev/null +++ b/tests/endpoint/windows_file_transfer_protocol_in_non_common_process_path.test.yml @@ -0,0 +1,13 @@ +name: Windows File Transfer Protocol In Non-Common Process Path Unit Test +tests: +- name: Windows File Transfer Protocol In Non-Common Process Path + file: endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_ftp/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_mail_protocol_in_non_common_process_path.test.yml b/tests/endpoint/windows_mail_protocol_in_non_common_process_path.test.yml new file mode 100644 index 0000000000..32764250f0 --- /dev/null +++ b/tests/endpoint/windows_mail_protocol_in_non_common_process_path.test.yml @@ -0,0 +1,13 @@ +name: Windows Mail Protocol In Non-Common Process Path Unit Test +tests: +- name: Windows Mail Protocol In Non-Common Process Path + file: endpoint/windows_mail_protocol_in_non_common_process_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_smtp/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml b/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml new file mode 100644 index 0000000000..35a55ef276 --- /dev/null +++ b/tests/endpoint/windows_multi_hop_proxy_tor_website_query.test.yml @@ -0,0 +1,13 @@ +name: Windows Multi-hop Proxy TOR Website Query Unit Test +tests: +- name: Windows Multi-hop Proxy TOR Website Query + file: endpoint/windows_multi_hop_proxy_tor_website_query.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From be6c16084ac44351bf9eed56aae4f159687eb9c5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 21 Sep 2022 11:24:35 +0200 Subject: [PATCH 3/5] agent-with-tesla-2 --- .../windows_mail_protocol_in_non_common_process_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml index 3f515c348c..8efb206b14 100644 --- a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml @@ -10,8 +10,8 @@ description: The following analytic identifies a possible windows application ha in a non common installation path in windows operating system.This network protocol is being used by adversaries, threat actors and malware like AgentTesla as a command and control communication to transfer its collected stolen information like the desktop screenshots, browser information and system information of a targeted or compromised host. -search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\windows\\system32\\*","*\\windows\\SysWOW64\\*")) - (DestinationPortName="smtp" OR DestinationPort=25) +search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\thunderbird.exe","*\\outlook.exe")) + (DestinationPortName="smtp" OR DestinationPort=25 OR DestinationPort=587) | stats count min(_time) as firstTime max(_time) as lastTime by Image DestinationPort DestinationPortName DestinationHostname SourceHostname SourcePort SourcePortName Protocol DestinationIp Computer user | `security_content_ctime(firstTime)` From 1b74f7276043e9c7f8bb0b118f8fb97d4de52cd2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 13:18:09 +0200 Subject: [PATCH 4/5] Update windows_file_transfer_protocol_in_non_common_process_path.yml --- ...dows_file_transfer_protocol_in_non_common_process_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml index 2dfbef08c5..ce52381956 100644 --- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -3,7 +3,7 @@ id: 0f43758f-1fe9-470a-a9e4-780acc4d5407 version: 1 date: '2022-09-16' author: Teoderick Contreras, Splunk -type: Hunting +type: Anomaly datamodel: - Endpoint description: The following analytic identifies a possible windows application having a FTP connection @@ -69,4 +69,4 @@ tags: - Computer - user risk_score: 9 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From 30c770fcf557bce194128e0add29a204790187ed Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 21 Sep 2022 13:20:01 +0200 Subject: [PATCH 5/5] Update windows_mail_protocol_in_non_common_process_path.yml --- .../windows_mail_protocol_in_non_common_process_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml index 8efb206b14..62501d3982 100644 --- a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml @@ -3,7 +3,7 @@ id: ac3311f5-661d-4e99-bd1f-3ec665b05441 version: 1 date: '2022-09-16' author: Teoderick Contreras, Splunk -type: Hunting +type: Anomaly datamodel: - Endpoint description: The following analytic identifies a possible windows application having a SMTP connection