Nirsoft Software

detections/endpoint/windows_nirsoft_utilities.yml

@@ -0,0 +1,70 @@
+name: Windows NirSoft Utilities
+id: 5b2f4596-7d4c-11ec-88a7-acde48001122
+version: 1
+date: '2022-01-24'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic assists with identifying the proces execution of commonly used utilities from NirSoft. Potentially not adversary behavior, but worth identifying to know if the software is present and being used.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `is_nirsoft_software`
+  | `windows_nirsoft_utilities_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present. Filtering may be required before setting to alert.
+references:
+-  
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1588.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

lookups/is_nirsoft_software.csv

@@ -0,0 +1,15 @@
+filename,nirsoftFile
+AdvancedRun.exe,True
+ChromePass.exe,True
+CredHistView.exe,True
+Dialupass.exe,True
+iepv.exe,True
+LostMyPassword.exe,True
+mailpv.exe,True
+mspass.exe,True
+netpass.exe,True
+PasswordFox.exe,True
+PasswordHashesView.exe,True
+PstPassword.exe,True
+RegHiveBackup.exe,True
+WebBrowserPassView.exe,True

lookups/is_nirsoft_software.yml

@@ -0,0 +1,6 @@
+default_match: 'false'
+description: A subset of utilities provided by NirSoft that may be used by adversaries.
+filename: is_nirsoft_software.csv
+min_matches: 1
+name: is_nirsoft_software
+case_sensitive_match: 'false'

macros/is_nirsoft_software.yml

@@ -0,0 +1,3 @@
+definition: lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true
+description: This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based.
+name: is_nirsoft_software

tests/endpoint/windows_nirsoft_utilities.test.yml

@@ -0,0 +1,12 @@
+name: Windows NirSoft Utilities Unit Test
+tests:
+- name: Windows NirSoft Utilities
+  file: endpoint/windows_nirsoft_utilities.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog