Branch was auto-updated.

detections/endpoint/conti_common_exec_parameter.yml

@@ -0,0 +1,49 @@
+name: Conti Common Exec parameter
+id: 624919bc-c382-11eb-adcc-acde48001122
+version: 1
+date: '2021-06-02'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search detects the suspicious commandline argument of revil ransomware
+  to encrypt specific or all local drive and network shares of the compromised machine
+  or host.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*"
+  OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process
+  = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `conti_common_exec_parameter_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: 3rd party tool may have commandline parameter that can trigger this detection.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1204
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest Processes.user
+  - Processes.process_id
+  - Processes.process_guid
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -25,6 +25,8 @@ references:
 tags:
   analytic_story:
   - DarkSide Ransomware
+  - Ransomware
+  - Revil Ransomware
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -40,3 +42,6 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log

detections/endpoint/known_services_killed_by_ransomware.yml

@@ -0,0 +1,46 @@
+name: Known Services Killed by Ransomware
+id: 3070f8e0-c528-11eb-b2a0-acde48001122
+version: 1
+date: '2021-06-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search detects a suspicioous termination of known services killed
+  by ransomware before encrypting files in a compromised machine. This technique is
+  commonly seen in most of ransomware now a days to avoid exception error while accessing
+  the targetted files it wants to encrypts because of the open handle of those services
+  to the targetted file.
+search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*",
+  "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service
+  entered the stopped state*" | stats count min(_time) as firstTime max(_time) as
+  lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  | `known_services_killed_by_ransomware_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
+known_false_positives: Admin activities or installing related updates may do a sudden stop to
+  list of services we monitor.
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+tags:
+  analytic_story:
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1490
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - dest
+  - Type
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log

detections/endpoint/modification_of_wallpaper.yml

@@ -0,0 +1,51 @@
+name: Modification Of Wallpaper
+id: accb0712-c381-11eb-8e5b-acde48001122
+version: 1
+date: '2021-06-02'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies suspicious modification of registry to deface
+  or change the wallpaper of a compromised machines as part of its payload. This technique
+  was commonly seen in ransomware like REVIL where it create a bitmap file contain
+  a note that the machine was compromised and make it as a wallpaper.
+search: '`sysmon` EventCode =13  (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper"
+  AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper"
+  AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as
+  lastTime by EventCode Image TargetObject Details  Computer process_guid process_id
+  user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `modification_of_wallpaper_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Image, TargetObject registry key, registry Details from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: 3rd party tool may used to changed the wallpaper of the machine
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1491
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Image
+  - TargetObject
+  - Details
+  - Computer
+  - process_guid
+  - process_id
+  - user_id
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log

detections/endpoint/revil_common_exec_parameter.yml

@@ -0,0 +1,52 @@
+name: Revil Common Exec Parameter
+id: 85facebe-c382-11eb-9c3e-acde48001122
+version: 1
+date: '2021-06-02'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies suspicious commandline parameter that are commonly
+  used by REVIL ransomware to encrypts the compromise machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*"
+  OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process
+  = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `revil_common_exec_parameter_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: third party tool may have same command line parameters as revil
+  ransomware.
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1204
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process_guid
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log

detections/endpoint/revil_registry_entry.yml

@@ -0,0 +1,49 @@
+name: Revil Registry Entry
+id: e3d3f57a-c381-11eb-9e35-acde48001122
+version: 1
+date: '2021-06-02'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies suspicious modification in registry entry to
+  keep some malware data during its infection. This technique seen in several apt
+  implant, malware and ransomware like REVIL where it keep some information like the
+  random generated file extension it uses for all the encrypted files and ransomware
+  notes file name in the compromised host.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
+  AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary
+  Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`'
+how_to_implement: to successfully implement this search, you need to be ingesting
+  logs with the Image, TargetObject registry key, registry Details from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_path
+  - Registry.registry_key_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log

detections/endpoint/wbemprox_com_object_execution.yml

@@ -0,0 +1,51 @@
+name: Wbemprox COM Object Execution
+id: 9d911ce0-c3be-11eb-b177-acde48001122
+version: 1
+date: '2021-06-02'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is designed to detect potential malicious process loading
+  COM object to wbemprox.dll,
+search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll",
+  "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe"))
+  NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time)
+  as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode
+  Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `wbemprox_com_object_execution_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: legitimate process that are not in the exception list may trigger
+  this event.
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId
+  - Hashes
+  - IMPHASH
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log

stories/ransomware_revil.yml

@@ -0,0 +1,25 @@
+name: Revil Ransomware
+id: 817cae42-f54b-457a-8a36-fbf45521e29e
+version: 1
+date: '2021-06-04'
+author: Teoderick Contreras, Splunk
+type: batch
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Revil ransomware, including looking for file writes associated
+  with Revil, encrypting network shares, deleting shadow volume storage, registry key modification,
+  deleting of security logs, and more.
+narrative: Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware.
+  It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for
+  ransome of data and threaten deletion and exposure of exfiltrated data.
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
+tags:
+  analytic_story: Revil Ransomware
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/conti_common_exec_parameter.test.yml

@@ -0,0 +1,15 @@
+name: Conti Common Exec parameter Unit Test
+tests:
+- name: Conti Common Exec parameter
+  file: endpoint/conti_common_exec_parameter.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+    

tests/endpoint/delete_shadowcopy_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Delete ShadowCopy With PowerShell Test
+tests:
+- name: Delete ShadowCopy With PowerShell
+  file: endpoint/delete_shadowcopy_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/known_services_killed_by_ransomware.test.yml

@@ -0,0 +1,15 @@
+name: Known Services Killed by Ransomware Unit Test
+tests:
+- name: Known Services Killed by Ransomware
+  file: endpoint/known_services_killed_by_ransomware.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf3/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+
+
+    

tests/endpoint/modification_of_wallpaper.test.yml

@@ -0,0 +1,16 @@
+name: Modification Of Wallpaper Unit Test
+tests:
+- name: Modification Of Wallpaper
+  file: endpoint/modification_of_wallpaper.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+
+    

tests/endpoint/revil_common_exec_parameter.test.yml

@@ -0,0 +1,12 @@
+name: Revil Common Exec Parameter Unit Test
+tests:
+- name: Revil Common Exec Parameter
+  file: endpoint/revil_common_exec_parameter.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/revil_registry_entry.test.yml

@@ -0,0 +1,12 @@
+name: Revil Registry Entry Unit Test
+tests:
+- name: Revil Registry Entry
+  file: endpoint/revil_registry_entry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/wbemprox_com_object_execution.test.yml

@@ -0,0 +1,15 @@
+name: Wbemprox COM Object Execution Unit Test
+tests:
+- name: Wbemprox COM Object Execution
+  file: endpoint/wbemprox_com_object_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+