com_obj

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -0,0 +1,43 @@
+name: CMLUA Or CMSTPLUA UAC Bypass
+id: f87b5062-b405-11eb-a889-acde48001122
+version: 1
+date: '2021-05-13'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a potential process using COM Object like CMLUA or CMSTPLUA 
+  to bypassed UAC. This technique used by ransomware to gain administrative privileges to its running process.
+search: '`sysmon` EventCode=7 process_name ="darkside.exe" ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) 
+| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `cmlua_or_cmstplua_uac_bypass_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: normal windows application that are not on the list loading this dll.
+references:
+- https://attack.mitre.org/techniques/T1218/003/
+tags:
+  analytic_story:
+  - darkside
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  security_domain: endpoint

tests/endpoint/cmlua_or_cmstplua_uac_bypass.test.yml

@@ -0,0 +1,12 @@
+name: CMLUA Or CMSTPLUA UAC Bypass Unit Test
+tests:
+- name: CMLUA Or CMSTPLUA UAC Bypass
+  file: endpoint/cmlua_or_cmstplua_uac_bypass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog