From c24f154dcee1ddf602674551349cf9719facbbf0 Mon Sep 17 00:00:00 2001
From: tcontreras <tcontreras@splunk.com>
Date: Thu, 13 May 2021 18:58:14 +0200
Subject: [PATCH] com_obj

---
 .../endpoint/cmlua_or_cmstplua_uac_bypass.yml | 43 +++++++++++++++++++
 .../cmlua_or_cmstplua_uac_bypass.test.yml     | 12 ++++++
 2 files changed, 55 insertions(+)
 create mode 100644 detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
 create mode 100644 tests/endpoint/cmlua_or_cmstplua_uac_bypass.test.yml

diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
new file mode 100644
index 0000000000..ca7aad1281
--- /dev/null
+++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
@@ -0,0 +1,43 @@
+name: CMLUA Or CMSTPLUA UAC Bypass
+id: f87b5062-b405-11eb-a889-acde48001122
+version: 1
+date: '2021-05-13'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a potential process using COM Object like CMLUA or CMSTPLUA 
+  to bypassed UAC. This technique used by ransomware to gain administrative privileges to its running process.
+search: '`sysmon` EventCode=7 process_name ="darkside.exe" ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) 
+| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `cmlua_or_cmstplua_uac_bypass_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: normal windows application that are not on the list loading this dll.
+references:
+- https://attack.mitre.org/techniques/T1218/003/
+tags:
+  analytic_story:
+  - darkside
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/cmlua_or_cmstplua_uac_bypass.test.yml b/tests/endpoint/cmlua_or_cmstplua_uac_bypass.test.yml
new file mode 100644
index 0000000000..770b92cacb
--- /dev/null
+++ b/tests/endpoint/cmlua_or_cmstplua_uac_bypass.test.yml
@@ -0,0 +1,12 @@
+name: CMLUA Or CMSTPLUA UAC Bypass Unit Test
+tests:
+- name: CMLUA Or CMSTPLUA UAC Bypass
+  file: endpoint/cmlua_or_cmstplua_uac_bypass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file