Merge pull request #2271 from splunk/azorult-bomb3

azorult-bomb3

detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml

@@ -0,0 +1,68 @@
+name: Windows Modify Registry Disable Win Defender Raw Write Notif
+id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b
+version: 1
+date: '2022-06-23'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a modification in the Windows registry
+  to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are 
+  sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring 
+  in terms of volume write.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+references:
+- https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: The registry for raw write notification settings was modified to disable in $dest$.
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_modify_registry_disabling_wer_settings.yml

@@ -0,0 +1,68 @@
+name: Windows Modify Registry Disabling WER Settings
+id: 21cbcaf1-b51f-496d-a0c1-858ff3070452
+version: 1
+date: '2022-06-22'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a modification in the Windows registry
+  to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems 
+  encountered in specific application or processes. Adversaries use this technique to hide any 
+  error or failure that some of its malicious components trigger.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_modify_registry_disabling_wer_settings_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
+references:
+- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry for WER settings was modified to be disabled on $dest$.
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_modify_registry_disallow_windows_app.yml

@@ -0,0 +1,67 @@
+name: Windows Modify Registry DisAllow Windows App
+id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889
+version: 1
+date: '2022-06-22'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies modification in the Windows registry
+  to prevent user running specific computer programs that could aid them in manually removing malware or detecting it 
+  using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute 
+  on the compromised host machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_disallow_windows_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+references:
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: The registry for DisallowRun settings was modified to enable in $dest$.
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml

@@ -0,0 +1,75 @@
+name: Windows Modify Registry Regedit Silent Reg Import
+id: 824dd598-71be-4203-bc3b-024f4cda340e
+version: 1
+date: '2022-06-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies modification of Windows registry 
+  using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. 
+  This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with 
+  dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") 
+  AND Processes.process="* /s *" AND Processes.process="*.reg*" 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_regedit_silent_reg_import_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed.
+references:
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+- https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: The regedit app was executed with silet mode parameter to import .reg file on $dest$.
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml

@@ -0,0 +1,74 @@
+name: Windows Remote Service Rdpwinst Tool Execution
+id: c8127f87-c7c9-4036-89ed-8fe4b30e678c
+version: 1
+date: '2022-06-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote 
+  desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries
+  to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") 
+  AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_remote_service_rdpwinst_tool_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
+references:
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Rdpwinst.exe executed on $dest$.
+  mitre_attack_id:
+  - T1021.001
+  - T1021
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint

tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry Disable Win Defender Raw Write Notif Unit Test
+tests:
+- name: Windows Modify Registry Disable Win Defender Raw Write Notif
+  file: endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry Disabling WER Settings Unit Test
+tests:
+- name: Windows Modify Registry Disabling WER Settings
+  file: endpoint/windows_modify_registry_disabling_wer_settings.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry DisAllow Windows App Unit Test
+tests:
+- name: Windows Modify Registry DisAllow Windows App
+  file: endpoint/windows_modify_registry_disallow_windows_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry Regedit Silent Reg Import Unit Test
+tests:
+- name: Windows Modify Registry Regedit Silent Reg Import
+  file: endpoint/windows_modify_registry_regedit_silent_reg_import.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml

@@ -0,0 +1,13 @@
+name: Windows Remote Service Rdpwinst Tool Execution Unit Test
+tests:
+- name: Windows Remote Service Rdpwinst Tool Execution
+  file: endpoint/windows_remote_service_rdpwinst_tool_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true