diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml new file mode 100644 index 0000000000..26c251dd52 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Disable Win Defender Raw Write Notif +id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b +version: 1 +date: '2022-06-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a modification in the Windows registry + to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are + sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring + in terms of volume write. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. +references: +- https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: The registry for raw write notification settings was modified to disable in $dest$. + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml new file mode 100644 index 0000000000..8f0e4853e4 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Disabling WER Settings +id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a modification in the Windows registry + to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems + encountered in specific application or processes. Adversaries use this technique to hide any + error or failure that some of its malicious components trigger. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disabling_wer_settings_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for WER settings was modified to be disabled on $dest$. + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml new file mode 100644 index 0000000000..a9b11801cb --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -0,0 +1,67 @@ +name: Windows Modify Registry DisAllow Windows App +id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies modification in the Windows registry + to prevent user running specific computer programs that could aid them in manually removing malware or detecting it + using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute + on the compromised host machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disallow_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: The registry for DisallowRun settings was modified to enable in $dest$. + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml new file mode 100644 index 0000000000..c4d436842c --- /dev/null +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -0,0 +1,75 @@ +name: Windows Modify Registry Regedit Silent Reg Import +id: 824dd598-71be-4203-bc3b-024f4cda340e +version: 1 +date: '2022-06-24' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies modification of Windows registry + using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. + This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with + dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") + AND Processes.process="* /s *" AND Processes.process="*.reg*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_regedit_silent_reg_import_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +- https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: The regedit app was executed with silet mode parameter to import .reg file on $dest$. + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml new file mode 100644 index 0000000000..099b29e6a9 --- /dev/null +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -0,0 +1,74 @@ +name: Windows Remote Service Rdpwinst Tool Execution +id: c8127f87-c7c9-4036-89ed-8fe4b30e678c +version: 1 +date: '2022-06-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote + desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries + to enable RDP connection to the targeted host for remote access and potentially be for lateral movement. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") + AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_service_rdpwinst_tool_execution_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: This tool was designed for home usage and not commonly seen in production environment. Filter as needed. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: Rdpwinst.exe executed on $dest$. + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 81 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml b/tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml new file mode 100644 index 0000000000..21930092d4 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disable Win Defender Raw Write Notif Unit Test +tests: +- name: Windows Modify Registry Disable Win Defender Raw Write Notif + file: endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml b/tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml new file mode 100644 index 0000000000..a9bb6f5e8c --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disabling WER Settings Unit Test +tests: +- name: Windows Modify Registry Disabling WER Settings + file: endpoint/windows_modify_registry_disabling_wer_settings.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml b/tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml new file mode 100644 index 0000000000..e9984251b3 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry DisAllow Windows App Unit Test +tests: +- name: Windows Modify Registry DisAllow Windows App + file: endpoint/windows_modify_registry_disallow_windows_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml b/tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml new file mode 100644 index 0000000000..fdd1c4642d --- /dev/null +++ b/tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Regedit Silent Reg Import Unit Test +tests: +- name: Windows Modify Registry Regedit Silent Reg Import + file: endpoint/windows_modify_registry_regedit_silent_reg_import.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml b/tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml new file mode 100644 index 0000000000..e199acfaba --- /dev/null +++ b/tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Service Rdpwinst Tool Execution Unit Test +tests: +- name: Windows Remote Service Rdpwinst Tool Execution + file: endpoint/windows_remote_service_rdpwinst_tool_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true