From b9450b3a32364d9857b4097f06a9a46583f06c93 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 6 Jul 2022 13:03:14 +0200 Subject: [PATCH 1/3] azorult-bomb3 --- ...modify_registry_disabling_wer_settings.yml | 68 +++++++++++++++++ ...s_modify_registry_disallow_windows_app.yml | 67 +++++++++++++++++ ...ify_registry_regedit_silent_reg_import.yml | 73 +++++++++++++++++++ ...y_registry_disabling_wer_settings.test.yml | 13 ++++ ...ify_registry_disallow_windows_app.test.yml | 13 ++++ ...egistry_regedit_silent_reg_import.test.yml | 13 ++++ 6 files changed, 247 insertions(+) create mode 100644 detections/endpoint/windows_modify_registry_disabling_wer_settings.yml create mode 100644 detections/endpoint/windows_modify_registry_disallow_windows_app.yml create mode 100644 detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml create mode 100644 tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml create mode 100644 tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml create mode 100644 tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml new file mode 100644 index 0000000000..8f717465e1 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Disabling WER Settings +id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to disable windows error reporting settings. This Windows feature allow the use to report bug, errors, failure or problems + encounter in specific application or process. Adversaries and threat actors use this technique like in Azorult malware to hide any + error or failure that some of its malicious component trigger. This modification is a good TTP pivot since it is not common to disable this feature. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disabling_wer_settings_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for WER settings was modified to disabled in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml new file mode 100644 index 0000000000..052b2f9722 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -0,0 +1,67 @@ +name: Windows Modify Registry DisAllow Windows App +id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to prevent user running specific computer programs that could aid them in manually removing malware or detecting it + using security product. This technique was seen in Azorult malware where it uses this registry to prevent several AV scanner to execute + in the compromised host machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disallow_windows_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for DisallowRun settings was modified to enable in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml new file mode 100644 index 0000000000..9f4aa451ff --- /dev/null +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -0,0 +1,73 @@ +name: Windows Modify Registry Regedit Silent Reg Import +id: 824dd598-71be-4203-bc3b-024f4cda340e +version: 1 +date: '2022-06-24' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify possible modification of Windows registry + using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. + This application is also has undocumented commandline parameter and one of those are silent mode parameter that performs action without stopping for confirmation with + dialog box. importing registry from .reg file need to monitor in a production environment since it can be used adversaries or malware author like azorult malware + to import RMS registry in compromised host. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") + AND Processes.process="* /s *" AND Processes.process="*.reg*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_regedit_silent_reg_import_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrators may execute this command that may cause some false positive. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +- https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the regedit app was executed with silet mode param to import .reg file in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - original_file_name + - dest + - user + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml b/tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml new file mode 100644 index 0000000000..a9bb6f5e8c --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disabling_wer_settings.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disabling WER Settings Unit Test +tests: +- name: Windows Modify Registry Disabling WER Settings + file: endpoint/windows_modify_registry_disabling_wer_settings.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml b/tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml new file mode 100644 index 0000000000..e9984251b3 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disallow_windows_app.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry DisAllow Windows App Unit Test +tests: +- name: Windows Modify Registry DisAllow Windows App + file: endpoint/windows_modify_registry_disallow_windows_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml b/tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml new file mode 100644 index 0000000000..fdd1c4642d --- /dev/null +++ b/tests/endpoint/windows_modify_registry_regedit_silent_reg_import.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Regedit Silent Reg Import Unit Test +tests: +- name: Windows Modify Registry Regedit Silent Reg Import + file: endpoint/windows_modify_registry_regedit_silent_reg_import.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From cd0207e68fbefbdd1728ad1d761071ee1c6f9d9b Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 8 Jul 2022 11:05:34 +0200 Subject: [PATCH 2/3] azorult-bomb3 --- ...y_disable_win_defender_raw_write_notif.yml | 68 +++++++++++++++++ ...remote_service_rdpwinst_tool_execution.yml | 73 +++++++++++++++++++ ...able_win_defender_raw_write_notif.test.yml | 13 ++++ ...e_service_rdpwinst_tool_execution.test.yml | 13 ++++ 4 files changed, 167 insertions(+) create mode 100644 detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml create mode 100644 detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml create mode 100644 tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml create mode 100644 tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml new file mode 100644 index 0000000000..0829248eec --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Disable Win Defender Raw Write Notif +id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b +version: 1 +date: '2022-06-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to disable windows defender raw write notification feature. This policy controls wether raw volume write notifications are + sent to behavior monitoring or not. This registry was abused by Azorult malware to bypassed windows defender detections or behavior monitoring + in terms of volume write. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for raw write notification settings was modified to disable in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml new file mode 100644 index 0000000000..fdd9347581 --- /dev/null +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -0,0 +1,73 @@ +name: Windows Remote Service Rdpwinst Tool Execution +id: c8127f87-c7c9-4036-89ed-8fe4b30e678c +version: 1 +date: '2022-06-24' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies process of "RDPWInst.exe" tool which is a rdp wrapper library tool designed to enable remote + desktop host support and concurrent rdp session on reduced functionality system. Unfortunately this open project was abuse by adversaries and malware like azorult + to enable rdp connection to the targeted host for remote access and might be for lateral movement. This TTP detection is a good pivot to check why specific user use this + tool and what host machine it tries to access that might help to see further suspicious events. This tool was designed for home usage and not commonly seen in production + environment. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") + AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_service_rdpwinst_tool_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: rdpwinst.exe executed in $dest$ + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - original_file_name + - dest + - user + risk_score: 81 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml b/tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml new file mode 100644 index 0000000000..21930092d4 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disable Win Defender Raw Write Notif Unit Test +tests: +- name: Windows Modify Registry Disable Win Defender Raw Write Notif + file: endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml b/tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml new file mode 100644 index 0000000000..e199acfaba --- /dev/null +++ b/tests/endpoint/windows_remote_service_rdpwinst_tool_execution.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Service Rdpwinst Tool Execution Unit Test +tests: +- name: Windows Remote Service Rdpwinst Tool Execution + file: endpoint/windows_remote_service_rdpwinst_tool_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 89d8441d1e71730aee4dfc5c2f054374ceff3702 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 19 Jul 2022 12:53:54 -0600 Subject: [PATCH 3/3] Updates --- ...y_disable_win_defender_raw_write_notif.yml | 10 ++--- ...modify_registry_disabling_wer_settings.yml | 12 +++--- ...s_modify_registry_disallow_windows_app.yml | 10 ++--- ...ify_registry_regedit_silent_reg_import.yml | 40 +++++++++--------- ...remote_service_rdpwinst_tool_execution.yml | 41 ++++++++++--------- 5 files changed, 58 insertions(+), 55 deletions(-) diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index 0829248eec..26c251dd52 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic is to identify a modification in the Windows registry - to disable windows defender raw write notification feature. This policy controls wether raw volume write notifications are - sent to behavior monitoring or not. This registry was abused by Azorult malware to bypassed windows defender detections or behavior monitoring +description: The following analytic identifies a modification in the Windows registry + to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are + sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" @@ -21,7 +21,7 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. references: - https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ @@ -42,7 +42,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: the registry for raw write notification settings was modified to disable in $dest$ + message: The registry for raw write notification settings was modified to disable in $dest$. mitre_attack_id: - T1112 nist: diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index 8f717465e1..8f0e4853e4 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic is to identify a modification in the Windows registry - to disable windows error reporting settings. This Windows feature allow the use to report bug, errors, failure or problems - encounter in specific application or process. Adversaries and threat actors use this technique like in Azorult malware to hide any - error or failure that some of its malicious component trigger. This modification is a good TTP pivot since it is not common to disable this feature. +description: The following analytic identifies a modification in the Windows registry + to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems + encountered in specific application or processes. Adversaries use this technique to hide any + error or failure that some of its malicious components trigger. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest @@ -21,7 +21,7 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ @@ -42,7 +42,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: the registry for WER settings was modified to disabled in $dest$ + message: the registry for WER settings was modified to be disabled on $dest$. mitre_attack_id: - T1112 nist: diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index 052b2f9722..a9b11801cb 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic is to identify a modification in the Windows registry +description: The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it - using security product. This technique was seen in Azorult malware where it uses this registry to prevent several AV scanner to execute - in the compromised host machine. + using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute + on the compromised host machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest @@ -21,7 +21,7 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: administrators may enable or disable this feature that may cause some false positive. +known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -41,7 +41,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: the registry for DisallowRun settings was modified to enable in $dest$ + message: The registry for DisallowRun settings was modified to enable in $dest$. mitre_attack_id: - T1112 nist: diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index 9f4aa451ff..c4d436842c 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic is to identify possible modification of Windows registry +description: The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. - This application is also has undocumented commandline parameter and one of those are silent mode parameter that performs action without stopping for confirmation with - dialog box. importing registry from .reg file need to monitor in a production environment since it can be used adversaries or malware author like azorult malware - to import RMS registry in compromised host. + This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with + dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") AND Processes.process="* /s *" AND Processes.process="*.reg*" @@ -19,11 +18,12 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrators may execute this command that may cause some false positive. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe @@ -44,7 +44,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: the regedit app was executed with silet mode param to import .reg file in $dest$ + message: The regedit app was executed with silet mode parameter to import .reg file on $dest$. mitre_attack_id: - T1112 nist: @@ -60,14 +60,16 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - original_file_name - - dest - - user + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id risk_score: 49 security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml index fdd9347581..099b29e6a9 100644 --- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -6,11 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies process of "RDPWInst.exe" tool which is a rdp wrapper library tool designed to enable remote - desktop host support and concurrent rdp session on reduced functionality system. Unfortunately this open project was abuse by adversaries and malware like azorult - to enable rdp connection to the targeted host for remote access and might be for lateral movement. This TTP detection is a good pivot to check why specific user use this - tool and what host machine it tries to access that might help to see further suspicious events. This tool was designed for home usage and not commonly seen in production - environment. +description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote + desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries + to enable RDP connection to the targeted host for remote access and potentially be for lateral movement. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") @@ -19,11 +17,12 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: This tool was designed for home usage and not commonly seen in production environment. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ tags: @@ -43,7 +42,7 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: rdpwinst.exe executed in $dest$ + message: Rdpwinst.exe executed on $dest$. mitre_attack_id: - T1021.001 - T1021 @@ -60,14 +59,16 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - original_file_name - - dest - - user + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id risk_score: 81 security_domain: endpoint \ No newline at end of file