mshta renamed

detections/endpoint/detect_mshta_renamed.yml

@@ -0,0 +1,42 @@
+name: Detect mshta renamed
+id: 4006adac-5937-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies renamed instances of mshta.exe executing.
+  Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
+  analytic utilizes the internal name of the PE to identify if is the legitimate
+  mshta binary. Further analysis should be performed to review the executed content 
+  and validation it is the real mshta. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `detect_mshta_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of mshta.exe, but never renamed, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed

tests/endpoint/detect_mshta_renamed.test.yml

@@ -0,0 +1,12 @@
+name: Detect mshta renamed unit test
+tests:
+- name: Detect mshta renamed
+  file: endpoint/detect_mshta_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog