From c3197d003eccd039f8f2cfe1d9774cd0fc7697b7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 20 Jan 2021 13:50:57 -0700
Subject: [PATCH] mshta renamed

---
 detections/endpoint/detect_mshta_renamed.yml | 42 ++++++++++++++++++++
 tests/endpoint/detect_mshta_renamed.test.yml | 12 ++++++
 2 files changed, 54 insertions(+)
 create mode 100644 detections/endpoint/detect_mshta_renamed.yml
 create mode 100644 tests/endpoint/detect_mshta_renamed.test.yml

diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
new file mode 100644
index 0000000000..6e896a429d
--- /dev/null
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -0,0 +1,42 @@
+name: Detect mshta renamed
+id: 4006adac-5937-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies renamed instances of mshta.exe executing.
+  Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
+  analytic utilizes the internal name of the PE to identify if is the legitimate
+  mshta binary. Further analysis should be performed to review the executed content 
+  and validation it is the real mshta. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `detect_mshta_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of mshta.exe, but never renamed, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/tests/endpoint/detect_mshta_renamed.test.yml b/tests/endpoint/detect_mshta_renamed.test.yml
new file mode 100644
index 0000000000..7e6d69f00f
--- /dev/null
+++ b/tests/endpoint/detect_mshta_renamed.test.yml
@@ -0,0 +1,12 @@
+name: Detect mshta renamed unit test
+tests:
+- name: Detect mshta renamed
+  file: endpoint/detect_mshta_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file