fixedsearchfortests

detections/endpoint/remcos_c2_install_process.yml

@@ -0,0 +1,52 @@
+name: Remcos C2 install process
+id: fcf91f18-1d62-11ec-893e-acde48001122
+version: 1
+date: '2021-09-24'
+author: Rod Soto
+type: TTP
+datamodel:
+- Endpoint
+description: This search detects Remcos command and control (c2) panel, by identifying process and vendor company record.
+search: '`sysmon` EventCode=1 Company="BreakingSecurity.net"  |  stats  min(_time) as firstTime max(_time) as lastTime count by  Computer Description signature dest parent_process_exec process_current_directory | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `remcos_c2_install_process_filter`'
+how_to_implement: In order To successfully implement this search, you need to be ingesting
+  logs with the driver loaded and Signature from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: False positives should be limited.
+references:
+  - https://attack.mitre.org/software/S0332/
+tags:
+analytic_story:
+  - Remcos
+dataset:
+  - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_c2_install_process.log
+kill_chain_phases:
+  - Exploitation
+mitre_attack_id:
+  - T1543
+product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+required_fields:
+  - _time
+  - Computer
+  - Description
+  - parent_process_exec
+  - Signature
+  - process_current_directory
+security_domain: endpoint
+impact: 90
+confidence: 100
+  # (impact * confidence)/100
+risk_score: 90
+context:
+message: A process $parent_process_exec$ related to installation of Remcos RAT has been detected in host $Computer$
+observable:
+  name: Computer
+  type: Hostname
+  role:
+    - Victim
+  name: Company
+  type: Process
+  role:
+    - Attacker

detections/endpoint/remcos_client_registry_install_entry.yml

@@ -0,0 +1,49 @@
+name: Remcos client registry install entry
+id: f2a1615a-1d63-11ec-97d2-acde48001122
+version: 1
+date: '2021-09-24'
+author: Rod Soto
+type: TTP
+datamodel:
+- Endpoint
+description: This search detects registry key license at host where Remcos RAT agent is installed.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\Software\\Remcos*)|
+  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remcos_registry_install_entry_filter`'
+how_to_implement: In order to successfully implement this search, you need to be ingesting
+  logs with the TargetObject registry key, registry Details from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+-  https://attack.mitre.org/software/S0332/
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  message: A registry entry $registry_path$ with registry value $registry_key_name$
+     related to Remcos RAT in host $dest$
+  observable:
+    name: dest
+    type: Hostname
+    role:
+    - Victim

detections/network/detect_remcos_control_panel_license_dns_query.yml

@@ -0,0 +1,54 @@
+name: Detect remcos control panel license dns query
+id: e897a1aa-1d64-11ec-99c7-acde48001122
+version: 1
+date: '2021-09-24'
+author: Rod Soto
+type: TTP
+datamodel:
+ - Network_Resolution
+description: This search will look for a specific DNS query made during the installation of Remcos Control panel, specifically directed towards p4-preview.runhosting.com.
+search: '(index=* OR index=_*) ((`cim_Network_Resolution_indexes`) tag=network tag=resolution tag=dns) | search query=*preview.runhosting.com | stats count by query, answer
+| `detect_remcos_control_panel_license_dns_query_filter`'
+how_to_implement: 'Need to ingest data from your DNS operations. This
+  can be done by ingesting logs from your server or data, collected passively by Splunk
+  Stream or a similar solution. Specifically, data that contains the domain that is
+  being queried and the IP of the host originating the request must be populating
+  the `Network_Resolution` data model.'
+known_false_positives: This specific domain its also associated with other products from the same vendor. They should be considered suspicious as well.
+references:
+- https://attack.mitre.org/software/S0332/
+tags:
+analytic_story:
+- Remcos
+dataset:
+  - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_control_panel_license_dns_query.log
+kill_chain_phases:
+- Exploitation
+mitre_attack_id:
+- T1016
+product:
+- Splunk Enterprise
+- Splunk Enterprise Security
+- Splunk Cloud
+required_fields:
+- _time
+- DNS.answer
+- DNS.query
+- host
+security_domain: network
+impact: 90
+confidence: 90
+  # (impact * confidence)/100
+risk_score: 90
+context:
+message: A dns query $query$ from your infrastructure attempted a connection to a Remcos RAT suspicious domain from
+    host $host$
+observable:
+name: host
+type: Hostname
+role:
+  - Victim
+name: query
+type: dnsquery
+role:
+  - Attacker

tests/endpoint/remcos_c2_install_process.test.yml

@@ -0,0 +1,12 @@
+name: Remcos C2 install process Unit Test
+tests:
+- name: Remcos C2 install process
+  file: endpoint/remcos_c2_install_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-15d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: remcos_c2_install_process.log
+    data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_c2_install_process.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/remcos_client_registry_install_entry.test.yml

@@ -0,0 +1,12 @@
+name: Remcos client registry install entry Unit Test
+tests:
+- name: Remcos client registry install entry
+  file: endpoint/remcos_client_registry_install_entry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-15d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: agent_license.log
+    data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/network/detect_remcos_control_panel_license_dns_query.test.yml

@@ -0,0 +1,12 @@
+name: Detect remcos control panel license dns query Unit Test
+tests:
+- name: Detect remcos control panel license dns query
+  file: network/detect_remcos_control_panel_license_dns_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-15d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: remcos_control_panel_license_dns_query.log
+    data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_control_panel_license_dns_query.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog