From c65775b5e763cdd2b83e352ef498fa0552c7d6bc Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 24 Sep 2021 13:17:03 -0700 Subject: [PATCH] fixedsearchfortests --- .../endpoint/remcos_c2_install_process.yml | 52 ++++++++++++++++++ .../remcos_client_registry_install_entry.yml | 49 +++++++++++++++++ ...remcos_control_panel_license_dns_query.yml | 54 +++++++++++++++++++ .../remcos_c2_install_process.test.yml | 12 +++++ ...cos_client_registry_install_entry.test.yml | 12 +++++ ...s_control_panel_license_dns_query.test.yml | 12 +++++ 6 files changed, 191 insertions(+) create mode 100644 detections/endpoint/remcos_c2_install_process.yml create mode 100644 detections/endpoint/remcos_client_registry_install_entry.yml create mode 100644 detections/network/detect_remcos_control_panel_license_dns_query.yml create mode 100644 tests/endpoint/remcos_c2_install_process.test.yml create mode 100644 tests/endpoint/remcos_client_registry_install_entry.test.yml create mode 100644 tests/network/detect_remcos_control_panel_license_dns_query.test.yml diff --git a/detections/endpoint/remcos_c2_install_process.yml b/detections/endpoint/remcos_c2_install_process.yml new file mode 100644 index 0000000000..60ca0735cd --- /dev/null +++ b/detections/endpoint/remcos_c2_install_process.yml @@ -0,0 +1,52 @@ +name: Remcos C2 install process +id: fcf91f18-1d62-11ec-893e-acde48001122 +version: 1 +date: '2021-09-24' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: This search detects Remcos command and control (c2) panel, by identifying process and vendor company record. +search: '`sysmon` EventCode=1 Company="BreakingSecurity.net" | stats min(_time) as firstTime max(_time) as lastTime count by Computer Description signature dest parent_process_exec process_current_directory | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `remcos_c2_install_process_filter`' +how_to_implement: In order To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: False positives should be limited. +references: + - https://attack.mitre.org/software/S0332/ +tags: +analytic_story: + - Remcos +dataset: + - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_c2_install_process.log +kill_chain_phases: + - Exploitation +mitre_attack_id: + - T1543 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +required_fields: + - _time + - Computer + - Description + - parent_process_exec + - Signature + - process_current_directory +security_domain: endpoint +impact: 90 +confidence: 100 + # (impact * confidence)/100 +risk_score: 90 +context: +message: A process $parent_process_exec$ related to installation of Remcos RAT has been detected in host $Computer$ +observable: + name: Computer + type: Hostname + role: + - Victim + name: Company + type: Process + role: + - Attacker diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml new file mode 100644 index 0000000000..197be3097f --- /dev/null +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -0,0 +1,49 @@ +name: Remcos client registry install entry +id: f2a1615a-1d63-11ec-97d2-acde48001122 +version: 1 +date: '2021-09-24' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: This search detects registry key license at host where Remcos RAT agent is installed. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\Software\\Remcos*)| + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remcos_registry_install_entry_filter`' +how_to_implement: In order to successfully implement this search, you need to be ingesting + logs with the TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://attack.mitre.org/software/S0332/ +tags: + analytic_story: + - Remcos + dataset: + - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + message: A registry entry $registry_path$ with registry value $registry_key_name$ + related to Remcos RAT in host $dest$ + observable: + name: dest + type: Hostname + role: + - Victim diff --git a/detections/network/detect_remcos_control_panel_license_dns_query.yml b/detections/network/detect_remcos_control_panel_license_dns_query.yml new file mode 100644 index 0000000000..53223b24c5 --- /dev/null +++ b/detections/network/detect_remcos_control_panel_license_dns_query.yml @@ -0,0 +1,54 @@ +name: Detect remcos control panel license dns query +id: e897a1aa-1d64-11ec-99c7-acde48001122 +version: 1 +date: '2021-09-24' +author: Rod Soto +type: TTP +datamodel: + - Network_Resolution +description: This search will look for a specific DNS query made during the installation of Remcos Control panel, specifically directed towards p4-preview.runhosting.com. +search: '(index=* OR index=_*) ((`cim_Network_Resolution_indexes`) tag=network tag=resolution tag=dns) | search query=*preview.runhosting.com | stats count by query, answer +| `detect_remcos_control_panel_license_dns_query_filter`' +how_to_implement: 'Need to ingest data from your DNS operations. This + can be done by ingesting logs from your server or data, collected passively by Splunk + Stream or a similar solution. Specifically, data that contains the domain that is + being queried and the IP of the host originating the request must be populating + the `Network_Resolution` data model.' +known_false_positives: This specific domain its also associated with other products from the same vendor. They should be considered suspicious as well. +references: +- https://attack.mitre.org/software/S0332/ +tags: +analytic_story: +- Remcos +dataset: + - https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_control_panel_license_dns_query.log +kill_chain_phases: +- Exploitation +mitre_attack_id: +- T1016 +product: +- Splunk Enterprise +- Splunk Enterprise Security +- Splunk Cloud +required_fields: +- _time +- DNS.answer +- DNS.query +- host +security_domain: network +impact: 90 +confidence: 90 + # (impact * confidence)/100 +risk_score: 90 +context: +message: A dns query $query$ from your infrastructure attempted a connection to a Remcos RAT suspicious domain from + host $host$ +observable: +name: host +type: Hostname +role: + - Victim +name: query +type: dnsquery +role: + - Attacker diff --git a/tests/endpoint/remcos_c2_install_process.test.yml b/tests/endpoint/remcos_c2_install_process.test.yml new file mode 100644 index 0000000000..477b37d1d7 --- /dev/null +++ b/tests/endpoint/remcos_c2_install_process.test.yml @@ -0,0 +1,12 @@ +name: Remcos C2 install process Unit Test +tests: +- name: Remcos C2 install process + file: endpoint/remcos_c2_install_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-15d' + latest_time: 'now' + attack_data: + - file_name: remcos_c2_install_process.log + data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_c2_install_process.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/remcos_client_registry_install_entry.test.yml b/tests/endpoint/remcos_client_registry_install_entry.test.yml new file mode 100644 index 0000000000..fd7cad0f15 --- /dev/null +++ b/tests/endpoint/remcos_client_registry_install_entry.test.yml @@ -0,0 +1,12 @@ +name: Remcos client registry install entry Unit Test +tests: +- name: Remcos client registry install entry + file: endpoint/remcos_client_registry_install_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-15d' + latest_time: 'now' + attack_data: + - file_name: agent_license.log + data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/agent_license.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/network/detect_remcos_control_panel_license_dns_query.test.yml b/tests/network/detect_remcos_control_panel_license_dns_query.test.yml new file mode 100644 index 0000000000..e77f275ed9 --- /dev/null +++ b/tests/network/detect_remcos_control_panel_license_dns_query.test.yml @@ -0,0 +1,12 @@ +name: Detect remcos control panel license dns query Unit Test +tests: +- name: Detect remcos control panel license dns query + file: network/detect_remcos_control_panel_license_dns_query.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-15d' + latest_time: 'now' + attack_data: + - file_name: remcos_control_panel_license_dns_query.log + data: https://github.com/splunk/attack_data/blob/master/datasets/malware/remcos/remcos_panel_client/remcos_control_panel_license_dns_query.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog