From b401ed9d501ea197d2170a8655811a004af043b0 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 30 Aug 2022 13:08:04 +0200
Subject: [PATCH 01/13] brute-ratel-2

---
 ...k_execution_flow_version_dll_side_load.yml | 68 ++++++++++++++++++
 ...dows_phishing_recent_iso_exec_registry.yml | 69 +++++++++++++++++++
 ...remote_access_software_brc4_loaded_dll.yml | 67 ++++++++++++++++++
 ...cution_flow_version_dll_side_load.test.yml | 13 ++++
 ...phishing_recent_iso_exec_registry.test.yml | 13 ++++
 ...e_access_software_brc4_loaded_dll.test.yml | 13 ++++
 6 files changed, 243 insertions(+)
 create mode 100644 detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
 create mode 100644 detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
 create mode 100644 detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
 create mode 100644 tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml
 create mode 100644 tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml
 create mode 100644 tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml

diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
new file mode 100644
index 0000000000..e5a475b079
--- /dev/null
+++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
@@ -0,0 +1,68 @@
+name: Windows Hijack Execution Flow Version Dll Side Load
+id: 8351340b-ac0e-41ec-8b07-dd01bf32d6ea
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a process loading version.dll that are not in %windir%\\system32 or %windir%\\syswow64 dir path. 
+  This event are seen in ransomware apt that execute malicious version.dll place same place on onedrive application that will look for this module. 
+  This technique is known to be dll side loading. This technique was used to execute an agent from Brute Ratel C4 red teaming tools to serve as remote 
+  admin tool to collect and compromised target host.
+search: '`sysmon` EventCode=7  
+  ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*",  "*\\windows\\syswow64\\*"))) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_hijack_execution_flow_version_dll_side_load_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: unknown
+references:
+- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: a process $Image$ loading $ImageLoaded$ as a side load dll in $Computer$
+  mitre_attack_id:
+  - T1574.001
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  risk_score: 35
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
new file mode 100644
index 0000000000..55cea12051
--- /dev/null
+++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
@@ -0,0 +1,69 @@
+name: Windows Phishing Recent ISO Exec Registry
+id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic detects the registry artifacts when a user execute .iso file. 
+  This file type is being abused by adversaries, threat actors and even used by red teamers to execute malicious file ussually 
+  as an attachment to have initial access to the targetted host. once the user click or mount the ISO file, it will create registry 
+  foot print related to recent application used by the user that might be good indicator of compromised.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_phishing_recent_iso_exec_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process 
+  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
+  datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed 
+  and the latest TA for the endpoint product.
+known_false_positives: False positives may be high depending on the environment and consistent use of ISOs mounting. 
+  Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
+references:
+- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
+- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Delivery
+  message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed.
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name 
+  - Registry.user 
+  - Registry.registry_path 
+  - Registry.registry_value_data 
+  - Registry.action 
+  - Registry.dest 
+  risk_score: 40
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
new file mode 100644
index 0000000000..7688c0bbee
--- /dev/null
+++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
@@ -0,0 +1,67 @@
+name: Windows Remote Access Software BRC4 Loaded Dll
+id: 73cf5dcb-cf36-4167-8bbe-384fe5384d05
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic detects the possible Brute Ratel Agent process loading known module. 
+  Brute Rate C4 is one of the advance red teaming tools that being abused by adversaries and threat actors for their attack.
+  This detection look for known modules that can distinguish potential brute ratel process.
+search: '`sysmon` EventCode=7 
+  |bin _time span=30s
+  | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0)
+  | eval BRC4_LoadedDllPath=case(match(ImageLoaded, "credui.dll"), 1, match(ImageLoaded, "dbghelp.dll"), 1, match(ImageLoaded, "samcli.dll"), 1, match(ImageLoaded, "winhttp.dll"), 1, 1=1, 0)
+  | stats count min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as ImageLoaded values(OriginalFileName) as OriginalFileName dc(ImageLoaded) as ImageLoadedCount by Image  BRC4_LoadedDllPath BRC4_AnomalyLoadedDll Computer EventCode Signed
+  | where  ImageLoadedCount == 4 AND (BRC4_LoadedDllPath == 1 OR BRC4_AnomalyLoadedDll == 1)
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_remote_access_software_brc4_loaded_dll_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: this module can be loaded by a third party application. Filter is needed.
+references:
+- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a process $Image$ loaded several modules $ImageLoaded$ that might related to BRC4 in $Computer$
+  mitre_attack_id:
+  - T1219
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  risk_score: 6
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml b/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml
new file mode 100644
index 0000000000..32e1ebee01
--- /dev/null
+++ b/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml
@@ -0,0 +1,13 @@
+name: Windows Hijack Execution Flow Version Dll Side Load Unit Test
+tests:
+- name: Windows Hijack Execution Flow Version Dll Side Load
+  file: endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml b/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml
new file mode 100644
index 0000000000..bd6c8924f9
--- /dev/null
+++ b/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml
@@ -0,0 +1,13 @@
+name: Windows Phishing Recent ISO Exec Registry Unit Test
+tests:
+- name: Windows Phishing Recent ISO Exec Registry
+  file: endpoint/windows_phishing_recent_iso_exec_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml b/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml
new file mode 100644
index 0000000000..048de62597
--- /dev/null
+++ b/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml
@@ -0,0 +1,13 @@
+name: Windows Remote Access Software BRC4 Loaded Dll Unit Test
+tests:
+- name: Windows Remote Access Software BRC4 Loaded Dll
+  file: endpoint/windows_remote_access_software_brc4_loaded_dll.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 8d6d137ba19a130c964ecbdbf493081a1017bc9f Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 30 Aug 2022 13:11:24 +0200
Subject: [PATCH 02/13] Update
 windows_remote_access_software_brc4_loaded_dll.yml

---
 .../endpoint/windows_remote_access_software_brc4_loaded_dll.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
index 7688c0bbee..a1cb0080c2 100644
--- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
+++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
@@ -63,5 +63,5 @@ tags:
   - EventCode
   - Signed
   - ProcessId 
-  risk_score: 6
+  risk_score: 9
   security_domain: endpoint

From d91a14c4d41edb289cb046578b21fcf84b434f4f Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 30 Aug 2022 17:42:04 +0200
Subject: [PATCH 03/13] Update
 windows_hijack_execution_flow_version_dll_side_load.yml

---
 ...indows_hijack_execution_flow_version_dll_side_load.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
index e5a475b079..e03c69afb4 100644
--- a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
+++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a process loading version.dll that are not in %windir%\\system32 or %windir%\\syswow64 dir path. 
-  This event are seen in ransomware apt that execute malicious version.dll place same place on onedrive application that will look for this module. 
-  This technique is known to be dll side loading. This technique was used to execute an agent from Brute Ratel C4 red teaming tools to serve as remote 
-  admin tool to collect and compromised target host.
+description: This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. 
+  This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application 
+  that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of 
+  Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host.
 search: '`sysmon` EventCode=7  
   ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*",  "*\\windows\\syswow64\\*"))) 
   | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 

From ec1a26ed464420866c90d49ea7f59a871a1e8d1e Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 30 Aug 2022 17:46:57 +0200
Subject: [PATCH 04/13] Update windows_phishing_recent_iso_exec_registry.yml

---
 .../windows_phishing_recent_iso_exec_registry.yml         | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
index 55cea12051..0193c8ea3c 100644
--- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
+++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic detects the registry artifacts when a user execute .iso file. 
-  This file type is being abused by adversaries, threat actors and even used by red teamers to execute malicious file ussually 
-  as an attachment to have initial access to the targetted host. once the user click or mount the ISO file, it will create registry 
-  foot print related to recent application used by the user that might be good indicator of compromised.
+description: The following analytic detects the registry artifacts when a user opens , clicks or mount the .iso file. 
+  This file type is being abused by adversaries, threat actors and even used by red teamers in their spear phishing attachment 
+  to have initial access to the targeted host. Once the user click or mount the ISO file, it will create a registry 
+  footprint related to this event as a recent application executed or open by the user.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
   where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" 
   by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 

From e90fa05a96c2cb37b1d57a0a05e5c4df26e436d5 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 30 Aug 2022 17:49:16 +0200
Subject: [PATCH 05/13] Update
 windows_remote_access_software_brc4_loaded_dll.yml

---
 .../windows_remote_access_software_brc4_loaded_dll.yml        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
index a1cb0080c2..22253e036e 100644
--- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
+++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
@@ -7,8 +7,8 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic detects the possible Brute Ratel Agent process loading known module. 
-  Brute Rate C4 is one of the advance red teaming tools that being abused by adversaries and threat actors for their attack.
-  This detection look for known modules that can distinguish potential brute ratel process.
+  Brute Ratel C4 tool is one of the advanced red teaming tools that is being abused by adversaries and threat actors for their attacks.
+  This detection looks for known modules that can distinguish potential BRC4 processes.
 search: '`sysmon` EventCode=7 
   |bin _time span=30s
   | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0)

From 126049593e93590a3646aa69321ed074941a3fb9 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 30 Aug 2022 11:21:46 -0600
Subject: [PATCH 06/13] Updates

---
 .../windows_phishing_recent_iso_exec_registry.yml  | 11 +++++------
 ...dows_remote_access_software_brc4_loaded_dll.yml | 14 +++++++++-----
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
index 0193c8ea3c..b7644289c0 100644
--- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
+++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
@@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic detects the registry artifacts when a user opens , clicks or mount the .iso file. 
-  This file type is being abused by adversaries, threat actors and even used by red teamers in their spear phishing attachment 
-  to have initial access to the targeted host. Once the user click or mount the ISO file, it will create a registry 
-  footprint related to this event as a recent application executed or open by the user.
+description: The following hunting analytic identifies registry artifacts when a ISO container is openedm clicked or mounted on the Windows operating system.
+  As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. 
+  Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
   where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" 
   by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
@@ -19,9 +18,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `windows_phishing_recent_iso_exec_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process 
   that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
-  datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed 
+  datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed 
   and the latest TA for the endpoint product.
-known_false_positives: False positives may be high depending on the environment and consistent use of ISOs mounting. 
+known_false_positives: False positives may be high depending on the environment and consistent use of ISOs. 
   Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
 references:
 - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
index 22253e036e..81cc16ad8a 100644
--- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
+++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
@@ -6,9 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic detects the possible Brute Ratel Agent process loading known module. 
-  Brute Ratel C4 tool is one of the advanced red teaming tools that is being abused by adversaries and threat actors for their attacks.
-  This detection looks for known modules that can distinguish potential BRC4 processes.
+description: The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. For example, credential managers are notified when a user logs on or an account password changes. Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
 search: '`sysmon` EventCode=7 
   |bin _time span=30s
   | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0)
@@ -20,10 +18,15 @@ search: '`sysmon` EventCode=7
   | `windows_remote_access_software_brc4_loaded_dll_filter`'
 how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
   add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
-known_false_positives: this module can be loaded by a third party application. Filter is needed.
+known_false_positives: This module can be loaded by a third party application. Filter is needed.
 references:
 - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
 - https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
+- https://strontic.github.io/xcyclopedia/library/logoncli.dll-138871DBE68D0696D3D7FA91BC2873B1.html
+- https://strontic.github.io/xcyclopedia/library/credui.dll-A5BD797BBC2DD55231B9DE99837E5461.html
+- https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-manager
+- https://strontic.github.io/xcyclopedia/library/samcli.dll-522D6D616EF142CDE965BD3A450A9E4C.html
+- https://strontic.github.io/xcyclopedia/library/dbghelp.dll-15A55EAB307EF8C190FE6135C0A86F7C.html
 tags:
   analytic_story:
   - Brute Ratel C4
@@ -40,9 +43,10 @@ tags:
   impact: 30
   kill_chain_phases:
   - Exploitation
-  message: a process $Image$ loaded several modules $ImageLoaded$ that might related to BRC4 in $Computer$
+  message: a process $Image$ loaded several modules $ImageLoaded$ that might related to credential access on $Computer$.
   mitre_attack_id:
   - T1219
+  - T1003
   nist:
   - DE.CM
   observable:

From c8f038be5d9f84e16150fe215d0bb420134498f0 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 31 Aug 2022 09:44:21 +0200
Subject: [PATCH 07/13] Update
 windows_remote_access_software_brc4_loaded_dll.yml

---
 .../windows_remote_access_software_brc4_loaded_dll.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
index 81cc16ad8a..6801bc82b1 100644
--- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
+++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
@@ -6,7 +6,15 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. For example, credential managers are notified when a user logs on or an account password changes. Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
+description: The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. 
+  Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded 
+  into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll 
+  is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. 
+  For example, credential managers are notified when a user logs on or an account password changes. 
+  Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) 
+  database either through in-memory techniques or through the Windows Registry where the SAM database is stored. 
+  Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. 
+  All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
 search: '`sysmon` EventCode=7 
   |bin _time span=30s
   | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0)

From 1557a528cf698671bfe2badf218efd1657d8ca86 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 31 Aug 2022 10:12:55 +0200
Subject: [PATCH 08/13] brute-ratel-2

---
 ...indows_gather_victim_identity_sam_info.yml | 66 +++++++++++++++++
 ..._input_capture_using_credential_ui_dll.yml | 70 +++++++++++++++++++
 ...s_gather_victim_identity_sam_info.test.yml | 13 ++++
 ...t_capture_using_credential_ui_dll.test.yml | 13 ++++
 4 files changed, 162 insertions(+)
 create mode 100644 detections/endpoint/windows_gather_victim_identity_sam_info.yml
 create mode 100644 detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
 create mode 100644 tests/endpoint/windows_gather_victim_identity_sam_info.test.yml
 create mode 100644 tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml

diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
new file mode 100644
index 0000000000..60243af3a9
--- /dev/null
+++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
@@ -0,0 +1,66 @@
+name: Windows Gather Victim Identity SAM Info
+id: a18e85d7-8b98-4399-820c-d46a1ca3516f
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies a process that loads the samlib.dll module. 
+  This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. 
+  This hunting query can be a good indicator that a process is capable of accessing the SAM object.
+search: '`sysmon` EventCode=7  ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll" AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_gather_victim_identity_sam_info_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: this module can be loaded by a third party application. Filter is needed.
+references:
+- https://redcanary.com/blog/active-breach-evading-defenses/
+- https://strontic.github.io/xcyclopedia/library/samlib.dll-0BDF6351009F6EBA5BA7E886F23263B1.html
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information.
+  mitre_attack_id:
+  - T1589.001
+  - T1589
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded 
+  - Computer 
+  - EventCode 
+  - Signed 
+  - ProcessId 
+  risk_score: 6
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
new file mode 100644
index 0000000000..1bcb2085d2
--- /dev/null
+++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
@@ -0,0 +1,70 @@
+name: Windows Input Capture Using Credential UI Dll
+id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies a process that loads the credui.dll module. 
+  This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt 
+  dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. 
+  This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. 
+  This hunting query may hit false positive for a third party application that uses a credential login UI for user login.
+search: '`sysmon` EventCode=7  (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll")
+  AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Computer EventCode Signed ProcessId ProcessGuid
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_input_capture_using_credential_ui_dll_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: this module can be loaded by a third party application. Filter is needed.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa
+- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a process $Image$ loaded $ImageLoaded$ in $Computer$
+  mitre_attack_id:
+  - T1056.002
+  - T1056
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  risk_score: 6
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml b/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml
new file mode 100644
index 0000000000..d5d0ca38df
--- /dev/null
+++ b/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml
@@ -0,0 +1,13 @@
+name: Windows Gather Victim Identity SAM Info Unit Test
+tests:
+- name: Windows Gather Victim Identity SAM Info
+  file: endpoint/windows_gather_victim_identity_sam_info.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml b/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml
new file mode 100644
index 0000000000..be9b725986
--- /dev/null
+++ b/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml
@@ -0,0 +1,13 @@
+name: Windows Input Capture Using Credential UI Dll Unit Test
+tests:
+- name: Windows Input Capture Using Credential UI Dll
+  file: endpoint/windows_input_capture_using_credential_ui_dll.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 8abf77841129ee6836192b9b4959758ab6c73922 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 1 Sep 2022 15:38:42 +0200
Subject: [PATCH 09/13] Update windows_gather_victim_identity_sam_info.yml

---
 detections/endpoint/windows_gather_victim_identity_sam_info.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
index 60243af3a9..842528a747 100644
--- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml
+++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
@@ -62,5 +62,5 @@ tags:
   - EventCode 
   - Signed 
   - ProcessId 
-  risk_score: 6
+  risk_score: 9
   security_domain: endpoint

From d764f48a295aab230fb7794eb8583608471ce8dd Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 1 Sep 2022 15:39:08 +0200
Subject: [PATCH 10/13] Update
 windows_input_capture_using_credential_ui_dll.yml

---
 .../endpoint/windows_input_capture_using_credential_ui_dll.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
index 1bcb2085d2..ea308ddca3 100644
--- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
+++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
@@ -66,5 +66,5 @@ tags:
   - EventCode
   - Signed
   - ProcessId 
-  risk_score: 6
+  risk_score: 9
   security_domain: endpoint

From 2dc78584a0c286311651fd42bb1d041d00c154b3 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 5 Sep 2022 10:56:01 +0200
Subject: [PATCH 11/13] Update windows_phishing_recent_iso_exec_registry.yml

---
 .../endpoint/windows_phishing_recent_iso_exec_registry.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
index b7644289c0..38efa868b9 100644
--- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
+++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following hunting analytic identifies registry artifacts when a ISO container is openedm clicked or mounted on the Windows operating system.
+description: The following hunting analytic identifies registry artifacts when a ISO container is opened, clicked or mounted on the Windows operating system.
   As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. 
   Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 

From 385bc45c5d99a352bc5cd2e484dcd2abd91b2503 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 5 Sep 2022 10:56:24 +0200
Subject: [PATCH 12/13] Update windows_phishing_recent_iso_exec_registry.yml

---
 .../endpoint/windows_phishing_recent_iso_exec_registry.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
index 38efa868b9..b82b44feeb 100644
--- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
+++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following hunting analytic identifies registry artifacts when a ISO container is opened, clicked or mounted on the Windows operating system.
+description: The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system.
   As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. 
   Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 

From 1d4f5c69210d2dc93bbe8d813390d48d2d3d3b65 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 14 Sep 2022 14:43:13 +0200
Subject: [PATCH 13/13] Update windows_gather_victim_identity_sam_info.yml

---
 .../endpoint/windows_gather_victim_identity_sam_info.yml       | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
index 842528a747..cf54501c99 100644
--- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml
+++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
@@ -9,7 +9,8 @@ datamodel:
 description: The following analytic identifies a process that loads the samlib.dll module. 
   This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. 
   This hunting query can be a good indicator that a process is capable of accessing the SAM object.
-search: '`sysmon` EventCode=7  ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll" AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
+search: '`sysmon` EventCode=7  (ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL")
+AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
   | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`