hh renamed

hh renamed

detections/endpoint/detect_html_help_renamed.yml

@@ -0,0 +1,43 @@
+name: Detect HTML Help Renamed
+id: 62fed254-513b-460e-953d-79771493a9f3
+version: 1
+date: '2021-02-11'
+description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM).
+  This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm.
+  Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution.
+  The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code.
+  During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. 
+  hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. 
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 OriginalFileName=HH.exe NOT process_name=hh.exe
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_html_help_renamed_filter`'
+known_false_positives: Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed.
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML file Activity
+  mitre_attack_id:
+  - T1218.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -2,16 +2,12 @@ name: Detect HTML Help Spawn Child Process
 id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
 version: 1
 date: '2021-02-11'
-description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
-  HTML Help (CHM) that spawns a child process. This particular technique will load
-  Windows script code from compiled help file. CHM files may contain nearly any file
-  type embedded, but only execute html/htm. Upon a successful execution, the following
-  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
-  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
-  upon execution. The "htm" and "html" file extensions were the only extensions observed
-  to be supported for the execution of Shortcut commands or WSH script code. During
-  investigation, identify script content origination. Review child process events
-  and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process.
+  This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm.
+  Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution.
+  The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code.
+  During investigation, identify script content origination. Review child process events and investigate further.
+  hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. 
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -3,7 +3,7 @@ id: 8c5835b9-39d9-438b-817c-95f14c69a31e
 version: 1
 date: '2021-02-11'
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url.
-  This particular technique will load Windows script code from compiled help file. CHM files may  contain nearly any file type embedded, but only execute html/htm.
+  This particular technique will load Windows script code from a compiled help file. CHM files may  contain nearly any file type embedded, but only execute html/htm.
   Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution.
   The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code.
   During investigation, identify script content origination.
@@ -30,8 +30,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `detect_html_help_url_in_command_line_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of hh, triggering a false positive.
+known_false_positives: Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed.
 tags:
   analytic_story:
   - Suspicious Compiled HTML file Activity

tests/endpoint/detect_html_help_renamed.test.yml

@@ -0,0 +1,12 @@
+name: Detect HTML Help Renamed Unit Test
+tests:
+- name: Detect HTML Help Renamed
+  file: endpoint/detect_html_help_renamed.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog