diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 55bfce0eb6..d80c836797 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -84,6 +84,7 @@ action.email.useNSSubject = 1 alert.digest_mode = 1 {% if detection.disabled is defined %} disabled = false +allow_skew = 100% {% else %} disabled = true {% endif %} diff --git a/bin/validate.py b/bin/validate.py index 1385fcc242..19aa011677 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -45,6 +45,7 @@ def validate_schema(REPO_PATH, type, objects, verbose): except yaml.YAMLError as exc: print(exc) print("Error reading {0}".format(manifest_file)) + errors.append("ERROR: Error reading {0}".format(manifest_file)) error = True continue @@ -258,7 +259,7 @@ def validate_tests(REPO_PATH, object): errors.append('ERROR: orphaned test: {0}, detection file: {1} no longer exists or incorrect detection path under `file`'.format(object['name'], detection_file_path)) else: errors.append('ERROR: test: {0} does not have a detection `file` associated with detection: {1}'.format(object['name'], test['name'])) - test['file'] + #test['file'] return errors def main(REPO_PATH, verbose): diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 5ddb223ebd..ef96015f78 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -44,4 +44,7 @@ tags: - userAgent - errorCode - userIdentity.type + risk_object: src_ip + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 6b27566d71..8dbe65bb13 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -49,4 +49,7 @@ tags: - userAgent - errorCode - requestParameters.policyName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 1bdbeae373..b049e0f898 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -46,4 +46,7 @@ tags: - userAgent - errorCode - requestParameters.policyArn + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 27201dcf6c..0315b7eb6b 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -46,4 +46,7 @@ tags: - userAgent - errorCode - requestParameters.groupName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: identity diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index bd28eddce7..997d2d01d5 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -45,4 +45,7 @@ tags: - userAgent - errorCode - requestParameters.groupName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: identity diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml new file mode 100644 index 0000000000..15892139c1 --- /dev/null +++ b/detections/endpoint/deleting_of_net_users.yml @@ -0,0 +1,49 @@ +name: Deleting Of Net Users +id: 1c8c6f66-acce-11eb-aafb-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will detect a suspicious net.exe/net1.exe command-line to + delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some + user or deleting adversaries tracks created during its lateral movement additional systems. + During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND + Processes.process="*user*" AND Processes.process="*/delete*" by Processes.process_name + Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_id + - Processes.parent_process + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml new file mode 100644 index 0000000000..395741269b --- /dev/null +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -0,0 +1,50 @@ +name: Disable Windows App Hotkeys +id: 1490f224-ad8b-11eb-8c4f-acde48001122 +version: 1 +date: '2021-05-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic detects a suspicious registry modification to disable + Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly + used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. + This technique is used to impair the analyst in analyzing and removing the attacker implant + in compromised systems. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows + NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name + = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest + Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_name + - Registry.dest Registry.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml new file mode 100644 index 0000000000..3434f35757 --- /dev/null +++ b/detections/endpoint/disabling_net_user_account.yml @@ -0,0 +1,49 @@ +name: Disabling Net User Account +id: c0325326-acd6-11eb-98c2-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will identify a suspicious command-line that disables a + user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt + availability of such users to do their malicious act. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND + Processes.process="*user*" AND Processes.process="*/active:no*" by Processes.process_name + Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be + used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_id + - Processes.parent_process + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml new file mode 100644 index 0000000000..e8ab7b70cd --- /dev/null +++ b/detections/endpoint/download_files_using_telegram.yml @@ -0,0 +1,47 @@ +name: Download Files Using Telegram +id: 58194e28-ae5e-11eb-8912-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic will identify a suspicious download by the Telegram application + on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with + downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. +search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" + |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode + Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `download_files_using_telegram_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and TargetFilename from your endpoints or Events that + monitor filestream events which is happened when process download something. (EventCode + 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon + TA. +known_false_positives: normal download of file in telegram app. (if it was a common + app in network) +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1105 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - EventCode + - Image + - process_id + - TargetFilename + - Hash + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml new file mode 100644 index 0000000000..3dbe4255d2 --- /dev/null +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -0,0 +1,48 @@ +name: Enumerate Users Local Group Using Telegram +id: fcd74532-ae54-11eb-a5ab-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will detect a suspicious Telegram process enumerating + all network users in a local group. This technique was seen in a Monero infected honeypot + to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. +search: '`wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" | + stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode + Process_Name Process_ID Account_Name Account_Domain Logon_ID Security_ID Message + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and + filter known instances of process like logonUI used in your environment. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ComputerName + - EventCode + - Process_Name + - Process_ID + - Account_Name + - Account_Domain + - Logon_ID + - Security_ID + - Message + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-security.log diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml new file mode 100644 index 0000000000..a3c431b2c0 --- /dev/null +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -0,0 +1,48 @@ +name: Excessive Attempt To Disable Services +id: 8fa2a0f0-acd9-11eb-8994-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will identify suspicious series of command-line to disable + several services. This technique is seen where the adversary attempts to disable + security app services or other malware services to complete the objective on the compromised system. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = + "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name + Processes.parent_process_name Processes.dest Processes.user _time span=1m | where + count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml new file mode 100644 index 0000000000..add7e63327 --- /dev/null +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -0,0 +1,50 @@ +name: Excessive Service Stop Attempt +id: ae8d3f4a-acd7-11eb-8846-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious series of attempt to kill multiple + services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries + to terminate security services or other related services to continue there objective and + evade detections. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" + OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND + Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name + Processes.parent_process_name Processes.dest Processes.user _time span=1m | where + count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml new file mode 100644 index 0000000000..7771fff3fd --- /dev/null +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -0,0 +1,48 @@ +name: Excessive Usage Of Cacls App +id: 0bdf6092-af17-11eb-939a-acde48001122 +version: 1 +date: '2021-05-07' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application + to change file or folder permission. This behavior is commonly seen where the adversary + attempts to impair some users from deleting or accessing its malware components + or artifact from the compromised system. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.process_name) as process_name + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" + OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process + Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml new file mode 100644 index 0000000000..423a770138 --- /dev/null +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -0,0 +1,47 @@ +name: Excessive Usage Of Net App +id: 45e52536-ae42-11eb-b5c6-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies excessive usage of `net.exe` or `net1.exe` + within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts + to create many users, delete and disable users as part of its malicious behavior. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" + OR Processes.process_name = "net1.exe" by Processes.process_name Processes.parent_process_name + Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: unknown. Filter as needed. Modify the time span as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml new file mode 100644 index 0000000000..3a8ce21928 --- /dev/null +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -0,0 +1,47 @@ +name: Excessive Usage Of Taskkill +id: fe5bca48-accb-11eb-a67c-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies excessive usage of `taskkill.exe` + application. This application is commonly used by adversaries to evade + detections by killing security product processes or even other processes to evade detection. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by + Processes.parent_process_name Processes.process_name Processes.dest Processes.user + _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: Unknown. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml new file mode 100644 index 0000000000..c1bd6234fe --- /dev/null +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -0,0 +1,54 @@ +name: Executables Or Script Creation In Suspicious Path +id: a7e3f0f0-ae42-11eb-b245-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will identify suspicious executable or scripts (known file + extensions) in list of suspicious file path in Windows. This technique is used + by adversaries to evade detection. The suspicious + file path are known paths used in the wild and are not common to have executable or scripts. +search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name + = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name + = *.vbe OR Filesystem.file_name = *.js OR Filesystem.file_name = *.ps1 OR Filesystem.file_name + = *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) AND ( Filesystem.file_path + = *\\windows\\fonts\\* OR Filesystem.file_path = *\\windows\\temp\\* OR Filesystem.file_path + = *\\users\\public\\* OR Filesystem.file_path = *\\windows\\debug\\* OR Filesystem.file_path + = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\* + OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin* + OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\* + OR Filesystem.file_path = *\\AppData\\Local\\Temp*) by Filesystem.file_create_time + Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in the paths specified. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1036 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml new file mode 100644 index 0000000000..901d3f701a --- /dev/null +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -0,0 +1,49 @@ +name: Hide User Account From Sign-In Screen +id: 834ba832-ad89-11eb-937d-acde48001122 +version: 1 +date: '2021-05-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies a suspicious registry modification to hide a + user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will + create a hidden user account with Admin privileges in login screen to avoid noticing + by the user that they already compromise and to persist on that said machine. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows + NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_name + = "DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_value_name + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` + | `hide_user_account_from_sign_in_screen_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: Unknown. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_name + - Registry.dest Registry.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml new file mode 100644 index 0000000000..07cbeb0041 --- /dev/null +++ b/detections/endpoint/icacls_deny_command.yml @@ -0,0 +1,48 @@ +name: Icacls Deny Command +id: cf8d753e-a8fe-11eb-8f58-acde48001122 +version: 1 +date: '2021-04-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies a potential adversary that changes the security + permission of a specific file or directory. This technique is commonly + seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" + OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" + AND Processes.process = "*/deny*" by Processes.parent_process_name Processes.process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: Unknown. It is possible some administrative scripts use ICacls. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.process + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml new file mode 100644 index 0000000000..f299ff8681 --- /dev/null +++ b/detections/endpoint/icacls_grant_command.yml @@ -0,0 +1,49 @@ +name: ICACLS Grant Command +id: b1b1e316-accc-11eb-a9b4-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies potential adversaries that modify the security + permission of a specific file or directory. This technique is commonly + seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component + files. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" + OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" + AND Processes.process = "*/grant*" by Processes.parent_process_name Processes.process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: Unknown. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.process + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml new file mode 100644 index 0000000000..d67033c20f --- /dev/null +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -0,0 +1,51 @@ +name: Modify ACL permission To Files Or Folder +id: 7e8458cc-acca-11eb-9e3f-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies suspicious modification of ACL permission + to a files or folder to make it available to everyone. This technique may be used by + the adversary to evade ACLs or protected files access. This changes is commonly configured + by the file or directory owner with appropriate permission. This behavior is a good indicator + if this command seen on a machine utilized by an account with no permission to do so. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" + OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe" + AND (Processes.process = "*/G everyone:*" OR Processes.process = "*/G SYSTEM:*") + by Processes.parent_process_name Processes.process_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `modify_acl_permission_to_files_or_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. +known_false_positives: administrators may use this command. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml new file mode 100644 index 0000000000..4fe42bff39 --- /dev/null +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -0,0 +1,46 @@ +name: Process Kill Base On File Path +id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = + "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*" + AND Processes.process="*delete*" by Processes.parent_process_name Processes.process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed wmic.exe may be used. +known_false_positives: Unknown. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_id + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 4a04c6f7d4..e64cf9fb68 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -12,11 +12,11 @@ description: The following query utilizes Windows Security EventCode 4698, `A sc technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether - it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` - and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or + it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in - memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or + memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml new file mode 100644 index 0000000000..ad085ebda0 --- /dev/null +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -0,0 +1,48 @@ +name: Schtasks Run Task On Demand +id: bb37061e-af1f-11eb-a159-acde48001122 +version: 1 +date: '2021-05-07' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies an on demand run of a Windows Schedule Task through shell + or command-line. This technique has been used by adversaries that force + to run their created Schedule Task as their persistence mechanism or for lateral + movement as part of their malicious attack to the compromised machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "schtasks.exe" + Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used. +known_false_positives: Administrators may use to debug Schedule Task entries. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml new file mode 100644 index 0000000000..99329d91ce --- /dev/null +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -0,0 +1,47 @@ +name: Suspicious Driver Loaded Path +id: f880acd4-a8f1-11eb-a53b-acde48001122 +version: 1 +date: '2021-04-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic will detect suspicious driver loaded paths. This technique + is commonly used by malicious software like coin miners (xmrig) to register its malicious driver + from notable directories where executable or drivers do not commonly exist. + During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. +search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", + "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as + firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature + Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `suspicious_driver_loaded_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Limited false positives will be present. Some applications do load drivers +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - ImageLoaded + - Hashes + - IMPHASH + - Signature + - Signed + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml new file mode 100644 index 0000000000..60a0fdf0c9 --- /dev/null +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -0,0 +1,54 @@ +name: Suspicious Process File Path +id: 9be25988-ad82-11eb-a14f-acde48001122 +version: 1 +date: '2021-05-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic will detect a suspicious process running in a file path where + a process is not commonly seen and is most commonly used by malicious softtware. This behavior has been + used by adversaries where they drop and run an exe in a path that is accessible without + admin privileges. +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" + OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" + OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path + = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*" + OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path + = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path + = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" by Processes.parent_process_name + Processes.parent_process Processes.process_path Processes.dest Processes.user | + `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `suspicious_process_file_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators may allow execution of specific binaries in non-standard paths. Filter as needed. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1543 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_path + - Processes.dest + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml new file mode 100644 index 0000000000..bef5b59256 --- /dev/null +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -0,0 +1,44 @@ +name: XMRIG Driver Loaded +id: 90080fa6-a8df-11eb-91e4-acde48001122 +version: 1 +date: '2021-04-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies XMRIG coinminer driver installation on the system. + The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused + by adversaries to infect and mine bitcoin. +search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" + | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded + Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `xmrig_driver_loaded_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: False positives should be limited. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +tags: + analytic_story: + - XMRig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - ImageLoaded + - Hashes + - IMPHASH + - Signature + - Signed + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 8501979d6a..eef6c5fa4e 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -4,7 +4,8 @@ version: 1 date: '2021-04-22' author: Teoderick Contreras, Splunk type: batch -datamodel: [] +datamodel: +- Network_Traffic description: This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using diff --git a/stories/ransomware_darkside.yml b/stories/ransomware_darkside.yml index fa49d4adf1..734c881cbc 100644 --- a/stories/ransomware_darkside.yml +++ b/stories/ransomware_darkside.yml @@ -1,7 +1,7 @@ name: DarkSide Ransomware id: 507edc74-13d5-4339-878e-b9114ded1f35 version: 1 -date: '2020-06-12' +date: '2021-05-12' author: Bhavin Patel, Splunk type: batch description: Leverage searches that allow you to detect and investigate unusual activities diff --git a/stories/xmrig.yml b/stories/xmrig.yml new file mode 100644 index 0000000000..2c5f1b30eb --- /dev/null +++ b/stories/xmrig.yml @@ -0,0 +1,35 @@ +name: XMRig +id: 06723e6a-6bd8-4817-ace2-5fb8a7b06628 +version: 1 +date: '2021-05-07' +author: Teoderick Contreras, Rod Soto Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the xmrig monero, including looking for file writes associated + with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) + and hacking tools including Telegram as mean of command and control (C2) to download other files. + Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. + One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. + Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. + (1) Servers and cloud-based + (2) systems are common targets because of the high potential for available resources, + but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining. +narrative: XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. + This monero is seen in the wild on May 2017. +references: +- https://github.com/xmrig/xmrig +- https://www.getmonero.org/resources/user-guides/mine-to-pool.html +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/ +tags: + analytic_story: XMRig + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + + + diff --git a/tests/endpoint/deleting_of_net_users.test.yml b/tests/endpoint/deleting_of_net_users.test.yml new file mode 100644 index 0000000000..c06140938e --- /dev/null +++ b/tests/endpoint/deleting_of_net_users.test.yml @@ -0,0 +1,16 @@ +name: Deleting Of Net Users Unit Test +tests: +- name: Excessive Deleting Of Users + file: endpoint/deleting_of_net_users.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + + \ No newline at end of file diff --git a/tests/endpoint/disable_windows_app_hotkeys.test.yml b/tests/endpoint/disable_windows_app_hotkeys.test.yml new file mode 100644 index 0000000000..addc4307f6 --- /dev/null +++ b/tests/endpoint/disable_windows_app_hotkeys.test.yml @@ -0,0 +1,12 @@ +name: Disable Windows App Hotkeys Unit Test +tests: +- name: Disable Windows App Hotkeys + file: endpoint/disable_windows_app_hotkeys.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_net_user_account.test.yml b/tests/endpoint/disabling_net_user_account.test.yml new file mode 100644 index 0000000000..0b0824737f --- /dev/null +++ b/tests/endpoint/disabling_net_user_account.test.yml @@ -0,0 +1,12 @@ +name: Disabling Net User Account Unit Test +tests: +- name: Disabling Net User Account + file: endpoint/disabling_net_user_account.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/download_files_using_telegram.test.yml b/tests/endpoint/download_files_using_telegram.test.yml new file mode 100644 index 0000000000..74b143e66e --- /dev/null +++ b/tests/endpoint/download_files_using_telegram.test.yml @@ -0,0 +1,14 @@ +name: Download Files Using Telegram Unit Test +tests: +- name: Download Files Using Telegram + file: endpoint/download_files_using_telegram.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + diff --git a/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml b/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml new file mode 100644 index 0000000000..59f6e6d3e9 --- /dev/null +++ b/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml @@ -0,0 +1,12 @@ +name: Enumerate Users Local Group Using Telegram Unit Test +tests: +- name: Enumerate Users Local Group Using Telegram + file: endpoint/enumerate_users_local_group_using_telegram.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/excessive_attempt_to_disable_services.test.yml b/tests/endpoint/excessive_attempt_to_disable_services.test.yml new file mode 100644 index 0000000000..d88d68a4bc --- /dev/null +++ b/tests/endpoint/excessive_attempt_to_disable_services.test.yml @@ -0,0 +1,12 @@ +name: Excessive Attempt To Disable Services Unit Test +tests: +- name: Excessive Attempt To Disable Services + file: endpoint/excessive_attempt_to_disable_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_service_stop_attempt.test.yml b/tests/endpoint/excessive_service_stop_attempt.test.yml new file mode 100644 index 0000000000..e678515f18 --- /dev/null +++ b/tests/endpoint/excessive_service_stop_attempt.test.yml @@ -0,0 +1,12 @@ +name: Excessive Service Stop Attempt Unit Test +tests: +- name: Excessive Service Stop Attempt + file: endpoint/excessive_service_stop_attempt.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_cacls_app.test.yml b/tests/endpoint/excessive_usage_of_cacls_app.test.yml new file mode 100644 index 0000000000..a547af951a --- /dev/null +++ b/tests/endpoint/excessive_usage_of_cacls_app.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of Cacls App Unit Test +tests: +- name: Excessive Usage Of Cacls App + file: endpoint/excessive_usage_of_cacls_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_net_app.test.yml b/tests/endpoint/excessive_usage_of_net_app.test.yml new file mode 100644 index 0000000000..557963736e --- /dev/null +++ b/tests/endpoint/excessive_usage_of_net_app.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of Net App Unit Test +tests: +- name: Excessive Usage Of Net App + file: endpoint/excessive_usage_of_net_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_taskkill.test.yml b/tests/endpoint/excessive_usage_of_taskkill.test.yml new file mode 100644 index 0000000000..9ac7b25183 --- /dev/null +++ b/tests/endpoint/excessive_usage_of_taskkill.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of Taskkill Unit Test +tests: +- name: Excessive Usage Of Taskkill + file: endpoint/excessive_usage_of_taskkill.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/executables_or_script_creation_in_suspicious_path.test.yml b/tests/endpoint/executables_or_script_creation_in_suspicious_path.test.yml new file mode 100644 index 0000000000..0183b2e7a1 --- /dev/null +++ b/tests/endpoint/executables_or_script_creation_in_suspicious_path.test.yml @@ -0,0 +1,12 @@ +name: Executables Or Script Creation In Suspicious Path Unit Test +tests: +- name: Executables Or Script Creation In Suspicious Path + file: endpoint/executables_or_script_creation_in_suspicious_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml b/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml new file mode 100644 index 0000000000..bb0f6358f0 --- /dev/null +++ b/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml @@ -0,0 +1,12 @@ +name: Hide User Account From Sign-In Screen Unit Test +tests: +- name: Hide User Account From Sign-In Screen + file: endpoint/hide_user_account_from_sign_in_screen.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/icacls_deny_command.test.yml b/tests/endpoint/icacls_deny_command.test.yml new file mode 100644 index 0000000000..eec60ce008 --- /dev/null +++ b/tests/endpoint/icacls_deny_command.test.yml @@ -0,0 +1,12 @@ +name: Icacls Deny Command Unit Test +tests: +- name: Icacls Deny Command + file: endpoint/icacls_deny_command.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/icacls_grant_command.test.yml b/tests/endpoint/icacls_grant_command.test.yml new file mode 100644 index 0000000000..c2c8c66ee4 --- /dev/null +++ b/tests/endpoint/icacls_grant_command.test.yml @@ -0,0 +1,12 @@ +name: ICACLS Grant Command Unit Test +tests: +- name: ICACLS Grant Command + file: endpoint/icacls_grant_command.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/modify_acl_permission_to_files_or_folder.test.yml b/tests/endpoint/modify_acl_permission_to_files_or_folder.test.yml new file mode 100644 index 0000000000..c0ef962a35 --- /dev/null +++ b/tests/endpoint/modify_acl_permission_to_files_or_folder.test.yml @@ -0,0 +1,12 @@ +name: Modify ACL permission To Files Or Folder Unit Test +tests: +- name: Modify ACL permission To Files Or Folder + file: endpoint/modify_acl_permission_to_files_or_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/process_kill_base_on_file_path.test.yml b/tests/endpoint/process_kill_base_on_file_path.test.yml new file mode 100644 index 0000000000..362540508b --- /dev/null +++ b/tests/endpoint/process_kill_base_on_file_path.test.yml @@ -0,0 +1,12 @@ +name: Process Kill Base On File Path Unit Test +tests: +- name: Process Kill Base On File Path + file: endpoint/process_kill_base_on_file_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/schtasks_run_task_on_demand.test.yml b/tests/endpoint/schtasks_run_task_on_demand.test.yml new file mode 100644 index 0000000000..3b9f3d1af9 --- /dev/null +++ b/tests/endpoint/schtasks_run_task_on_demand.test.yml @@ -0,0 +1,12 @@ +name: Schtasks Run Task On Demand Unit Test +tests: +- name: Schtasks Run Task On Demand + file: endpoint/schtasks_run_task_on_demand.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_driver_loaded_path.test.yml b/tests/endpoint/suspicious_driver_loaded_path.test.yml new file mode 100644 index 0000000000..2cb83a024d --- /dev/null +++ b/tests/endpoint/suspicious_driver_loaded_path.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Driver Loaded Path Unit Test +tests: +- name: Suspicious Driver Loaded Path + file: endpoint/suspicious_driver_loaded_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_process_file_path.test.yml b/tests/endpoint/suspicious_process_file_path.test.yml new file mode 100644 index 0000000000..e04a00597d --- /dev/null +++ b/tests/endpoint/suspicious_process_file_path.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Process File Path Unit Test +tests: +- name: Suspicious Process File Path + file: endpoint/suspicious_process_file_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/xmrig_driver_loaded.test.yml b/tests/endpoint/xmrig_driver_loaded.test.yml new file mode 100644 index 0000000000..e507788f9c --- /dev/null +++ b/tests/endpoint/xmrig_driver_loaded.test.yml @@ -0,0 +1,12 @@ +name: XMRIG Driver Loaded Unit Test +tests: +- name: XMRIG Driver Loaded + file: endpoint/xmrig_driver_loaded.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file