From cf280e71b4bac538a90915aa0f19eec5e1af407b Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 22 Apr 2021 12:09:52 -0700 Subject: [PATCH 01/70] allow skew setting for mustang detections --- bin/jinja2_templates/savedsearches.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index 55bfce0eb6..d80c836797 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -84,6 +84,7 @@ action.email.useNSSubject = 1 alert.digest_mode = 1 {% if detection.disabled is defined %} disabled = false +allow_skew = 100% {% else %} disabled = true {% endif %} From 5879a87e2168128b57b0f0662a577a6a05795c1e Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 13:38:12 +0200 Subject: [PATCH 02/70] xmrig_ir --- detections/endpoint/deleting_of_net_users.yml | 47 ++++++++++++++++++ .../endpoint/disable_windows_app_hotkeys.yml | 47 ++++++++++++++++++ .../endpoint/disabling_net_user_account.yml | 46 ++++++++++++++++++ .../download_files_using_telegram.yml | 44 +++++++++++++++++ ...erate_users_local_group_using_telegram.yml | 45 +++++++++++++++++ .../excessive_attempt_to_disable_services.yml | 46 ++++++++++++++++++ .../excessive_service_stop_attempt.yml | 47 ++++++++++++++++++ .../endpoint/excessive_usage_of_cacls_app.yml | 46 ++++++++++++++++++ .../endpoint/excessive_usage_of_net_app.yml | 47 ++++++++++++++++++ .../endpoint/excessive_usage_of_taskkill.yml | 44 +++++++++++++++++ ..._or_script_creation_in_suspicious_path.yml | 48 +++++++++++++++++++ .../hide_user_account_from_sign_in_screen.yml | 47 ++++++++++++++++++ detections/endpoint/icacls_deny_command.yml | 44 +++++++++++++++++ detections/endpoint/icacls_grant_command.yml | 44 +++++++++++++++++ ...dify_acl_permission_to_files_or_folder.yml | 46 ++++++++++++++++++ .../process_kill_base_on_file_path.yml | 47 ++++++++++++++++++ ...ule_task_with_rundll32_command_trigger.yml | 6 +-- .../endpoint/schtasks_run_task_on_demand_.yml | 45 +++++++++++++++++ .../suspicious_driver_loaded_path.yml | 41 ++++++++++++++++ .../endpoint/suspicious_process_file_path.yml | 47 ++++++++++++++++++ detections/endpoint/xmrig_driver_loaded.yml | 42 ++++++++++++++++ stories/xmrig.yml | 29 +++++++++++ tests/endpoint/deleting_of_net_users.test.yml | 16 +++++++ .../disable_windows_app_hotkeys.test.yml | 12 +++++ .../disabling_net_user_account.test.yml | 12 +++++ .../download_files_using_telegram.test.yml | 14 ++++++ ..._users_local_group_using_telegram.test.yml | 12 +++++ ...ssive_attempt_to_disable_services.test.yml | 12 +++++ .../excessive_service_stop_attempt.test.yml | 12 +++++ .../excessive_usage_of_cacls_app.test.yml | 12 +++++ .../excessive_usage_of_net_app.test.yml | 12 +++++ .../excessive_usage_of_taskkill.test.yml | 12 +++++ ...cript_creation_in_suspicious_path.test.yml | 12 +++++ ..._user_account_from_sign_in_screen.test.yml | 12 +++++ tests/endpoint/icacls_deny_command.test.yml | 12 +++++ tests/endpoint/icacls_grant_command.test.yml | 12 +++++ ...acl_permission_to_files_or_folder.test.yml | 12 +++++ .../process_kill_base_on_file_path.test.yml | 12 +++++ .../schtasks_run_task_on_demand_.test.yml | 12 +++++ .../suspicious_driver_loaded_path.test.yml | 12 +++++ .../suspicious_process_file_path.test.yml | 12 +++++ tests/endpoint/xmrig_driver_loaded.test.yml | 12 +++++ 42 files changed, 1188 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/deleting_of_net_users.yml create mode 100644 detections/endpoint/disable_windows_app_hotkeys.yml create mode 100644 detections/endpoint/disabling_net_user_account.yml create mode 100644 detections/endpoint/download_files_using_telegram.yml create mode 100644 detections/endpoint/enumerate_users_local_group_using_telegram.yml create mode 100644 detections/endpoint/excessive_attempt_to_disable_services.yml create mode 100644 detections/endpoint/excessive_service_stop_attempt.yml create mode 100644 detections/endpoint/excessive_usage_of_cacls_app.yml create mode 100644 detections/endpoint/excessive_usage_of_net_app.yml create mode 100644 detections/endpoint/excessive_usage_of_taskkill.yml create mode 100644 detections/endpoint/executables_or_script_creation_in_suspicious_path.yml create mode 100644 detections/endpoint/hide_user_account_from_sign_in_screen.yml create mode 100644 detections/endpoint/icacls_deny_command.yml create mode 100644 detections/endpoint/icacls_grant_command.yml create mode 100644 detections/endpoint/modify_acl_permission_to_files_or_folder.yml create mode 100644 detections/endpoint/process_kill_base_on_file_path.yml create mode 100644 detections/endpoint/schtasks_run_task_on_demand_.yml create mode 100644 detections/endpoint/suspicious_driver_loaded_path.yml create mode 100644 detections/endpoint/suspicious_process_file_path.yml create mode 100644 detections/endpoint/xmrig_driver_loaded.yml create mode 100644 stories/xmrig.yml create mode 100644 tests/endpoint/deleting_of_net_users.test.yml create mode 100644 tests/endpoint/disable_windows_app_hotkeys.test.yml create mode 100644 tests/endpoint/disabling_net_user_account.test.yml create mode 100644 tests/endpoint/download_files_using_telegram.test.yml create mode 100644 tests/endpoint/enumerate_users_local_group_using_telegram.test.yml create mode 100644 tests/endpoint/excessive_attempt_to_disable_services.test.yml create mode 100644 tests/endpoint/excessive_service_stop_attempt.test.yml create mode 100644 tests/endpoint/excessive_usage_of_cacls_app.test.yml create mode 100644 tests/endpoint/excessive_usage_of_net_app.test.yml create mode 100644 tests/endpoint/excessive_usage_of_taskkill.test.yml create mode 100644 tests/endpoint/executables_or_script_creation_in_suspicious_path.test.yml create mode 100644 tests/endpoint/hide_user_account_from_sign_in_screen.test.yml create mode 100644 tests/endpoint/icacls_deny_command.test.yml create mode 100644 tests/endpoint/icacls_grant_command.test.yml create mode 100644 tests/endpoint/modify_acl_permission_to_files_or_folder.test.yml create mode 100644 tests/endpoint/process_kill_base_on_file_path.test.yml create mode 100644 tests/endpoint/schtasks_run_task_on_demand_.test.yml create mode 100644 tests/endpoint/suspicious_driver_loaded_path.test.yml create mode 100644 tests/endpoint/suspicious_process_file_path.test.yml create mode 100644 tests/endpoint/xmrig_driver_loaded.test.yml diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml new file mode 100644 index 0000000000..af0d64c4dd --- /dev/null +++ b/detections/endpoint/deleting_of_net_users.yml @@ -0,0 +1,47 @@ +name: Deleting Of Net Users +id: 1c8c6f66-acce-11eb-aafb-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious net.exe/net1.exe commandline to delete a net users in a machine. + This technique can be use by the network operator to do this task, apparently this commandline was abuse in the wild to impair some user + or deleting adversaries tracks like created user during its lateral movement to the vulnerable machines. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND Processes.process="*user*" AND Processes.process="*/delete*" + by Processes.process_name Processes.dest Processes.user Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `deleting_of_net_users_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: network operator can make use of this command +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1136.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_id + - Processes.parent_process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml new file mode 100644 index 0000000000..e02dc63814 --- /dev/null +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -0,0 +1,47 @@ +name: Disable Windows App Hotkeys +id: 1490f224-ad8b-11eb-8c4f-acde48001122 +version: 1 +date: '2021-05-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious registry mdification to disable windows hotkey (shortcut keys) for windows application. + We've seen this techniques used to disable certain or several windows application like taskmgr, cmd.exe and etc. to impaire the user + or analyst in analyzing and removing the attacker implant in the vulnerable machine. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" + AND Registry.registry_value_name = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" + by Registry.dest Registry.user Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `disable_windows_app_hotkeys_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_name + - Registry.dest Registry.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml new file mode 100644 index 0000000000..c54e9da02c --- /dev/null +++ b/detections/endpoint/disabling_net_user_account.yml @@ -0,0 +1,46 @@ +name: Disabling Net User Account +id: c0325326-acd6-11eb-98c2-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious commandline that disable a net user account. + This technique may used by the adversaries or attacker to interrupt availability of such users to do their malicious act. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND Processes.process="*user*" AND Processes.process="*/active:no*" + by Processes.process_name Processes.dest Processes.user Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disabling_net_user_account_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_id + - Processes.parent_process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml new file mode 100644 index 0000000000..522cb0341e --- /dev/null +++ b/detections/endpoint/download_files_using_telegram.yml @@ -0,0 +1,44 @@ +name: Download Files Using Telegram +id: 58194e28-ae5e-11eb-8912-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect a suspicious download by a telegram application to windows machine. + We saw this technique made some attacker in honeypot where it tries to download different scanner (port, bruteforcer, masscan) + to the vulnerable machine to mapped the whole network and compromise it also. +search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" +|stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode Image process_id TargetFilename Hash +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `download_files_using_telegram_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and TargetFilename from your endpoints or Events that monitor filestream + events which is happened when process download something. (EventCode 15) + If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: normal download of file in telegram app. (if it was a common app in network) +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1105 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - EventCode + - Image + - process_id + - TargetFilename + - Hash + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml new file mode 100644 index 0000000000..d5b85172ff --- /dev/null +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -0,0 +1,45 @@ +name: Enumerate Users Local Group Using Telegram +id: fcd74532-ae54-11eb-a5ab-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect a suspicious telegram process that enumerate all network user in a local group. + This technique was seen in monero infected honeypot to mapped all the users in the compromised machine +search: '`wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" + | stats count min(_time) as firstTime max(_time) as lastTime + by ComputerName EventCode Process_Name Process_ID Account_Name Account_Domain Logon_ID Security_ID Message + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `enumerate_users_local_group_using_telegram_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the task schedule (Exa. Security Log EventCode 4798) + endpoints. Tune and filter known instances of process like logonUI used in your environment. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ComputerName + - EventCode + - Process_Name + - Process_ID + - Account_Name + - Account_Domain + - Logon_ID + - Security_ID + - Message + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml new file mode 100644 index 0000000000..3db9fd013c --- /dev/null +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -0,0 +1,46 @@ +name: Excessive Attempt To Disable Services +id: 8fa2a0f0-acd9-11eb-8994-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect suspicious series of commandline to disable several services. + This technique is seen in some adversaries and attacker to disable security app services or other malware services to own the vulnerable machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" + by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m + | where count >=10 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_attempt_to_disable_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml new file mode 100644 index 0000000000..70488d25cc --- /dev/null +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -0,0 +1,47 @@ +name: Excessive Service Stop Attempt +id: ae8d3f4a-acd7-11eb-8846-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious series of attempt to kill multiple services in a machine using either net.exe or sc.exe. + This technique is use by adversaries to kill security services or other related services to continue there attack and evade detections. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" + AND Processes.process="*stop*" OR Processes.process="*/delete*" + by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m + | where count >=5 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_service_stop_attempt_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml new file mode 100644 index 0000000000..6d4bcef2a4 --- /dev/null +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -0,0 +1,46 @@ +name: Excessive Usage Of Cacls App +id: 0bdf6092-af17-11eb-939a-acde48001122 +version: 1 +date: '2021-05-07' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect excessive usage of cacls,xcacls or icacls application to change file or folder permission. + This behavior is commonly seen in some adversaries attacker to impair some users from deleting or accessing + its malware components or artifact from the compromised machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.process_name) as process_name + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "XCACLS.exe" + by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m + | where count >=10 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_usage_of_cacls_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: network operator may use this application. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml new file mode 100644 index 0000000000..8f36e3214a --- /dev/null +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -0,0 +1,47 @@ +name: Excessive Usage Of Net App +id: 45e52536-ae42-11eb-b5c6-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious excessive usage of net.exe/net1.exe in bucket of time frame. + This behavior was seen in a monero incident where it tries to abuse net application to create so many users, delete and disable users + as part of its malicious behavior. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" + by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m + | where count >=30 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_usage_of_net_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed net.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml new file mode 100644 index 0000000000..c1ee4e2433 --- /dev/null +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -0,0 +1,44 @@ +name: Excessive Usage Of Taskkill +id: fe5bca48-accb-11eb-a67c-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious excessive usage of taskkill.exe application. + This application is commonly used by attacker or adversaries to evade detections by killing security product process or even + other process that may cause their action notice by the analyst or users. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m + | where count >=20 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml new file mode 100644 index 0000000000..c6312d4fa9 --- /dev/null +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -0,0 +1,48 @@ +name: Executables Or Script Creation In Suspicious Path +id: a7e3f0f0-ae42-11eb-b245-acde48001122 +version: 1 +date: '2021-05-06' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious executable or scripts (known file extensions) in list of suspicious file path in windows OS. + This technique was seen in so many adversaries and attacker to hide their track from the user. The suspicious file path in detection + are known dropping point uses in the wild and folder path that are not commonly to have executable or scripts. +search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where (Filesystem.file_name = "*.exe" OR Filesystem.file_name = "*.dll" OR Filesystem.file_name = "*.sys" + OR Filesystem.file_name = "*.com" OR Filesystem.file_name = "*.vbs" OR Filesystem.file_name = "*.vbe" + OR Filesystem.file_name = "*.js" OR Filesystem.file_name = "*.ps1" OR Filesystem.file_name = "*.bat" OR Filesystem.file_name = "*.cmd" OR Filesystem.file_name = "*.pif") + AND ( Filesystem.file_path = "*\\windows\\fonts\\*" OR Filesystem.file_path = "*\\windows\\temp\\*" OR Filesystem.file_path = "*\\users\\public\\*" OR Filesystem.file_path = "*\\windows\\debug\\*" + OR Filesystem.file_path = "*\\Users\\Administrator\\Music\\*" OR Filesystem.file_path = "*\\Windows\\servicing\\*" OR Filesystem.file_path = "*\\Users\\Default\\*" OR Filesystem.file_path = "*Recycle.bin*" + OR Filesystem.file_path = "*\\Windows\\Media\\*" OR Filesystem.file_path = "\\Windows\\repair\\*" OR Filesystem.file_path = "*\\AppData\\Local\\Temp*") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `executables_or_script_creation_in_suspicious_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: network operator may allow creation of script or exec in the said file path +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1036 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml new file mode 100644 index 0000000000..b136de31ff --- /dev/null +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -0,0 +1,47 @@ +name: Hide User Account From Sign-In Screen +id: 834ba832-ad89-11eb-937d-acde48001122 +version: 1 +date: '2021-05-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious registry modification to hide a user account in signin screen. + This technique was seen in some attacker where they create hidden user account with admin privileges in login screen + To avoid noticing by the user that they already compromise and to persist on that said machine. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" + AND Registry.registry_value_name = "DWORD (0x00000000)" + by Registry.dest Registry.user Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `hide_user_account_from_sign_in_screen_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_name + - Registry.dest Registry.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml new file mode 100644 index 0000000000..7ed4409cc1 --- /dev/null +++ b/detections/endpoint/icacls_deny_command.yml @@ -0,0 +1,44 @@ +name: Icacls Deny Command +id: cf8d753e-a8fe-11eb-8f58-acde48001122 +version: 1 +date: '2021-04-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect potential attacker that change the security permission of a specific file, folder path or file system. + This technique is commonly seen in APT, coinminer script to evade detections and access to their component files. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" AND Processes.process = "*/deny*" + by Processes.parent_process_name Processes.process_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `icacls_deny_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml new file mode 100644 index 0000000000..dde3de35ab --- /dev/null +++ b/detections/endpoint/icacls_grant_command.yml @@ -0,0 +1,44 @@ +name: ICACLS Grant Command +id: b1b1e316-accc-11eb-a9b4-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect potential attacker that change the security permission of a specific file, folder path or file system. + This technique is commonly seen in APT, coinminer script to evade detections and access to their component files. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" AND Processes.process = "*/grant*" + by Processes.parent_process_name Processes.process_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `icacls_grant_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.process + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml new file mode 100644 index 0000000000..e0dcd262e9 --- /dev/null +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -0,0 +1,46 @@ +name: Modify ACL permission To Files Or Folder +id: 7e8458cc-acca-11eb-9e3f-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious modification of ACL permission to a files or folder to make it available to everyone. + This technique may use by adversarie to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner + with appropriate permission. So this is a good indicator if this command seen in machine with no permission to do so. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe" + AND (Processes.process = "*/G everyone:*" OR Processes.process = "*/G SYSTEM:*") + by Processes.parent_process_name Processes.process_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `modify_acl_permission_to_files_or_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. +known_false_positives: administrator or operator may use this command. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml new file mode 100644 index 0000000000..3c3278320c --- /dev/null +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -0,0 +1,47 @@ +name: Process Kill Base On File Path +id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 +version: 1 +date: '2021-05-04' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to look for execessive series of process kill attempt using wmic.exe. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*" AND Processes.process="*delete*" + by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m + | where count >=10 + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `process_kill_base_on_file_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed wmic.exe may be used. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.process + - Processes.process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 4a054d44b5..cc7e9fe247 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -12,11 +12,11 @@ description: The following query utilizes Windows Security EventCode 4698, `A sc technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether - it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` - and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or + it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` + and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in - memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or + memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' diff --git a/detections/endpoint/schtasks_run_task_on_demand_.yml b/detections/endpoint/schtasks_run_task_on_demand_.yml new file mode 100644 index 0000000000..89cbea53fd --- /dev/null +++ b/detections/endpoint/schtasks_run_task_on_demand_.yml @@ -0,0 +1,45 @@ +name: Schtasks Run Task On Demand +id: bb37061e-af1f-11eb-a159-acde48001122 +version: 1 +date: '2021-05-07' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a on demand run of schedule task through shell or commandline. + This technique was seen in some adversaries or attacker that force to run their created schedule task as their persistence mechanism or + for lateral movement as part of their malicious attack to the compromised machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "schtasks.exe" Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `schtasks_run_task_on_demand__filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used. +known_false_positives: network operator or user may debug schedule task entry. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_id + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml new file mode 100644 index 0000000000..ea356c81c6 --- /dev/null +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -0,0 +1,41 @@ +name: Suspicious Driver Loaded Path +id: f880acd4-a8f1-11eb-a53b-acde48001122 +version: 1 +date: '2021-04-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious driver loaded path. This technique is commonly used by malware like coin miner (xmrig) + to register its malicious driver from notable directory where executable or driver is not commonly exist. +search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) + | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_driver_loaded_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - ImageLoaded + - Hashes + - IMPHASH + - Signature + - Signed + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml new file mode 100644 index 0000000000..220c54f7ce --- /dev/null +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -0,0 +1,47 @@ +name: Suspicious Process File Path +id: 9be25988-ad82-11eb-a14f-acde48001122 +version: 1 +date: '2021-05-05' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious process running in file path where process is not commonly seen or commonly use by attacker. + This technique is seen in several attacker where they drop and run exe in folder path that accessible without admin privileges. +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" OR Processes.process_path = "*\\windows\\debug\\*" + OR Processes.process_path.file_path = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*" OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path = "*Recycle.bin*" + OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_process_file_path_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: network operator may allow the process execution in several process file path. +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1543 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_path + - Processes.dest + - Processes.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml new file mode 100644 index 0000000000..0543c1b2a2 --- /dev/null +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -0,0 +1,42 @@ +name: XMRIG Driver Loaded +id: 90080fa6-a8df-11eb-91e4-acde48001122 +version: 1 +date: '2021-04-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect XMRIG coinminer installation to the machine. + This search is to look for the driver used by xmrig coinminer to do its coin mining name as WinRing0x64.sys. + This cpu miner is an open source project that are abused by attacker to infect and mine on the infected machine. +search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" + | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `xmrig_driver_loaded_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +tags: + analytic_story: + - xmrig + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - ImageLoaded + - Hashes + - IMPHASH + - Signature + - Signed + security_domain: endpoint \ No newline at end of file diff --git a/stories/xmrig.yml b/stories/xmrig.yml new file mode 100644 index 0000000000..79b0fdbfe0 --- /dev/null +++ b/stories/xmrig.yml @@ -0,0 +1,29 @@ +name: xmrig +id: 06723e6a-6bd8-4817-ace2-5fb8a7b06628 +version: 1 +date: '2021-05-07' +author: Teoderick Contreras,Rod Soto Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the xmrig monero, including looking for file writes associated + with its payload, process commandline, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) + and hacking tools including telegram as mean of c2 to download other files. +narrative: XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. + This monero is seen in the wild on May 2017 +references: +- https://github.com/xmrig/xmrig +- https://www.getmonero.org/resources/user-guides/mine-to-pool.html +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/ +tags: + analytic_story: xmrig + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + + + diff --git a/tests/endpoint/deleting_of_net_users.test.yml b/tests/endpoint/deleting_of_net_users.test.yml new file mode 100644 index 0000000000..c06140938e --- /dev/null +++ b/tests/endpoint/deleting_of_net_users.test.yml @@ -0,0 +1,16 @@ +name: Deleting Of Net Users Unit Test +tests: +- name: Excessive Deleting Of Users + file: endpoint/deleting_of_net_users.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + + \ No newline at end of file diff --git a/tests/endpoint/disable_windows_app_hotkeys.test.yml b/tests/endpoint/disable_windows_app_hotkeys.test.yml new file mode 100644 index 0000000000..7b39001680 --- /dev/null +++ b/tests/endpoint/disable_windows_app_hotkeys.test.yml @@ -0,0 +1,12 @@ +name: Disable Windows App Hotkeys Unit Test +tests: +- name: Disable Windows App Hotkeys + file: endpoint/disable_windows_app_hotkeys.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_net_user_account.test.yml b/tests/endpoint/disabling_net_user_account.test.yml new file mode 100644 index 0000000000..0b0824737f --- /dev/null +++ b/tests/endpoint/disabling_net_user_account.test.yml @@ -0,0 +1,12 @@ +name: Disabling Net User Account Unit Test +tests: +- name: Disabling Net User Account + file: endpoint/disabling_net_user_account.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/download_files_using_telegram.test.yml b/tests/endpoint/download_files_using_telegram.test.yml new file mode 100644 index 0000000000..74b143e66e --- /dev/null +++ b/tests/endpoint/download_files_using_telegram.test.yml @@ -0,0 +1,14 @@ +name: Download Files Using Telegram Unit Test +tests: +- name: Download Files Using Telegram + file: endpoint/download_files_using_telegram.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + diff --git a/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml b/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml new file mode 100644 index 0000000000..5ecfb26519 --- /dev/null +++ b/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml @@ -0,0 +1,12 @@ +name: Enumerate Users Local Group Using Telegram Unit Test +tests: +- name: Enumerate Users Local Group Using Telegram + file: detections/endpoint/enumerate_users_local_group_using_telegram.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/excessive_attempt_to_disable_services.test.yml b/tests/endpoint/excessive_attempt_to_disable_services.test.yml new file mode 100644 index 0000000000..d88d68a4bc --- /dev/null +++ b/tests/endpoint/excessive_attempt_to_disable_services.test.yml @@ -0,0 +1,12 @@ +name: Excessive Attempt To Disable Services Unit Test +tests: +- name: Excessive Attempt To Disable Services + file: endpoint/excessive_attempt_to_disable_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_service_stop_attempt.test.yml b/tests/endpoint/excessive_service_stop_attempt.test.yml new file mode 100644 index 0000000000..e678515f18 --- /dev/null +++ b/tests/endpoint/excessive_service_stop_attempt.test.yml @@ -0,0 +1,12 @@ +name: Excessive Service Stop Attempt Unit Test +tests: +- name: Excessive Service Stop Attempt + file: endpoint/excessive_service_stop_attempt.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_cacls_app.test.yml b/tests/endpoint/excessive_usage_of_cacls_app.test.yml new file mode 100644 index 0000000000..a547af951a --- /dev/null +++ b/tests/endpoint/excessive_usage_of_cacls_app.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of Cacls App Unit Test +tests: +- name: Excessive Usage Of Cacls App + file: endpoint/excessive_usage_of_cacls_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_net_app.test.yml b/tests/endpoint/excessive_usage_of_net_app.test.yml new file mode 100644 index 0000000000..557963736e --- /dev/null +++ b/tests/endpoint/excessive_usage_of_net_app.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of Net App Unit Test +tests: +- name: Excessive Usage Of Net App + file: endpoint/excessive_usage_of_net_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/excessive_usage_of_taskkill.test.yml b/tests/endpoint/excessive_usage_of_taskkill.test.yml new file mode 100644 index 0000000000..9ac7b25183 --- /dev/null +++ b/tests/endpoint/excessive_usage_of_taskkill.test.yml @@ -0,0 +1,12 @@ +name: Excessive Usage Of Taskkill Unit Test +tests: +- name: Excessive Usage Of Taskkill + file: endpoint/excessive_usage_of_taskkill.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/executables_or_script_creation_in_suspicious_path.test.yml b/tests/endpoint/executables_or_script_creation_in_suspicious_path.test.yml new file mode 100644 index 0000000000..0183b2e7a1 --- /dev/null +++ b/tests/endpoint/executables_or_script_creation_in_suspicious_path.test.yml @@ -0,0 +1,12 @@ +name: Executables Or Script Creation In Suspicious Path Unit Test +tests: +- name: Executables Or Script Creation In Suspicious Path + file: endpoint/executables_or_script_creation_in_suspicious_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml b/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml new file mode 100644 index 0000000000..8a637aa2fd --- /dev/null +++ b/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml @@ -0,0 +1,12 @@ +name: Hide User Account From Sign-In Screen Unit Test +tests: +- name: Hide User Account From Sign-In Screen + file: endpoint/hide_user_account_from_sign_in_screen.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/icacls_deny_command.test.yml b/tests/endpoint/icacls_deny_command.test.yml new file mode 100644 index 0000000000..eec60ce008 --- /dev/null +++ b/tests/endpoint/icacls_deny_command.test.yml @@ -0,0 +1,12 @@ +name: Icacls Deny Command Unit Test +tests: +- name: Icacls Deny Command + file: endpoint/icacls_deny_command.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/icacls_grant_command.test.yml b/tests/endpoint/icacls_grant_command.test.yml new file mode 100644 index 0000000000..c2c8c66ee4 --- /dev/null +++ b/tests/endpoint/icacls_grant_command.test.yml @@ -0,0 +1,12 @@ +name: ICACLS Grant Command Unit Test +tests: +- name: ICACLS Grant Command + file: endpoint/icacls_grant_command.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/modify_acl_permission_to_files_or_folder.test.yml b/tests/endpoint/modify_acl_permission_to_files_or_folder.test.yml new file mode 100644 index 0000000000..c0ef962a35 --- /dev/null +++ b/tests/endpoint/modify_acl_permission_to_files_or_folder.test.yml @@ -0,0 +1,12 @@ +name: Modify ACL permission To Files Or Folder Unit Test +tests: +- name: Modify ACL permission To Files Or Folder + file: endpoint/modify_acl_permission_to_files_or_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/process_kill_base_on_file_path.test.yml b/tests/endpoint/process_kill_base_on_file_path.test.yml new file mode 100644 index 0000000000..362540508b --- /dev/null +++ b/tests/endpoint/process_kill_base_on_file_path.test.yml @@ -0,0 +1,12 @@ +name: Process Kill Base On File Path Unit Test +tests: +- name: Process Kill Base On File Path + file: endpoint/process_kill_base_on_file_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/schtasks_run_task_on_demand_.test.yml b/tests/endpoint/schtasks_run_task_on_demand_.test.yml new file mode 100644 index 0000000000..a7a1e950cb --- /dev/null +++ b/tests/endpoint/schtasks_run_task_on_demand_.test.yml @@ -0,0 +1,12 @@ +name: Schtasks Run Task On Demand Unit Test +tests: +- name: Schtasks Run Task On Demand + file: endpoint/schtasks_run_task_on_demand_.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_driver_loaded_path.test.yml b/tests/endpoint/suspicious_driver_loaded_path.test.yml new file mode 100644 index 0000000000..2cb83a024d --- /dev/null +++ b/tests/endpoint/suspicious_driver_loaded_path.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Driver Loaded Path Unit Test +tests: +- name: Suspicious Driver Loaded Path + file: endpoint/suspicious_driver_loaded_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_process_file_path.test.yml b/tests/endpoint/suspicious_process_file_path.test.yml new file mode 100644 index 0000000000..e04a00597d --- /dev/null +++ b/tests/endpoint/suspicious_process_file_path.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Process File Path Unit Test +tests: +- name: Suspicious Process File Path + file: endpoint/suspicious_process_file_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/xmrig_driver_loaded.test.yml b/tests/endpoint/xmrig_driver_loaded.test.yml new file mode 100644 index 0000000000..e507788f9c --- /dev/null +++ b/tests/endpoint/xmrig_driver_loaded.test.yml @@ -0,0 +1,12 @@ +name: XMRIG Driver Loaded Unit Test +tests: +- name: XMRIG Driver Loaded + file: endpoint/xmrig_driver_loaded.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From aff2b0adb54f33e89a943dde852b7cba91d3881e Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 13:51:26 +0200 Subject: [PATCH 03/70] xmrig1 --- .../enumerate_users_local_group_using_telegram.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml b/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml index 5ecfb26519..59f6e6d3e9 100644 --- a/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml +++ b/tests/endpoint/enumerate_users_local_group_using_telegram.test.yml @@ -1,7 +1,7 @@ name: Enumerate Users Local Group Using Telegram Unit Test tests: - name: Enumerate Users Local Group Using Telegram - file: detections/endpoint/enumerate_users_local_group_using_telegram.yml + file: endpoint/enumerate_users_local_group_using_telegram.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From e7a626bd16f9dd3a9ffd31e93fbebea67e44436b Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 13:56:08 +0200 Subject: [PATCH 04/70] xmrig2 --- ...un_task_on_demand_.yml => schtasks_run_task_on_demand.yml} | 4 ++-- ..._demand_.test.yml => schtasks_run_task_on_demand.test.yml} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{schtasks_run_task_on_demand_.yml => schtasks_run_task_on_demand.yml} (95%) rename tests/endpoint/{schtasks_run_task_on_demand_.test.yml => schtasks_run_task_on_demand.test.yml} (81%) diff --git a/detections/endpoint/schtasks_run_task_on_demand_.yml b/detections/endpoint/schtasks_run_task_on_demand.yml similarity index 95% rename from detections/endpoint/schtasks_run_task_on_demand_.yml rename to detections/endpoint/schtasks_run_task_on_demand.yml index 89cbea53fd..a845b7e44e 100644 --- a/detections/endpoint/schtasks_run_task_on_demand_.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -1,4 +1,4 @@ -name: Schtasks Run Task On Demand +name: Schtasks Run Task On Demand id: bb37061e-af1f-11eb-a159-acde48001122 version: 1 date: '2021-05-07' @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `schtasks_run_task_on_demand__filter`' + | `schtasks_run_task_on_demand_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/tests/endpoint/schtasks_run_task_on_demand_.test.yml b/tests/endpoint/schtasks_run_task_on_demand.test.yml similarity index 81% rename from tests/endpoint/schtasks_run_task_on_demand_.test.yml rename to tests/endpoint/schtasks_run_task_on_demand.test.yml index a7a1e950cb..3b9f3d1af9 100644 --- a/tests/endpoint/schtasks_run_task_on_demand_.test.yml +++ b/tests/endpoint/schtasks_run_task_on_demand.test.yml @@ -1,7 +1,7 @@ -name: Schtasks Run Task On Demand Unit Test +name: Schtasks Run Task On Demand Unit Test tests: - name: Schtasks Run Task On Demand - file: endpoint/schtasks_run_task_on_demand_.yml + file: endpoint/schtasks_run_task_on_demand.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From b6a1991a75fdf8478f53401742c43a61debbe14f Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 15:09:06 +0200 Subject: [PATCH 05/70] xmrig3 --- detections/endpoint/deleting_of_net_users.yml | 2 +- detections/endpoint/excessive_attempt_to_disable_services.yml | 2 +- detections/endpoint/excessive_usage_of_taskkill.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index af0d64c4dd..26e486b630 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -31,7 +31,7 @@ tags: kill_chain_phases: - Exploitation mitre_attack_id: - - T1136.001 + - T1531 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 3db9fd013c..f3721a460f 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -12,7 +12,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m - | where count >=10 + | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index c1ee4e2433..7fd92a4551 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -11,7 +11,7 @@ description: This search is to detect a suspicious excessive usage of taskkill.e other process that may cause their action notice by the analyst or users. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m - | where count >=20 + | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' From 2ad70965eb678927b05b4b60d0b2967f80f38052 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 7 May 2021 13:54:08 +0000 Subject: [PATCH 06/70] Added detection testing service results inExcessive Deleting Of Users --- detections/endpoint/deleting_of_net_users.yml | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 26e486b630..d4a9d2b41a 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious net.exe/net1.exe commandline to delete a net users in a machine. - This technique can be use by the network operator to do this task, apparently this commandline was abuse in the wild to impair some user - or deleting adversaries tracks like created user during its lateral movement to the vulnerable machines. +description: This search is to detect a suspicious net.exe/net1.exe commandline to + delete a net users in a machine. This technique can be use by the network operator + to do this task, apparently this commandline was abuse in the wild to impair some + user or deleting adversaries tracks like created user during its lateral movement + to the vulnerable machines. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND Processes.process="*user*" AND Processes.process="*/delete*" - by Processes.process_name Processes.dest Processes.user Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `deleting_of_net_users_filter`' + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND + Processes.process="*user*" AND Processes.process="*/delete*" by Processes.process_name + Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -41,7 +41,10 @@ tags: - Processes.process_name - Processes.dest - Processes.user - - Processes.parent_process_name + - Processes.parent_process_name - Processes.process_id - Processes.parent_process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 73bfbd74827c02866d4f72a7a88f1ec0cd2270db Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 16:04:59 +0200 Subject: [PATCH 07/70] xmrig4 --- detections/endpoint/excessive_usage_of_net_app.yml | 2 +- detections/endpoint/process_kill_base_on_file_path.yml | 7 ++----- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 8f36e3214a..f39c598c35 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m - | where count >=30 + | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 3c3278320c..5083206849 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -6,12 +6,11 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to look for execessive series of process kill attempt using wmic.exe. +description: This search is to look for process kill attempt using wmic.exe base on file path. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*" AND Processes.process="*delete*" - by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m - | where count >=10 + by Processes.parent_process_name Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -26,8 +25,6 @@ references: tags: analytic_story: - xmrig - dataset: - - UPDATE_DATASET_URL kill_chain_phases: - Exploitation mitre_attack_id: From 4aa746593fc873497c86a931c54c5b933474afe0 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 7 May 2021 16:34:15 +0200 Subject: [PATCH 08/70] xmrig5 --- tests/endpoint/disable_windows_app_hotkeys.test.yml | 2 +- tests/endpoint/hide_user_account_from_sign_in_screen.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/disable_windows_app_hotkeys.test.yml b/tests/endpoint/disable_windows_app_hotkeys.test.yml index 7b39001680..addc4307f6 100644 --- a/tests/endpoint/disable_windows_app_hotkeys.test.yml +++ b/tests/endpoint/disable_windows_app_hotkeys.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml b/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml index 8a637aa2fd..bb0f6358f0 100644 --- a/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml +++ b/tests/endpoint/hide_user_account_from_sign_in_screen.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 429a308f006d97f5065370ebc4ff6931d176bb5e Mon Sep 17 00:00:00 2001 From: root Date: Fri, 7 May 2021 15:00:11 +0000 Subject: [PATCH 09/70] Added detection testing service results inDisable Windows App Hotkeys --- .../endpoint/disable_windows_app_hotkeys.yml | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index e02dc63814..28217e33bb 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious registry mdification to disable windows hotkey (shortcut keys) for windows application. - We've seen this techniques used to disable certain or several windows application like taskmgr, cmd.exe and etc. to impaire the user - or analyst in analyzing and removing the attacker implant in the vulnerable machine. +description: This search is to detect a suspicious registry mdification to disable + windows hotkey (shortcut keys) for windows application. We've seen this techniques + used to disable certain or several windows application like taskmgr, cmd.exe and + etc. to impaire the user or analyst in analyzing and removing the attacker implant + in the vulnerable machine. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" - AND Registry.registry_value_name = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" - by Registry.dest Registry.user Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `disable_windows_app_hotkeys_filter`' + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows + NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name + = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest + Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -44,4 +44,7 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log From 925a516cebdc3c83030b58dc66662f192e621ede Mon Sep 17 00:00:00 2001 From: root Date: Fri, 7 May 2021 15:23:30 +0000 Subject: [PATCH 10/70] Added detection testing service results inDisabling Net User Account --- .../endpoint/disabling_net_user_account.yml | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index c54e9da02c..1d07974709 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -6,21 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious commandline that disable a net user account. - This technique may used by the adversaries or attacker to interrupt availability of such users to do their malicious act. +description: This search is to detect a suspicious commandline that disable a net + user account. This technique may used by the adversaries or attacker to interrupt + availability of such users to do their malicious act. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND Processes.process="*user*" AND Processes.process="*/active:no*" - by Processes.process_name Processes.dest Processes.user Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `disabling_net_user_account_filter`' + where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND + Processes.process="*user*" AND Processes.process="*/active:no*" by Processes.process_name + Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used. + Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be + used. known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -40,7 +40,10 @@ tags: - Processes.process_name - Processes.dest - Processes.user - - Processes.parent_process_name + - Processes.parent_process_name - Processes.process_id - Processes.parent_process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From c3480f2b23807287863436e09f60c52c2c8dc6ec Mon Sep 17 00:00:00 2001 From: root Date: Fri, 7 May 2021 15:29:24 +0000 Subject: [PATCH 11/70] Added detection testing service results inDownload Files Using Telegram --- .../download_files_using_telegram.yml | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 522cb0341e..aab4b1ced9 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a suspicious download by a telegram application to windows machine. - We saw this technique made some attacker in honeypot where it tries to download different scanner (port, bruteforcer, masscan) - to the vulnerable machine to mapped the whole network and compromise it also. +description: this search is to detect a suspicious download by a telegram application + to windows machine. We saw this technique made some attacker in honeypot where it + tries to download different scanner (port, bruteforcer, masscan) to the vulnerable + machine to mapped the whole network and compromise it also. search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" -|stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode Image process_id TargetFilename Hash -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `download_files_using_telegram_filter`' + |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode + Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `download_files_using_telegram_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and TargetFilename from your endpoints or Events that monitor filestream - events which is happened when process download something. (EventCode 15) - If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: normal download of file in telegram app. (if it was a common app in network) + logs with the process name and TargetFilename from your endpoints or Events that + monitor filestream events which is happened when process download something. (EventCode + 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon + TA. +known_false_positives: normal download of file in telegram app. (if it was a common + app in network) references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: @@ -41,4 +42,7 @@ tags: - process_id - TargetFilename - Hash - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log From f31f51731ebbf3d11d4cc6f86ad4313de4e213c5 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 07:19:08 +0000 Subject: [PATCH 12/70] Added detection testing service results inEnumerate Users Local Group Using Telegram --- ...erate_users_local_group_using_telegram.yml | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index d5b85172ff..c757b28cb2 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -6,17 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a suspicious telegram process that enumerate all network user in a local group. - This technique was seen in monero infected honeypot to mapped all the users in the compromised machine -search: '`wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" - | stats count min(_time) as firstTime max(_time) as lastTime - by ComputerName EventCode Process_Name Process_ID Account_Name Account_Domain Logon_ID Security_ID Message - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `enumerate_users_local_group_using_telegram_filter`' +description: this search is to detect a suspicious telegram process that enumerate + all network user in a local group. This technique was seen in monero infected honeypot + to mapped all the users in the compromised machine +search: '`wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" | + stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode + Process_Name Process_ID Account_Name Account_Domain Logon_ID Security_ID Message + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the task schedule (Exa. Security Log EventCode 4798) - endpoints. Tune and filter known instances of process like logonUI used in your environment. + logs with the task schedule (Exa. Security Log EventCode 4798) endpoints. Tune and + filter known instances of process like logonUI used in your environment. known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -42,4 +41,7 @@ tags: - Logon_ID - Security_ID - Message - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-security.log From d3611ef16d6da7722f07d8d18241e4ad18866000 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 07:37:38 +0000 Subject: [PATCH 13/70] Added detection testing service results inExcessive Attempt To Disable Services --- .../excessive_attempt_to_disable_services.yml | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index f3721a460f..a4b9aec923 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -6,17 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect suspicious series of commandline to disable several services. - This technique is seen in some adversaries and attacker to disable security app services or other malware services to own the vulnerable machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" - by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m - | where count >=5 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_attempt_to_disable_services_filter`' +description: this search is to detect suspicious series of commandline to disable + several services. This technique is seen in some adversaries and attacker to disable + security app services or other malware services to own the vulnerable machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = + "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name + Processes.parent_process_name Processes.dest Processes.user _time span=1m | where + count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -43,4 +42,7 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 8f89820cfbff15cbcaa90236f9f3eae38b072c02 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 07:46:47 +0000 Subject: [PATCH 14/70] Added detection testing service results inExcessive Service Stop Attempt --- .../excessive_service_stop_attempt.yml | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 70488d25cc..349826f75e 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious series of attempt to kill multiple services in a machine using either net.exe or sc.exe. - This technique is use by adversaries to kill security services or other related services to continue there attack and evade detections. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "net.exe" OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" - AND Processes.process="*stop*" OR Processes.process="*/delete*" - by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m - | where count >=5 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_service_stop_attempt_filter`' +description: This search is to detect a suspicious series of attempt to kill multiple + services in a machine using either net.exe or sc.exe. This technique is use by adversaries + to kill security services or other related services to continue there attack and + evade detections. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" + OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND + Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name + Processes.parent_process_name Processes.dest Processes.user _time span=1m | where + count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -44,4 +44,7 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From e9130822f356e2201b50c9a299722472a390dbbc Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 08:14:34 +0000 Subject: [PATCH 15/70] Added detection testing service results inExcessive Usage Of Cacls App --- .../endpoint/excessive_usage_of_cacls_app.yml | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 6d4bcef2a4..b947842ebc 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -6,18 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect excessive usage of cacls,xcacls or icacls application to change file or folder permission. - This behavior is commonly seen in some adversaries attacker to impair some users from deleting or accessing - its malware components or artifact from the compromised machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.process_name) as process_name +description: This search is to detect excessive usage of cacls,xcacls or icacls application + to change file or folder permission. This behavior is commonly seen in some adversaries + attacker to impair some users from deleting or accessing its malware components + or artifact from the compromised machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.process_name) as process_name count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "XCACLS.exe" - by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m - | where count >=10 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_usage_of_cacls_app_filter`' + where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" + OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process + Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -43,4 +42,7 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From f2291b489631bf71f7bf07570d53ac7ddc54927d Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 08:20:20 +0000 Subject: [PATCH 16/70] Added detection testing service results inExcessive Usage Of Net App --- .../endpoint/excessive_usage_of_net_app.yml | 27 ++++++++++--------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index f39c598c35..e8051a565c 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -6,18 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious excessive usage of net.exe/net1.exe in bucket of time frame. - This behavior was seen in a monero incident where it tries to abuse net application to create so many users, delete and disable users - as part of its malicious behavior. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" - by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m - | where count >=10 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `excessive_usage_of_net_app_filter`' +description: This search is to detect a suspicious excessive usage of net.exe/net1.exe + in bucket of time frame. This behavior was seen in a monero incident where it tries + to abuse net application to create so many users, delete and disable users as part + of its malicious behavior. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" + OR Processes.process_name = "net1.exe" by Processes.process_name Processes.parent_process_name + Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -44,4 +42,7 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 4af21b26242f02983b64879417aaff5446cc61e4 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 08:43:47 +0000 Subject: [PATCH 17/70] Added detection testing service results inExecutables Or Script Creation In Suspicious Path --- ..._or_script_creation_in_suspicious_path.yml | 45 ++++++++++++------- 1 file changed, 28 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index c6312d4fa9..8e09425607 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -6,25 +6,33 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious executable or scripts (known file extensions) in list of suspicious file path in windows OS. - This technique was seen in so many adversaries and attacker to hide their track from the user. The suspicious file path in detection - are known dropping point uses in the wild and folder path that are not commonly to have executable or scripts. -search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where (Filesystem.file_name = "*.exe" OR Filesystem.file_name = "*.dll" OR Filesystem.file_name = "*.sys" - OR Filesystem.file_name = "*.com" OR Filesystem.file_name = "*.vbs" OR Filesystem.file_name = "*.vbe" - OR Filesystem.file_name = "*.js" OR Filesystem.file_name = "*.ps1" OR Filesystem.file_name = "*.bat" OR Filesystem.file_name = "*.cmd" OR Filesystem.file_name = "*.pif") - AND ( Filesystem.file_path = "*\\windows\\fonts\\*" OR Filesystem.file_path = "*\\windows\\temp\\*" OR Filesystem.file_path = "*\\users\\public\\*" OR Filesystem.file_path = "*\\windows\\debug\\*" - OR Filesystem.file_path = "*\\Users\\Administrator\\Music\\*" OR Filesystem.file_path = "*\\Windows\\servicing\\*" OR Filesystem.file_path = "*\\Users\\Default\\*" OR Filesystem.file_path = "*Recycle.bin*" - OR Filesystem.file_path = "*\\Windows\\Media\\*" OR Filesystem.file_path = "\\Windows\\repair\\*" OR Filesystem.file_path = "*\\AppData\\Local\\Temp*") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `executables_or_script_creation_in_suspicious_path_filter`' +description: This search is to detect a suspicious executable or scripts (known file + extensions) in list of suspicious file path in windows OS. This technique was seen + in so many adversaries and attacker to hide their track from the user. The suspicious + file path in detection are known dropping point uses in the wild and folder path + that are not commonly to have executable or scripts. +search: "|tstats `security_content_summariesonly` values(Filesystem.file_path) as\ + \ file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem\ + \ where (Filesystem.file_name = \"*.exe\" OR Filesystem.file_name = \"*.dll\" OR\ + \ Filesystem.file_name = \"*.sys\" OR Filesystem.file_name = \"*.com\" OR Filesystem.file_name\ + \ = \"*.vbs\" OR Filesystem.file_name = \"*.vbe\" OR Filesystem.file_name = \"*.js\"\ + \ OR Filesystem.file_name = \"*.ps1\" OR Filesystem.file_name = \"*.bat\" OR Filesystem.file_name\ + \ = \"*.cmd\" OR Filesystem.file_name = \"*.pif\") AND ( Filesystem.file_path =\ + \ \"*\\\\windows\\\\fonts\\\\*\" OR Filesystem.file_path = \"*\\\\windows\\\\temp\\\ + \\*\" OR Filesystem.file_path = \"*\\\\users\\\\public\\\\*\" OR Filesystem.file_path\ + \ = \"*\\\\windows\\\\debug\\\\*\" OR Filesystem.file_path = \"*\\\\Users\\\\Administrator\\\ + \\Music\\\\*\" OR Filesystem.file_path = \"*\\\\Windows\\\\servicing\\\\*\" OR Filesystem.file_path\ + \ = \"*\\\\Users\\\\Default\\\\*\" OR Filesystem.file_path = \"*Recycle.bin*\" OR\ + \ Filesystem.file_path = \"*\\\\Windows\\\\Media\\\\*\" OR Filesystem.file_path\ + \ = \"\\\\Windows\\\\repair\\\\*\" OR Filesystem.file_path = \"*\\\\AppData\\\\\ + Local\\\\Temp*\") by \tFilesystem.file_create_time Filesystem.process_id Filesystem.file_name\ + \ Filesystem.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ + \ | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`" how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: network operator may allow creation of script or exec in the said file path +known_false_positives: network operator may allow creation of script or exec in the + said file path references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: @@ -45,4 +53,7 @@ tags: - Filesystem.process_id - Filesystem.file_name - Filesystem.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 4820d8875f8094f8a31a48ee3ea1196ee6dd155e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 08:44:13 +0000 Subject: [PATCH 18/70] Added detection testing service results inExcessive Usage Of Taskkill --- .../endpoint/excessive_usage_of_taskkill.yml | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 7fd92a4551..a61b209de0 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -6,14 +6,15 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious excessive usage of taskkill.exe application. - This application is commonly used by attacker or adversaries to evade detections by killing security product process or even - other process that may cause their action notice by the analyst or users. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m - | where count >=10 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` +description: This search is to detect a suspicious excessive usage of taskkill.exe + application. This application is commonly used by attacker or adversaries to evade + detections by killing security product process or even other process that may cause + their action notice by the analyst or users. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by + Processes.parent_process_name Processes.process_name Processes.dest Processes.user + _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -38,7 +39,10 @@ tags: - Processes.parent_process_name - Processes.process_name - Processes.dest - - Processes.user + - Processes.user - Processes.process - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From db89ba0646b6b8279de20d28648f15b82b960e16 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 09:04:36 +0000 Subject: [PATCH 19/70] Added detection testing service results inHide User Account From Sign-In Screen --- .../hide_user_account_from_sign_in_screen.yml | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index b136de31ff..d36fb41edf 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -6,17 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious registry modification to hide a user account in signin screen. - This technique was seen in some attacker where they create hidden user account with admin privileges in login screen - To avoid noticing by the user that they already compromise and to persist on that said machine. +description: This search is to detect a suspicious registry modification to hide a + user account in signin screen. This technique was seen in some attacker where they + create hidden user account with admin privileges in login screen To avoid noticing + by the user that they already compromise and to persist on that said machine. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" - AND Registry.registry_value_name = "DWORD (0x00000000)" - by Registry.dest Registry.user Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows + NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_name + = "DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_value_name + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `hide_user_account_from_sign_in_screen_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -44,4 +43,7 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log From 453b943eecdd9a53915437a9dbe16e1e672216f4 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 09:06:30 +0000 Subject: [PATCH 20/70] Added detection testing service results inIcacls Deny Command --- detections/endpoint/icacls_deny_command.yml | 25 ++++++++++++--------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 7ed4409cc1..8d7aa81ec6 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -6,15 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect potential attacker that change the security permission of a specific file, folder path or file system. - This technique is commonly seen in APT, coinminer script to evade detections and access to their component files. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" AND Processes.process = "*/deny*" - by Processes.parent_process_name Processes.process_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `icacls_deny_command_filter`' +description: This search is to detect potential attacker that change the security + permission of a specific file, folder path or file system. This technique is commonly + seen in APT, coinminer script to evade detections and access to their component + files. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" + OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" + AND Processes.process = "*/deny*" by Processes.parent_process_name Processes.process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -41,4 +43,7 @@ tags: - Processes.user - Processes.process_id - Processes.process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From d9de782e9e1640462e578541c40f94b263fb25e4 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 09:28:38 +0000 Subject: [PATCH 21/70] Added detection testing service results inICACLS Grant Command --- detections/endpoint/icacls_grant_command.yml | 25 ++++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index dde3de35ab..0562671fcf 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -6,15 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect potential attacker that change the security permission of a specific file, folder path or file system. - This technique is commonly seen in APT, coinminer script to evade detections and access to their component files. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" AND Processes.process = "*/grant*" - by Processes.parent_process_name Processes.process_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `icacls_grant_command_filter`' +description: This search is to detect potential attacker that change the security + permission of a specific file, folder path or file system. This technique is commonly + seen in APT, coinminer script to evade detections and access to their component + files. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" + OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe" + AND Processes.process = "*/grant*" by Processes.parent_process_name Processes.process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -41,4 +43,7 @@ tags: - Processes.user - Processes.process_id - Processes.process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 4dec3deb52207b015ff780e2f1edd4d72389670e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 09:31:01 +0000 Subject: [PATCH 22/70] Added detection testing service results inModify ACL permission To Files Or Folder --- ...dify_acl_permission_to_files_or_folder.yml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index e0dcd262e9..0c71d1498d 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious modification of ACL permission to a files or folder to make it available to everyone. - This technique may use by adversarie to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner - with appropriate permission. So this is a good indicator if this command seen in machine with no permission to do so. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe" +description: This search is to detect a suspicious modification of ACL permission + to a files or folder to make it available to everyone. This technique may use by + adversarie to evade ACLs or protected files access. This changes is commonly configured + by the file or directory owner with appropriate permission. So this is a good indicator + if this command seen in machine with no permission to do so. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" + OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe" AND (Processes.process = "*/G everyone:*" OR Processes.process = "*/G SYSTEM:*") by Processes.parent_process_name Processes.process_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -43,4 +45,7 @@ tags: - Processes.user - Processes.process - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 9c519fef56030e612d4b0c1736b806b4a6d8dd0c Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 10:00:32 +0000 Subject: [PATCH 23/70] Added detection testing service results inSchtasks Run Task On Demand --- .../endpoint/schtasks_run_task_on_demand.yml | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index a845b7e44e..9dcfc33ca9 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a on demand run of schedule task through shell or commandline. - This technique was seen in some adversaries or attacker that force to run their created schedule task as their persistence mechanism or - for lateral movement as part of their malicious attack to the compromised machine. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "schtasks.exe" Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `schtasks_run_task_on_demand_filter`' +description: This search is to detect a on demand run of schedule task through shell + or commandline. This technique was seen in some adversaries or attacker that force + to run their created schedule task as their persistence mechanism or for lateral + movement as part of their malicious attack to the compromised machine. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "schtasks.exe" + Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -38,8 +38,11 @@ tags: - _time - Processes.process - Processes.process_id - - Processes.process_name + - Processes.process_name - Processes.parent_process_name - Processes.dest - - Processes.user - security_domain: endpoint \ No newline at end of file + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From e10788eaee7a140761a086f82eb4c63875d4251e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 10:01:04 +0000 Subject: [PATCH 24/70] Added detection testing service results inProcess Kill Base On File Path --- .../process_kill_base_on_file_path.yml | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 5083206849..9aeb39a2e5 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -6,15 +6,15 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to look for process kill attempt using wmic.exe base on file path. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*" AND Processes.process="*delete*" - by Processes.parent_process_name Processes.process_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `process_kill_base_on_file_path_filter`' +description: This search is to look for process kill attempt using wmic.exe base on + file path. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = + "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*" + AND Processes.process="*delete*" by Processes.parent_process_name Processes.process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -39,6 +39,9 @@ tags: - Processes.process_name - Processes.dest - Processes.user - - Processes.process + - Processes.process - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 4a4dfb803143bec01f58f4c7dacf3f79a23e6f26 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 10:23:26 +0000 Subject: [PATCH 25/70] Added detection testing service results inSuspicious Driver Loaded Path --- .../suspicious_driver_loaded_path.yml | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index ea356c81c6..93f68345c1 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious driver loaded path. This technique is commonly used by malware like coin miner (xmrig) - to register its malicious driver from notable directory where executable or driver is not commonly exist. -search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) - | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect suspicious driver loaded path. This technique + is commonly used by malware like coin miner (xmrig) to register its malicious driver + from notable directory where executable or driver is not commonly exist. +search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", + "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as + firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature + Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ @@ -38,4 +39,7 @@ tags: - IMPHASH - Signature - Signed - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 00c5f5556ed743faa45af1d730e7e8bc090495d9 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 10:25:23 +0000 Subject: [PATCH 26/70] Added detection testing service results inXMRIG Driver Loaded --- detections/endpoint/xmrig_driver_loaded.yml | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 0543c1b2a2..a418634b3d 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -7,16 +7,16 @@ type: batch datamodel: - Endpoint description: This search is to detect XMRIG coinminer installation to the machine. - This search is to look for the driver used by xmrig coinminer to do its coin mining name as WinRing0x64.sys. - This cpu miner is an open source project that are abused by attacker to infect and mine on the infected machine. -search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" - | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + This search is to look for the driver used by xmrig coinminer to do its coin mining + name as WinRing0x64.sys. This cpu miner is an open source project that are abused + by attacker to infect and mine on the infected machine. +search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" + | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded + Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xmrig_driver_loaded_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ @@ -39,4 +39,7 @@ tags: - IMPHASH - Signature - Signed - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 8b67211aa1bf7804918bb9518845567197308ca4 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 10:25:28 +0000 Subject: [PATCH 27/70] Added detection testing service results inSuspicious Process File Path --- .../endpoint/suspicious_process_file_path.yml | 32 ++++++++++++------- 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 220c54f7ce..d0bf9f9cac 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -6,22 +6,27 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious process running in file path where process is not commonly seen or commonly use by attacker. - This technique is seen in several attacker where they drop and run exe in folder path that accessible without admin privileges. +description: This search is to detect a suspicious process running in file path where + process is not commonly seen or commonly use by attacker. This technique is seen + in several attacker where they drop and run exe in folder path that accessible without + admin privileges. search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" OR Processes.process_path = "*\\windows\\debug\\*" - OR Processes.process_path.file_path = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*" OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path = "*Recycle.bin*" - OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" - by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" + OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" + OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path + = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*" + OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path + = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path + = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" by Processes.parent_process_name + Processes.parent_process Processes.process_path Processes.dest Processes.user | + `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: network operator may allow the process execution in several process file path. +known_false_positives: network operator may allow the process execution in several + process file path. references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ tags: @@ -43,5 +48,8 @@ tags: - Processes.parent_process - Processes.process_path - Processes.dest - - Processes.user - security_domain: endpoint \ No newline at end of file + - Processes.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log From 8f98a1506402bbc541f97f689018a851ed499d9d Mon Sep 17 00:00:00 2001 From: tcontreras Date: Tue, 11 May 2021 15:04:40 +0200 Subject: [PATCH 28/70] minor_mod_ransomnotes --- detections/endpoint/ransomware_notes_bulk_creation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index bbe1e912ab..2c6e0e20c2 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -10,10 +10,10 @@ description: The following analytics identifies a big number of instance of rans notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. -search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") | stats +search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer Image file_name | where - unique_readme_path_count >= 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are From b18224b2bb2af478bb9b0c6c896a1979e3bba5d8 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 11 May 2021 14:13:15 +0000 Subject: [PATCH 29/70] Added detection testing service results inRansomware Notes bulk creation --- detections/endpoint/ransomware_notes_bulk_creation.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 2c6e0e20c2..fb491a0776 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -10,11 +10,11 @@ description: The following analytics identifies a big number of instance of rans notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. -search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats - min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count - values(TargetFilename) as list_of_readme_path by Computer Image file_name | where - unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `ransomware_notes_bulk_creation_filter`' +search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time + span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) + as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer + Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which From 7bb8eb506c54d2ca838926853a58bb6bc30514e5 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Wed, 12 May 2021 18:35:13 +0200 Subject: [PATCH 30/70] shadow --- .../delete_shadowcopy_with_powershell.yml | 39 +++++++++++++++++++ macros/powershell.yml | 4 ++ ...delete_shadowcopy_with_powershell.test.yml | 12 ++++++ 3 files changed, 55 insertions(+) create mode 100644 detections/endpoint/delete_shadowcopy_with_powershell.yml create mode 100644 macros/powershell.yml create mode 100644 tests/endpoint/delete_shadowcopy_with_powershell.test.yml diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml new file mode 100644 index 0000000000..25cb159580 --- /dev/null +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -0,0 +1,39 @@ +name: Delete ShadowCopy With PowerShell +id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 +version: 1 +date: '2021-05-12' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: this search is to detect powershell command to delete shadow copy using wmic powershell module. + This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded + command to delete shadow copy. This hex encoded command was able to decrypt by powershell log. +search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" + stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `delete_shadowcopy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html +tags: + analytic_story: + - Ransomware + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint \ No newline at end of file diff --git a/macros/powershell.yml b/macros/powershell.yml new file mode 100644 index 0000000000..2597ffcbd5 --- /dev/null +++ b/macros/powershell.yml @@ -0,0 +1,4 @@ +definition: sourcetype=XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: powershell diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml new file mode 100644 index 0000000000..f3041a9b29 --- /dev/null +++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Delete ShadowCopy With PowerShell Unit Test +tests: +- name: Delete ShadowCopy With PowerShell + file: detections/endpoint/delete_shadowcopy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From d98467014670460710ecc577d8e1cc8506121e42 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Wed, 12 May 2021 18:49:24 +0200 Subject: [PATCH 31/70] shadow1 --- .../delete_shadowcopy_with_powershell.test.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml index f3041a9b29..b53c03377c 100644 --- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml +++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml @@ -1,12 +1,12 @@ name: Delete ShadowCopy With PowerShell Unit Test tests: - name: Delete ShadowCopy With PowerShell - file: detections/endpoint/delete_shadowcopy_with_powershell.yml + file: endpoint/delete_shadowcopy_with_powershell.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file From c89adcba8cfc8c9579cf181d156c0fe1b4a9c87b Mon Sep 17 00:00:00 2001 From: tcontreras Date: Fri, 14 May 2021 10:06:16 +0200 Subject: [PATCH 32/70] remove_rel1 --- detections/endpoint/ransomware_notes_bulk_creation.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index fb491a0776..ace3740572 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Clop Ransomware + - DarkSide Ransomware automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log From 2bad2f8635b30c264e84899471d6c8ce85e29bba Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 17 May 2021 09:48:56 +0200 Subject: [PATCH 33/70] Delete delete_shadowcopy_with_powershell.test.yml already in merged with other PR --- .../delete_shadowcopy_with_powershell.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/delete_shadowcopy_with_powershell.test.yml diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml deleted file mode 100644 index b53c03377c..0000000000 --- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Delete ShadowCopy With PowerShell Unit Test -tests: -- name: Delete ShadowCopy With PowerShell - file: endpoint/delete_shadowcopy_with_powershell.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog \ No newline at end of file From e15810de9b614a81046d7cda79e26027c084e8a4 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 17 May 2021 09:49:40 +0200 Subject: [PATCH 34/70] Delete delete_shadowcopy_with_powershell.yml already merged in other PR --- .../delete_shadowcopy_with_powershell.yml | 39 ------------------- 1 file changed, 39 deletions(-) delete mode 100644 detections/endpoint/delete_shadowcopy_with_powershell.yml diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml deleted file mode 100644 index 25cb159580..0000000000 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: Delete ShadowCopy With PowerShell -id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 -version: 1 -date: '2021-05-12' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: this search is to detect powershell command to delete shadow copy using wmic powershell module. - This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded - command to delete shadow copy. This hex encoded command was able to decrypt by powershell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" - stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `delete_shadowcopy_with_powershell_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -known_false_positives: unknown -references: -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1490 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - Message - - ComputerName - - User - security_domain: endpoint \ No newline at end of file From e72000cca226e395dd8a144177cdccdc831e9236 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 17 May 2021 09:50:43 +0200 Subject: [PATCH 35/70] Delete ransomware_notes_bulk_creation.yml already merged in other PR --- .../ransomware_notes_bulk_creation.yml | 49 ------------------- 1 file changed, 49 deletions(-) delete mode 100644 detections/endpoint/ransomware_notes_bulk_creation.yml diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml deleted file mode 100644 index ace3740572..0000000000 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Ransomware Notes bulk creation -id: eff7919a-8330-11eb-83f8-acde48001122 -version: 1 -date: '2021-03-12' -author: Teoderick Contreras -type: batch -datamodel: -- Endpoint -description: The following analytics identifies a big number of instance of ransomware - notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This - behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your lookup table list for monitoring. -search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time - span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) - as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer - Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: unknown -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -tags: - analytic_story: - - Clop Ransomware - - DarkSide Ransomware - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log - kill_chain_phases: - - Obfuscation - mitre_attack_id: - - T1486 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - EventCode - - file_name - - _time - - TargetFilename - - Computer - - Image - - user - security_domain: endpoint From 5aeeb51d5bff18eea983a0ef18f071b3412b1a2d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 17 May 2021 09:51:28 +0200 Subject: [PATCH 36/70] Delete powershell.yml already merged --- macros/powershell.yml | 4 ---- 1 file changed, 4 deletions(-) delete mode 100644 macros/powershell.yml diff --git a/macros/powershell.yml b/macros/powershell.yml deleted file mode 100644 index 2597ffcbd5..0000000000 --- a/macros/powershell.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: sourcetype=XmlWinEventLog:Microsoft-Windows-PowerShell/Operational -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: powershell From 3d3ff91c2bddfa773367bbfe9e288c52e0c2d7ec Mon Sep 17 00:00:00 2001 From: tcontreras Date: Mon, 17 May 2021 10:00:36 +0200 Subject: [PATCH 37/70] removed --- .../delete_shadowcopy_with_powershell.yml | 39 --------------- .../ransomware_notes_bulk_creation.yml | 49 ------------------- macros/powershell.yml | 4 -- ...delete_shadowcopy_with_powershell.test.yml | 12 ----- 4 files changed, 104 deletions(-) delete mode 100644 detections/endpoint/delete_shadowcopy_with_powershell.yml delete mode 100644 detections/endpoint/ransomware_notes_bulk_creation.yml delete mode 100644 macros/powershell.yml delete mode 100644 tests/endpoint/delete_shadowcopy_with_powershell.test.yml diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml deleted file mode 100644 index 25cb159580..0000000000 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: Delete ShadowCopy With PowerShell -id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 -version: 1 -date: '2021-05-12' -author: Teoderick Contreras, Splunk -type: batch -datamodel: -- Endpoint -description: this search is to detect powershell command to delete shadow copy using wmic powershell module. - This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded - command to delete shadow copy. This hex encoded command was able to decrypt by powershell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" - stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `delete_shadowcopy_with_powershell_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -known_false_positives: unknown -references: -- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html -tags: - analytic_story: - - Ransomware - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1490 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - Message - - ComputerName - - User - security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml deleted file mode 100644 index ace3740572..0000000000 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Ransomware Notes bulk creation -id: eff7919a-8330-11eb-83f8-acde48001122 -version: 1 -date: '2021-03-12' -author: Teoderick Contreras -type: batch -datamodel: -- Endpoint -description: The following analytics identifies a big number of instance of ransomware - notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This - behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your lookup table list for monitoring. -search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time - span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) - as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer - Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' -how_to_implement: You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: unknown -references: -- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html -- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -tags: - analytic_story: - - Clop Ransomware - - DarkSide Ransomware - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log - kill_chain_phases: - - Obfuscation - mitre_attack_id: - - T1486 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - EventCode - - file_name - - _time - - TargetFilename - - Computer - - Image - - user - security_domain: endpoint diff --git a/macros/powershell.yml b/macros/powershell.yml deleted file mode 100644 index 2597ffcbd5..0000000000 --- a/macros/powershell.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: sourcetype=XmlWinEventLog:Microsoft-Windows-PowerShell/Operational -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: powershell diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml deleted file mode 100644 index b53c03377c..0000000000 --- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Delete ShadowCopy With PowerShell Unit Test -tests: -- name: Delete ShadowCopy With PowerShell - file: endpoint/delete_shadowcopy_with_powershell.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog \ No newline at end of file From 8273460c4af9a950846ed3634a038098bc26dd43 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 17 May 2021 10:55:17 +0200 Subject: [PATCH 38/70] notes --- .../ransomware_notes_bulk_creation.yml | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 detections/endpoint/ransomware_notes_bulk_creation.yml diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml new file mode 100644 index 0000000000..c92ae3921f --- /dev/null +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -0,0 +1,49 @@ +name: Ransomware Notes bulk creation +id: eff7919a-8330-11eb-83f8-acde48001122 +version: 1 +date: '2021-03-12' +author: Teoderick Contreras +type: batch +datamodel: +- Endpoint +description: The following analytics identifies a big number of instance of ransomware + notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This + behavior is a good sensor if the ransomware note filename is quite new for security + industry or the ransomware note filename is not in your ransomware notes lookup table list for monitoring. +search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time + span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) + as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer + Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' +how_to_implement: You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint file-system data model node. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html +- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +tags: + analytic_story: + - Clop Ransomware + - DarkSide Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log + kill_chain_phases: + - Obfuscation + mitre_attack_id: + - T1486 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - file_name + - _time + - TargetFilename + - Computer + - Image + - user + security_domain: endpoint From 9844a5b6567d85125cb4613bead0e4bd8858b5bd Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 17 May 2021 10:57:09 +0200 Subject: [PATCH 39/70] n --- detections/endpoint/ransomware_notes_bulk_creation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index c92ae3921f..1d309f5b77 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your ransomware notes lookup table list for monitoring. + industry or the ransomware note filename is not in your ransomware notes lookup table list to monitor. search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer From 1f68582f1fabc731880a152ffefa808f507408f2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 18 May 2021 10:40:53 +0200 Subject: [PATCH 40/70] recode --- ..._or_script_creation_in_suspicious_path.yml | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 8e09425607..83722108e2 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -11,23 +11,22 @@ description: This search is to detect a suspicious executable or scripts (known in so many adversaries and attacker to hide their track from the user. The suspicious file path in detection are known dropping point uses in the wild and folder path that are not commonly to have executable or scripts. -search: "|tstats `security_content_summariesonly` values(Filesystem.file_path) as\ - \ file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem\ - \ where (Filesystem.file_name = \"*.exe\" OR Filesystem.file_name = \"*.dll\" OR\ - \ Filesystem.file_name = \"*.sys\" OR Filesystem.file_name = \"*.com\" OR Filesystem.file_name\ - \ = \"*.vbs\" OR Filesystem.file_name = \"*.vbe\" OR Filesystem.file_name = \"*.js\"\ - \ OR Filesystem.file_name = \"*.ps1\" OR Filesystem.file_name = \"*.bat\" OR Filesystem.file_name\ - \ = \"*.cmd\" OR Filesystem.file_name = \"*.pif\") AND ( Filesystem.file_path =\ - \ \"*\\\\windows\\\\fonts\\\\*\" OR Filesystem.file_path = \"*\\\\windows\\\\temp\\\ - \\*\" OR Filesystem.file_path = \"*\\\\users\\\\public\\\\*\" OR Filesystem.file_path\ - \ = \"*\\\\windows\\\\debug\\\\*\" OR Filesystem.file_path = \"*\\\\Users\\\\Administrator\\\ - \\Music\\\\*\" OR Filesystem.file_path = \"*\\\\Windows\\\\servicing\\\\*\" OR Filesystem.file_path\ - \ = \"*\\\\Users\\\\Default\\\\*\" OR Filesystem.file_path = \"*Recycle.bin*\" OR\ - \ Filesystem.file_path = \"*\\\\Windows\\\\Media\\\\*\" OR Filesystem.file_path\ - \ = \"\\\\Windows\\\\repair\\\\*\" OR Filesystem.file_path = \"*\\\\AppData\\\\\ - Local\\\\Temp*\") by \tFilesystem.file_create_time Filesystem.process_id Filesystem.file_name\ - \ Filesystem.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`" +search: "|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where (Filesystem.file_name = "*.exe" OR Filesystem.file_name = "*.dll" + OR Filesystem.file_name = "*.sys" OR Filesystem.file_name = "*.com" OR Filesystem.file_name = "*.vbs" + OR Filesystem.file_name = "*.vbe" OR Filesystem.file_name = "*.js" + OR Filesystem.file_name = "*.ps1" OR Filesystem.file_name = "*.bat" + OR Filesystem.file_name = "*.cmd" OR Filesystem.file_name = "*.pif") + AND ( Filesystem.file_path ="*\\windows\\fonts\\*" OR Filesystem.file_path = "*\\windows\\temp\\*" OR Filesystem.file_path = "*\\users\\public\\*" + OR Filesystem.file_path = "*\\windows\\debug\\*" OR Filesystem.file_path = "*\\Users\\Administrator\\Music\\*" OR Filesystem.file_path = "*\\Windows\\servicing\\*" + OR Filesystem.file_path = "*\\Users\\Default\\*" OR Filesystem.file_path = "*Recycle.bin*" + OR Filesystem.file_path = "*\\Windows\\Media\\*" OR Filesystem.file_path = "*\\Windows\\repair\\*" + OR Filesystem.file_path = "*\\AppData\\Local\\Temp*") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `executables_or_script_creation_in_suspicious_path_filter`" how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. From 0249f2ce273f7091c9364b256bd18bcea35828f0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 18 May 2021 10:47:53 +0200 Subject: [PATCH 41/70] fix_validate --- detections/network/plain_http_post_exfiltrated_data.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 8501979d6a..eef6c5fa4e 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -4,7 +4,8 @@ version: 1 date: '2021-04-22' author: Teoderick Contreras, Splunk type: batch -datamodel: [] +datamodel: +- Network_Traffic description: This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using From b817eddb9505abf6725661a4ba378a95fe6b4ed3 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 18 May 2021 11:12:00 +0200 Subject: [PATCH 42/70] small update vlidate --- bin/validate.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bin/validate.py b/bin/validate.py index 1385fcc242..19aa011677 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -45,6 +45,7 @@ def validate_schema(REPO_PATH, type, objects, verbose): except yaml.YAMLError as exc: print(exc) print("Error reading {0}".format(manifest_file)) + errors.append("ERROR: Error reading {0}".format(manifest_file)) error = True continue @@ -258,7 +259,7 @@ def validate_tests(REPO_PATH, object): errors.append('ERROR: orphaned test: {0}, detection file: {1} no longer exists or incorrect detection path under `file`'.format(object['name'], detection_file_path)) else: errors.append('ERROR: test: {0} does not have a detection `file` associated with detection: {1}'.format(object['name'], test['name'])) - test['file'] + #test['file'] return errors def main(REPO_PATH, verbose): From 8ced8d990490faff151524605d91c673fd1a5774 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 18 May 2021 11:22:27 +0200 Subject: [PATCH 43/70] fix --- ..._or_script_creation_in_suspicious_path.yml | 23 +++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 83722108e2..eacb846421 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -12,20 +12,19 @@ description: This search is to detect a suspicious executable or scripts (known file path in detection are known dropping point uses in the wild and folder path that are not commonly to have executable or scripts. search: "|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where (Filesystem.file_name = "*.exe" OR Filesystem.file_name = "*.dll" - OR Filesystem.file_name = "*.sys" OR Filesystem.file_name = "*.com" OR Filesystem.file_name = "*.vbs" - OR Filesystem.file_name = "*.vbe" OR Filesystem.file_name = "*.js" - OR Filesystem.file_name = "*.ps1" OR Filesystem.file_name = "*.bat" - OR Filesystem.file_name = "*.cmd" OR Filesystem.file_name = "*.pif") - AND ( Filesystem.file_path ="*\\windows\\fonts\\*" OR Filesystem.file_path = "*\\windows\\temp\\*" OR Filesystem.file_path = "*\\users\\public\\*" - OR Filesystem.file_path = "*\\windows\\debug\\*" OR Filesystem.file_path = "*\\Users\\Administrator\\Music\\*" OR Filesystem.file_path = "*\\Windows\\servicing\\*" - OR Filesystem.file_path = "*\\Users\\Default\\*" OR Filesystem.file_path = "*Recycle.bin*" - OR Filesystem.file_path = "*\\Windows\\Media\\*" OR Filesystem.file_path = "*\\Windows\\repair\\*" - OR Filesystem.file_path = "*\\AppData\\Local\\Temp*") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user + where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll + OR Filesystem.file_name = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs + OR Filesystem.file_name = *.vbe OR Filesystem.file_name = *.js + OR Filesystem.file_name = *.ps1 OR Filesystem.file_name = *.bat + OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) + AND ( Filesystem.file_path = *\\windows\\fonts\\* OR Filesystem.file_path = *\\windows\\temp\\* OR Filesystem.file_path = *\\users\\public\\* + OR Filesystem.file_path = *\\windows\\debug\\* OR Filesystem.file_path = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\* + OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin* + OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\* + OR Filesystem.file_path = *\\AppData\\Local\\Temp*) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`" how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from From c2e5540577db813ec1f706332795d12606f3f217 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 18 May 2021 11:41:25 +0200 Subject: [PATCH 44/70] fix_ --- .../executables_or_script_creation_in_suspicious_path.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index eacb846421..9a77873a08 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -11,7 +11,7 @@ description: This search is to detect a suspicious executable or scripts (known in so many adversaries and attacker to hide their track from the user. The suspicious file path in detection are known dropping point uses in the wild and folder path that are not commonly to have executable or scripts. -search: "|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem +search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name = *.js @@ -25,7 +25,7 @@ search: "|tstats `security_content_summariesonly` values(Filesystem.file_path) a | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `executables_or_script_creation_in_suspicious_path_filter`" + | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. From bb5a7395f6cb0585430090c339f40f5ad2212cfe Mon Sep 17 00:00:00 2001 From: root Date: Tue, 18 May 2021 10:09:22 +0000 Subject: [PATCH 45/70] Added detection testing service results inExecutables Or Script Creation In Suspicious Path --- ..._or_script_creation_in_suspicious_path.yml | 27 +++++++++---------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 9a77873a08..fb1ff5af8e 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -11,21 +11,20 @@ description: This search is to detect a suspicious executable or scripts (known in so many adversaries and attacker to hide their track from the user. The suspicious file path in detection are known dropping point uses in the wild and folder path that are not commonly to have executable or scripts. -search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll - OR Filesystem.file_name = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs - OR Filesystem.file_name = *.vbe OR Filesystem.file_name = *.js - OR Filesystem.file_name = *.ps1 OR Filesystem.file_name = *.bat - OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) - AND ( Filesystem.file_path = *\\windows\\fonts\\* OR Filesystem.file_path = *\\windows\\temp\\* OR Filesystem.file_path = *\\users\\public\\* - OR Filesystem.file_path = *\\windows\\debug\\* OR Filesystem.file_path = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\* - OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin* +search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name + = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name + = *.vbe OR Filesystem.file_name = *.js OR Filesystem.file_name = *.ps1 OR Filesystem.file_name + = *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) AND ( Filesystem.file_path + = *\\windows\\fonts\\* OR Filesystem.file_path = *\\windows\\temp\\* OR Filesystem.file_path + = *\\users\\public\\* OR Filesystem.file_path = *\\windows\\debug\\* OR Filesystem.file_path + = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\* + OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin* OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\* - OR Filesystem.file_path = *\\AppData\\Local\\Temp*) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `executables_or_script_creation_in_suspicious_path_filter`' + OR Filesystem.file_path = *\\AppData\\Local\\Temp*) by Filesystem.file_create_time + Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. From 289a6861eb6d4d414ef69ad987b4593a7696bbcf Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:31:22 -0600 Subject: [PATCH 46/70] Update deleting_of_net_users.yml --- detections/endpoint/deleting_of_net_users.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index d4a9d2b41a..112140de14 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious net.exe/net1.exe commandline to - delete a net users in a machine. This technique can be use by the network operator - to do this task, apparently this commandline was abuse in the wild to impair some - user or deleting adversaries tracks like created user during its lateral movement - to the vulnerable machines. +description: This analytic will detect a suspicious net.exe/net1.exe command-line to + delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some + user or deleting adversaries tracks created during its lateral movement additional systems. + During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -22,7 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: network operator can make use of this command +known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From e1cb6fec1be73af0b9aa0a75369ddc4844df59da Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:42:55 -0600 Subject: [PATCH 47/70] Update disable_windows_app_hotkeys.yml --- detections/endpoint/disable_windows_app_hotkeys.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 28217e33bb..6596e0bf17 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -6,11 +6,11 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious registry mdification to disable - windows hotkey (shortcut keys) for windows application. We've seen this techniques - used to disable certain or several windows application like taskmgr, cmd.exe and - etc. to impaire the user or analyst in analyzing and removing the attacker implant - in the vulnerable machine. +description: This analytic detects a suspicious registry modification to disable + Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly + used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. + This technique is used to impair the analyst in analyzing and removing the attacker implant + in compromised systems. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows @@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. known_false_positives: unknown From 8b52654a5ce447f467a8df7ef0282ca557dda811 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:44:15 -0600 Subject: [PATCH 48/70] Update disabling_net_user_account.yml --- detections/endpoint/disabling_net_user_account.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index 1d07974709..ae527e6839 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious commandline that disable a net - user account. This technique may used by the adversaries or attacker to interrupt +description: This analytic will identify a suspicious command-line that disables a + user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) From 92f3aeb59683f3c11bf23138f23bfdc7a0856983 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:47:30 -0600 Subject: [PATCH 49/70] Update download_files_using_telegram.yml --- detections/endpoint/download_files_using_telegram.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index aab4b1ced9..763e241ecb 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a suspicious download by a telegram application - to windows machine. We saw this technique made some attacker in honeypot where it - tries to download different scanner (port, bruteforcer, masscan) to the vulnerable - machine to mapped the whole network and compromise it also. +description: The following analytic will identify a suspicious download by the Telegram application + on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with + downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 5e2516e854ecbb63d2cccfa7feec8953633e4de5 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:53:27 -0600 Subject: [PATCH 50/70] Update enumerate_users_local_group_using_telegram.yml --- .../enumerate_users_local_group_using_telegram.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index c757b28cb2..58eef291c3 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -6,19 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a suspicious telegram process that enumerate - all network user in a local group. This technique was seen in monero infected honeypot - to mapped all the users in the compromised machine +description: This analytic will detect a suspicious Telegram process enumerating + all network users in a local group. This technique was seen in a Monero infected honeypot + to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. search: '`wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Process_Name Process_ID Account_Name Account_Domain Logon_ID Security_ID Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the task schedule (Exa. Security Log EventCode 4798) endpoints. Tune and + logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment. known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 tags: analytic_story: - xmrig From fb5dc80bebe84aaeeab382aecf95ef7c52c4d0f9 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:55:09 -0600 Subject: [PATCH 51/70] Update excessive_attempt_to_disable_services.yml --- .../endpoint/excessive_attempt_to_disable_services.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index a4b9aec923..13b8e3f333 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect suspicious series of commandline to disable - several services. This technique is seen in some adversaries and attacker to disable - security app services or other malware services to own the vulnerable machine. +description: This analytic will identify suspicious series of command-line to disable + several services. This technique is seen where the adversary attempts to disable + security app services or other malware services to complete the objective on the compromised system. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = From 84b8fd673299c54bd31e206ce02c8981a511ea6b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:59:04 -0600 Subject: [PATCH 52/70] Update excessive_service_stop_attempt.yml --- detections/endpoint/excessive_service_stop_attempt.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 349826f75e..90a3b86d5a 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious series of attempt to kill multiple - services in a machine using either net.exe or sc.exe. This technique is use by adversaries - to kill security services or other related services to continue there attack and +description: This analytic identifies suspicious series of attempt to kill multiple + services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries + to terminate security services or other related services to continue there objective and evade detections. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) From cf576cc1aba6e507065cabc5a735da48b4f86c1f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 07:01:09 -0600 Subject: [PATCH 53/70] Update excessive_usage_of_cacls_app.yml --- detections/endpoint/excessive_usage_of_cacls_app.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index b947842ebc..19dd10d6db 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect excessive usage of cacls,xcacls or icacls application - to change file or folder permission. This behavior is commonly seen in some adversaries - attacker to impair some users from deleting or accessing its malware components - or artifact from the compromised machine. +description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application + to change file or folder permission. This behavior is commonly seen where the adversary + attempts to impair some users from deleting or accessing its malware components + or artifact from the compromised system. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.process_name) as process_name count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: network operator may use this application. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From 1b65498b30c39ff0206982470dc9cec49afa3747 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 07:04:54 -0600 Subject: [PATCH 54/70] Update excessive_usage_of_net_app.yml --- detections/endpoint/excessive_usage_of_net_app.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index e8051a565c..ff0cd90a4f 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious excessive usage of net.exe/net1.exe - in bucket of time frame. This behavior was seen in a monero incident where it tries - to abuse net application to create so many users, delete and disable users as part - of its malicious behavior. +description: This analytic identifies excessive usage of `net.exe` or `net1.exe` + within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts + to create many users, delete and disable users as part of its malicious behavior. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe" @@ -20,7 +19,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used. -known_false_positives: unknown +known_false_positives: unknown. Filter as needed. Modify the time span as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From 2473db53a19c967ff0127cd03aad19504bb97fd9 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 07:06:39 -0600 Subject: [PATCH 55/70] Update excessive_usage_of_taskkill.yml --- detections/endpoint/excessive_usage_of_taskkill.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index a61b209de0..8e3ad6376f 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious excessive usage of taskkill.exe - application. This application is commonly used by attacker or adversaries to evade - detections by killing security product process or even other process that may cause - their action notice by the analyst or users. +description: This analytic identifies excessive usage of `taskkill.exe` + application. This application is commonly used by adversaries to evade + detections by killing security product processes or even other processes to evade detection. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by @@ -20,7 +19,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From 14b838e094afb43f2f58ed6648a34e525ddc4438 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 07:13:11 -0600 Subject: [PATCH 56/70] Update executables_or_script_creation_in_suspicious_path.yml --- ...utables_or_script_creation_in_suspicious_path.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index fb1ff5af8e..282fb312b8 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious executable or scripts (known file - extensions) in list of suspicious file path in windows OS. This technique was seen - in so many adversaries and attacker to hide their track from the user. The suspicious - file path in detection are known dropping point uses in the wild and folder path - that are not commonly to have executable or scripts. +description: This analytic will identify suspicious executable or scripts (known file + extensions) in list of suspicious file path in Windows. This technique is used + by adversaries to evade detection. The suspicious + file path are known paths used in the wild and are not common to have executable or scripts. search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name @@ -28,8 +27,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: network operator may allow creation of script or exec in the - said file path +known_false_positives: Administrators may allow creation of script or exe in the paths specified. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From 53451f407d0b8ffcc78ba9befaa7b932548fd03b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 07:17:18 -0600 Subject: [PATCH 57/70] Update hide_user_account_from_sign_in_screen.yml --- .../endpoint/hide_user_account_from_sign_in_screen.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index d36fb41edf..dc18cc05ee 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious registry modification to hide a - user account in signin screen. This technique was seen in some attacker where they - create hidden user account with admin privileges in login screen To avoid noticing +description: This analytic identifies a suspicious registry modification to hide a + user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will + create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) @@ -20,10 +20,10 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -known_false_positives: unknown +known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From b592b27f8d952f1aa6d8671592c5c2028bca1f16 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 07:19:26 -0600 Subject: [PATCH 58/70] Update icacls_deny_command.yml --- detections/endpoint/icacls_deny_command.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 8d7aa81ec6..5ecfd56724 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect potential attacker that change the security - permission of a specific file, folder path or file system. This technique is commonly - seen in APT, coinminer script to evade detections and access to their component - files. +description: This analytic identifies a potential adversary that changes the security + permission of a specific file or directory. This technique is commonly + seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe" @@ -21,7 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: unknown +known_false_positives: Unknown. It is possible some administrative scripts use ICacls. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From 8e0c29a6a792c7e69bccdcd49978058339a331c0 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 08:08:39 -0600 Subject: [PATCH 59/70] Update icacls_grant_command.yml --- detections/endpoint/icacls_grant_command.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 0562671fcf..f5e314ea85 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect potential attacker that change the security - permission of a specific file, folder path or file system. This technique is commonly - seen in APT, coinminer script to evade detections and access to their component +description: This analytic identifies potential adversaries that modify the security + permission of a specific file or directory. This technique is commonly + seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component files. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) @@ -21,7 +21,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -known_false_positives: unknown +known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From 134db539756857a450d56c75cac298abb546a76b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 08:11:59 -0600 Subject: [PATCH 60/70] Update modify_acl_permission_to_files_or_folder.yml --- .../modify_acl_permission_to_files_or_folder.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 0c71d1498d..1bfdab9a73 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -6,11 +6,11 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious modification of ACL permission - to a files or folder to make it available to everyone. This technique may use by - adversarie to evade ACLs or protected files access. This changes is commonly configured - by the file or directory owner with appropriate permission. So this is a good indicator - if this command seen in machine with no permission to do so. +description: This analytic identifies suspicious modification of ACL permission + to a files or folder to make it available to everyone. This technique may be used by + the adversary to evade ACLs or protected files access. This changes is commonly configured + by the file or directory owner with appropriate permission. This behavior is a good indicator + if this command seen on a machine utilized by an account with no permission to do so. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" @@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. -known_false_positives: administrator or operator may use this command. +known_false_positives: administrators may use this command. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From e6df825b27b9a80e16b87a8ca65fdaeb7c904445 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 08:21:30 -0600 Subject: [PATCH 61/70] Update process_kill_base_on_file_path.yml --- detections/endpoint/process_kill_base_on_file_path.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 9aeb39a2e5..9f6e982acb 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -6,8 +6,7 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to look for process kill attempt using wmic.exe base on - file path. +description: The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = @@ -19,7 +18,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed wmic.exe may be used. -known_false_positives: unknown +known_false_positives: Unknown. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From b3d12aaf913aa7d079516e9b520dbba782b7e18d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 08:24:01 -0600 Subject: [PATCH 62/70] Update schtasks_run_task_on_demand.yml --- detections/endpoint/schtasks_run_task_on_demand.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 9dcfc33ca9..bb06adc5d9 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a on demand run of schedule task through shell - or commandline. This technique was seen in some adversaries or attacker that force - to run their created schedule task as their persistence mechanism or for lateral +description: This analytic identifies an on demand run of a Windows Schedule Task through shell + or command-line. This technique has been used by adversaries that force + to run their created Schedule Task as their persistence mechanism or for lateral movement as part of their malicious attack to the compromised machine. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) @@ -20,7 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used. -known_false_positives: network operator or user may debug schedule task entry. +known_false_positives: Administrators may use to debug Schedule Task entries. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: From 5109ed792c05e73b33b6e480d3d0fa7b12ae0dd2 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 08:29:34 -0600 Subject: [PATCH 63/70] Update suspicious_driver_loaded_path.yml --- detections/endpoint/suspicious_driver_loaded_path.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 93f68345c1..c071b8ff54 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -6,9 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious driver loaded path. This technique - is commonly used by malware like coin miner (xmrig) to register its malicious driver - from notable directory where executable or driver is not commonly exist. +description: This analytic will detect suspicious driver loaded paths. This technique + is commonly used by malicious software like coin miners (xmrig) to register its malicious driver + from notable directories where executable or drivers do not commonly exist. + During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature @@ -17,9 +18,10 @@ search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WIND how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: unknown +known_false_positives: Limited false positives will be present. Some applications do load drivers references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ tags: analytic_story: - xmrig From 66c567ef4fe39c32f2b90fc887eef2517063cc15 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 08:49:51 -0600 Subject: [PATCH 64/70] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index d0bf9f9cac..1a70013449 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious process running in file path where - process is not commonly seen or commonly use by attacker. This technique is seen - in several attacker where they drop and run exe in folder path that accessible without +description: The following analytic will detect a suspicious process running in a file path where + a process is not commonly seen and is most commonly used by malicious softtware. This behavior has been + used by adversaries where they drop and run an exe in a path that is accessible without admin privileges. search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) @@ -25,8 +25,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: network operator may allow the process execution in several - process file path. +known_false_positives: Administrators may allow execution of specific binaries in non-standard paths. Filter as needed. references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ tags: From 5f7f6fb7cdca9813cdb5b39e624dbebdfa856685 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 09:36:10 -0600 Subject: [PATCH 65/70] Update xmrig_driver_loaded.yml --- detections/endpoint/xmrig_driver_loaded.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index a418634b3d..5c08736b35 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect XMRIG coinminer installation to the machine. - This search is to look for the driver used by xmrig coinminer to do its coin mining - name as WinRing0x64.sys. This cpu miner is an open source project that are abused - by attacker to infect and mine on the infected machine. +description: This analytic identifies XMRIG coinminer driver installation on the system. + The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused + by adversaries to infect and mine bitcoin. search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -17,7 +16,7 @@ search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\ how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: unknown +known_false_positives: False positives should be limited. references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ tags: From 9ace8fb3fd619ec57070c0204dabc261450e3aa3 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 10:05:12 -0600 Subject: [PATCH 66/70] Update xmrig.yml --- stories/xmrig.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/stories/xmrig.yml b/stories/xmrig.yml index 79b0fdbfe0..2597436264 100644 --- a/stories/xmrig.yml +++ b/stories/xmrig.yml @@ -2,14 +2,14 @@ name: xmrig id: 06723e6a-6bd8-4817-ace2-5fb8a7b06628 version: 1 date: '2021-05-07' -author: Teoderick Contreras,Rod Soto Splunk +author: Teoderick Contreras, Rod Soto Splunk type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated - with its payload, process commandline, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) - and hacking tools including telegram as mean of c2 to download other files. + with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) + and hacking tools including Telegram as mean of command and control (C2) to download other files. narrative: XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. - This monero is seen in the wild on May 2017 + This monero is seen in the wild on May 2017. references: - https://github.com/xmrig/xmrig - https://www.getmonero.org/resources/user-guides/mine-to-pool.html From 7dce7ba1742309224b18627d5a09341ae6ba8818 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 19 May 2021 16:26:40 -0400 Subject: [PATCH 67/70] date of story is wrong --- stories/ransomware_darkside.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/ransomware_darkside.yml b/stories/ransomware_darkside.yml index fa49d4adf1..734c881cbc 100644 --- a/stories/ransomware_darkside.yml +++ b/stories/ransomware_darkside.yml @@ -1,7 +1,7 @@ name: DarkSide Ransomware id: 507edc74-13d5-4339-878e-b9114ded1f35 version: 1 -date: '2020-06-12' +date: '2021-05-12' author: Bhavin Patel, Splunk type: batch description: Leverage searches that allow you to detect and investigate unusual activities From 7f4d032edd5ba1ca411f0398032f4b6fc3a6d3f7 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 19 May 2021 15:21:25 -0700 Subject: [PATCH 68/70] updating story name --- detections/endpoint/deleting_of_net_users.yml | 2 +- detections/endpoint/disable_windows_app_hotkeys.yml | 2 +- detections/endpoint/disabling_net_user_account.yml | 2 +- detections/endpoint/download_files_using_telegram.yml | 2 +- .../endpoint/enumerate_users_local_group_using_telegram.yml | 2 +- detections/endpoint/excessive_attempt_to_disable_services.yml | 2 +- detections/endpoint/excessive_service_stop_attempt.yml | 2 +- detections/endpoint/excessive_usage_of_cacls_app.yml | 2 +- detections/endpoint/excessive_usage_of_net_app.yml | 2 +- detections/endpoint/excessive_usage_of_taskkill.yml | 2 +- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- detections/endpoint/hide_user_account_from_sign_in_screen.yml | 2 +- detections/endpoint/icacls_deny_command.yml | 2 +- detections/endpoint/icacls_grant_command.yml | 2 +- .../endpoint/modify_acl_permission_to_files_or_folder.yml | 2 +- detections/endpoint/process_kill_base_on_file_path.yml | 2 +- detections/endpoint/schtasks_run_task_on_demand.yml | 2 +- detections/endpoint/suspicious_driver_loaded_path.yml | 2 +- detections/endpoint/suspicious_process_file_path.yml | 2 +- detections/endpoint/xmrig_driver_loaded.yml | 2 +- stories/xmrig.yml | 4 ++-- 21 files changed, 22 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 112140de14..15892139c1 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -26,7 +26,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 6596e0bf17..395741269b 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -29,7 +29,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index ae527e6839..3434f35757 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -26,7 +26,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 763e241ecb..e8ab7b70cd 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -24,7 +24,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 58eef291c3..3dbe4255d2 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -22,7 +22,7 @@ references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798 tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 13b8e3f333..a3c431b2c0 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -25,7 +25,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 90a3b86d5a..add7e63327 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -27,7 +27,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 19dd10d6db..7771fff3fd 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -25,7 +25,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index ff0cd90a4f..423a770138 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -24,7 +24,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 8e3ad6376f..3a8ce21928 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -24,7 +24,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 282fb312b8..c1bd6234fe 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -32,7 +32,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index dc18cc05ee..901d3f701a 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -28,7 +28,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 5ecfd56724..07cbeb0041 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -25,7 +25,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index f5e314ea85..f299ff8681 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -26,7 +26,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 1bfdab9a73..d67033c20f 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -28,7 +28,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 9f6e982acb..4fe42bff39 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -23,7 +23,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index bb06adc5d9..ad085ebda0 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -25,7 +25,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index c071b8ff54..99329d91ce 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -24,7 +24,7 @@ references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 1a70013449..60a0fdf0c9 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -30,7 +30,7 @@ references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 5c08736b35..bef5b59256 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -21,7 +21,7 @@ references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ tags: analytic_story: - - xmrig + - XMRig kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/stories/xmrig.yml b/stories/xmrig.yml index 2597436264..2e6e8bb5c8 100644 --- a/stories/xmrig.yml +++ b/stories/xmrig.yml @@ -1,4 +1,4 @@ -name: xmrig +name: XMRig id: 06723e6a-6bd8-4817-ace2-5fb8a7b06628 version: 1 date: '2021-05-07' @@ -16,7 +16,7 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ - https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/ tags: - analytic_story: xmrig + analytic_story: XMRig category: - Malware product: From e0e8d2b322fa6e4b419a3c6770e7005dc3ec93a3 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 20 May 2021 10:56:00 +0200 Subject: [PATCH 69/70] xmr_str --- stories/xmrig.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/stories/xmrig.yml b/stories/xmrig.yml index 2e6e8bb5c8..2c5f1b30eb 100644 --- a/stories/xmrig.yml +++ b/stories/xmrig.yml @@ -8,6 +8,12 @@ description: Leverage searches that allow you to detect and investigate unusual that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. + Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. + One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. + Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. + (1) Servers and cloud-based + (2) systems are common targets because of the high potential for available resources, + but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining. narrative: XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. This monero is seen in the wild on May 2017. references: From a5b0e785aefd745dda8adbef508368718c29db82 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 20 May 2021 13:00:47 -0700 Subject: [PATCH 70/70] adding risk tags --- detections/cloud/aws_iam_accessdenied_discovery_events.yml | 3 +++ detections/cloud/aws_iam_assume_role_policy_brute_force.yml | 3 +++ detections/cloud/aws_iam_delete_policy.yml | 3 +++ detections/cloud/aws_iam_failure_group_deletion.yml | 3 +++ detections/cloud/aws_iam_successful_group_deletion.yml | 3 +++ 5 files changed, 15 insertions(+) diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 5ddb223ebd..ef96015f78 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -44,4 +44,7 @@ tags: - userAgent - errorCode - userIdentity.type + risk_object: src_ip + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 6b27566d71..8dbe65bb13 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -49,4 +49,7 @@ tags: - userAgent - errorCode - requestParameters.policyName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 1bdbeae373..b049e0f898 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -46,4 +46,7 @@ tags: - userAgent - errorCode - requestParameters.policyArn + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: access diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 27201dcf6c..0315b7eb6b 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -46,4 +46,7 @@ tags: - userAgent - errorCode - requestParameters.groupName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: identity diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index bd28eddce7..997d2d01d5 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -45,4 +45,7 @@ tags: - userAgent - errorCode - requestParameters.groupName + risk_object: src + risk_object_type: system + risk_score: 20 security_domain: identity