From cea7d34435767c36fdfcb37004617ef96bbfdccd Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Mar 2023 14:38:03 -0700 Subject: [PATCH] not datamodel --- detections/endpoint/windows_process_injection_into_notepad.yml | 3 +-- detections/endpoint/windows_service_create_sliverc2.yml | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/endpoint/windows_process_injection_into_notepad.yml index e53c0c99a2..88e8c3f10e 100644 --- a/detections/endpoint/windows_process_injection_into_notepad.yml +++ b/detections/endpoint/windows_process_injection_into_notepad.yml @@ -4,8 +4,7 @@ version: 1 date: '2023-02-22' author: Michael Haag, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes Sysmon to identify process injection into Notepad.exe, based on GrantedAccess requests - 0x40 and 0x1fffff. This particular behavior is attributed to the defaults of the SliverC2 framework by BishopFox. By default, the analytic filters out any SourceImage paths of System32, Syswow64 and program files. Add more as needed, or remove and monitor what is consistently injecting into notepad.exe. This particular behavior will occur from a source image that is the initial payload dropped. diff --git a/detections/endpoint/windows_service_create_sliverc2.yml b/detections/endpoint/windows_service_create_sliverc2.yml index 14471645ee..eaf0689cea 100644 --- a/detections/endpoint/windows_service_create_sliverc2.yml +++ b/detections/endpoint/windows_service_create_sliverc2.yml @@ -4,8 +4,7 @@ version: 1 date: '2023-03-03' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: When an adversary utilizes SliverC2 to laterally move with the Psexec module, it will create a service with the name and description of "Sliver" and "Sliver Implant". Note that these may be easily changed and are specific to only SliverC2. We have also created the same regex as Microsoft has outlined to attempt to capture the suspicious service path (regex101 reference). search: '`wineventlog_system` EventCode=7045 ServiceName="sliver"