Branch was auto-updated.

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -0,0 +1,61 @@
+name: Add DefaultUser And Password In Registry
+id: d4a3eb62-0f1e-11ec-a971-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: this search is to detect a suspicious registry modification to implement
+  auto admin logon to a host. This technique was seen in BlackMatter ransomware to
+  automatically logon to the compromise host after  triggering a safemode boot to
+  continue encrypting the whole network. This behavior is not a common practice and
+  really a suspicious TTP or alert need to be consider if found within then network
+  premise.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
+  NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR
+  Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1552.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: modified registry key $registry_key_name$ with registry value $registry_value_name$
+    to prepare autoadminlogon
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/auto_admin_logon_registry_entry.yml

@@ -0,0 +1,61 @@
+name: Auto Admin Logon Registry Entry
+id: 1379d2b8-0f18-11ec-8ca3-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: this search is to detect a suspicious registry modification to implement
+  auto admin logon to a host. This technique was seen in BlackMatter ransomware to
+  automatically logon to the compromise host after  triggering a safemode boot to
+  continue encrypting the whole network. This behavior is not a common practice and
+  really a suspicious TTP or alert need to be consider if found within then network
+  premise.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
+  NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND
+  Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1552.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: modified registry key $registry_key_name$ with registry value $registry_value_name$
+    to prepare autoadminlogon
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml

@@ -0,0 +1,67 @@
+name: Bcdedit Command Back To Normal Mode Boot
+id: dc7a8004-0f18-11ec-8c54-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious bcdedit commandline to configure
+  the host from safe mode back to normal boot configuration. This technique was seen
+  in blackMatter ransomware where it force the compromised host to boot in safe mode
+  to continue its encryption and bring back to normal boot using bcdedit deletevalue
+  command. This TTP can be a good alert for host that booted from safe mode forcefully
+  since it need to modify the boot configuration to bring it back to normal.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
+  Processes.process="*/deletevalue*" Processes.process="*{current}*"  Processes.process="*safeboot*"
+  by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
+  Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1490
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 50
+  confidence: 70
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: bcdedit process with commandline $process$ to bring back to normal boot
+    configuration the $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/change_to_safe_mode_with_network_config.yml

@@ -0,0 +1,66 @@
+name: Change To Safe Mode With Network Config
+id: 81f1dce0-0f18-11ec-a5d7-acde48001122
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious bcdedit commandline to configure
+  the host to boot in safe mode with network config. This technique was seen in blackMatter
+  ransomware where it force the compromised host to boot in safe mode to continue
+  its encryption and bring back to normal boot using bcdedit deletevalue command.
+  This TTP can be a good alert for host that booted from safe mode forcefully since
+  it need to modify the boot configuration to bring it back to normal.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
+  Processes.process="*/set*" Processes.process="*{current}*"  Processes.process="*safeboot*"
+  Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name
+  Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - BlackMatter Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1490
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: bcdedit process with commandline $process$ to force safemode boot the $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/known_services_killed_by_ransomware.yml

@@ -12,9 +12,10 @@ description: This search detects a suspicioous termination of known services kil
   the targetted files it wants to encrypts because of the open handle of those services
   to the targetted file.
 search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*",
-  "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service
-  entered the stopped state*" | stats count min(_time) as firstTime max(_time) as
-  lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type 
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)`
   | `known_services_killed_by_ransomware_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
@@ -26,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - BlackMatter Ransomware
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/modification_of_wallpaper.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - Ransomware
   - Revil Ransomware
+  - BlackMatter Ransomware
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/ransomware_notes_bulk_creation.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Clop Ransomware
   - DarkSide Ransomware
+  - BlackMatter Ransomware
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml

@@ -0,0 +1,66 @@
+name: SchCache Change By App Connect And Create ADSI Object
+id: 991eb510-0fc6-11ec-82d3-acde48001122
+version: 1
+date: '2021-09-07'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect an application try to connect and create ADSI
+  Object to do LDAP query. Every time an application connects to the directory and
+  attempts to create an ADSI object, the Active Directory Schema is checked for changes.
+  If it has changed since the last connection, the schema is downloaded and stored
+  in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache
+  or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious
+  application like blackmatter ransomware that use ADS object api to execute ldap
+  query. having a good list of ldap or normal AD query tool used within the network
+  is a good start to reduce the noise.
+search: '`sysmon` EventCode=11  TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
+  = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time)
+  as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id  process_name
+  Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `schcache_change_by_app_connect_and_create_adsi_object_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: normal application like mmc.exe and other ldap query tool may
+  trigger this detections.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+tags:
+  analytic_story:
+  - blackMatter ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1087.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - TargetFilename
+  - EventCode
+  - process_id
+  - process_name
+  - Computer
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - source:endpoint
+  - stage:Discovery
+  message: process $Image$ create a file $TargetFilename$ in host $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

stories/ransomware_blackmatter.yml

@@ -0,0 +1,24 @@
+name: BlackMatter Ransomware
+id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee
+version: 1
+date: '2021-09-06'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the BlackMatter ransomware, including looking for file writes associated
+  with BlackMatter, force safe mode boot, autadminlogon account registry modification and more.
+narrative: blackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of
+  ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for
+  ransome of data and threaten deletion and exposure of exfiltrated data.
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
+- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/
+- https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/
+tags:
+  analytic_story: blackMatter Ransomware
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/add_defaultuser_and_password_in_registry.test.yml

@@ -0,0 +1,12 @@
+name: Add DefaultUser And Password In Registry Unit Test
+tests:
+- name: Add DefaultUser And Password In Registry
+  file: endpoint/add_defaultuser_and_password_in_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/auto_admin_logon_registry_entry.test.yml

@@ -0,0 +1,12 @@
+name: Auto Admin Logon Registry Entry Unit Test
+tests:
+- name: Auto Admin Logon Registry Entry
+  file: endpoint/auto_admin_logon_registry_entry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml

@@ -0,0 +1,12 @@
+name: Bcdedit Command Back To Normal Mode Boot Unit Test
+tests:
+- name: Bcdedit Command Back To Normal Mode Boot
+  file: endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/change_to_safe_mode_with_network_config.test.yml

@@ -0,0 +1,12 @@
+name: Change To Safe Mode With Network Config Unit Test
+tests:
+- name: Change To Safe Mode With Network Config
+  file: endpoint/change_to_safe_mode_with_network_config.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml

@@ -0,0 +1,12 @@
+name: SchCache Change By App Connect And Create ADSI Object Unit Test
+tests:
+- name: SchCache Change By App Connect And Create ADSI Object
+  file: endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog