diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml new file mode 100644 index 0000000000..ce8e2203bf --- /dev/null +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -0,0 +1,61 @@ +name: Add DefaultUser And Password In Registry +id: d4a3eb62-0f1e-11ec-a971-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: this search is to detect a suspicious registry modification to implement + auto admin logon to a host. This technique was seen in BlackMatter ransomware to + automatically logon to the compromise host after triggering a safemode boot to + continue encrypting the whole network. This behavior is not a common practice and + really a suspicious TTP or alert need to be consider if found within then network + premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR + Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Credential Access + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ + to prepare autoadminlogon + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml new file mode 100644 index 0000000000..229e7fa1f1 --- /dev/null +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -0,0 +1,61 @@ +name: Auto Admin Logon Registry Entry +id: 1379d2b8-0f18-11ec-8ca3-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: this search is to detect a suspicious registry modification to implement + auto admin logon to a host. This technique was seen in BlackMatter ransomware to + automatically logon to the compromise host after triggering a safemode boot to + continue encrypting the whole network. This behavior is not a common practice and + really a suspicious TTP or alert need to be consider if found within then network + premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND + Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + security_domain: endpoint + impact: 70 + confidence: 90 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Credential Access + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ + to prepare autoadminlogon + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml new file mode 100644 index 0000000000..7373e931ba --- /dev/null +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -0,0 +1,67 @@ +name: Bcdedit Command Back To Normal Mode Boot +id: dc7a8004-0f18-11ec-8c54-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious bcdedit commandline to configure + the host from safe mode back to normal boot configuration. This technique was seen + in blackMatter ransomware where it force the compromised host to boot in safe mode + to continue its encryption and bring back to normal boot using bcdedit deletevalue + command. This TTP can be a good alert for host that booted from safe mode forcefully + since it need to modify the boot configuration to bring it back to normal. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe + Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" + by Processes.process_name Processes.process Processes.parent_process_name Processes.dest + Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 50 + confidence: 70 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to bring back to normal boot + configuration the $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml new file mode 100644 index 0000000000..2bcd13640e --- /dev/null +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -0,0 +1,66 @@ +name: Change To Safe Mode With Network Config +id: 81f1dce0-0f18-11ec-a5d7-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious bcdedit commandline to configure + the host to boot in safe mode with network config. This technique was seen in blackMatter + ransomware where it force the compromised host to boot in safe mode to continue + its encryption and bring back to normal boot using bcdedit deletevalue command. + This TTP can be a good alert for host that booted from safe mode forcefully since + it need to modify the boot configuration to bring it back to normal. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe + Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" + Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name + Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to force safemode boot the $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index edca4aa62a..1330ba95d9 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -12,9 +12,10 @@ description: This search detects a suspicioous termination of known services kil the targetted files it wants to encrypts because of the open handle of those services to the targetted file. search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", - "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service - entered the stopped state*" | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. @@ -26,6 +27,7 @@ references: tags: analytic_story: - Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 7ffb78901d..abbc9ace22 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -27,6 +27,7 @@ tags: analytic_story: - Ransomware - Revil Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 2b04d700cd..db1f7434ed 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Clop Ransomware - DarkSide Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml new file mode 100644 index 0000000000..195a869c7b --- /dev/null +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -0,0 +1,66 @@ +name: SchCache Change By App Connect And Create ADSI Object +id: 991eb510-0fc6-11ec-82d3-acde48001122 +version: 1 +date: '2021-09-07' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect an application try to connect and create ADSI + Object to do LDAP query. Every time an application connects to the directory and + attempts to create an ADSI object, the Active Directory Schema is checked for changes. + If it has changed since the last connection, the schema is downloaded and stored + in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache + or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious + application like blackmatter ransomware that use ADS object api to execute ldap + query. having a good list of ldap or normal AD query tool used within the network + is a good start to reduce the noise. +search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename + = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time) + as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name + Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `schcache_change_by_app_connect_and_create_adsi_object_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: normal application like mmc.exe and other ldap query tool may + trigger this detections. +references: +- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - blackMatter ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - EventCode + - process_id + - process_name + - Computer + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source:endpoint + - stage:Discovery + message: process $Image$ create a file $TargetFilename$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + automated_detection_testing: passed diff --git a/stories/ransomware_blackmatter.yml b/stories/ransomware_blackmatter.yml new file mode 100644 index 0000000000..8280c80e75 --- /dev/null +++ b/stories/ransomware_blackmatter.yml @@ -0,0 +1,24 @@ +name: BlackMatter Ransomware +id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the BlackMatter ransomware, including looking for file writes associated + with BlackMatter, force safe mode boot, autadminlogon account registry modification and more. +narrative: blackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of + ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for + ransome of data and threaten deletion and exposure of exfiltrated data. +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/ +- https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/ +tags: + analytic_story: blackMatter Ransomware + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml b/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml new file mode 100644 index 0000000000..bc31abaa07 --- /dev/null +++ b/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml @@ -0,0 +1,12 @@ +name: Add DefaultUser And Password In Registry Unit Test +tests: +- name: Add DefaultUser And Password In Registry + file: endpoint/add_defaultuser_and_password_in_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/auto_admin_logon_registry_entry.test.yml b/tests/endpoint/auto_admin_logon_registry_entry.test.yml new file mode 100644 index 0000000000..35e38cb16c --- /dev/null +++ b/tests/endpoint/auto_admin_logon_registry_entry.test.yml @@ -0,0 +1,12 @@ +name: Auto Admin Logon Registry Entry Unit Test +tests: +- name: Auto Admin Logon Registry Entry + file: endpoint/auto_admin_logon_registry_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml b/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml new file mode 100644 index 0000000000..4a352d2e57 --- /dev/null +++ b/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml @@ -0,0 +1,12 @@ +name: Bcdedit Command Back To Normal Mode Boot Unit Test +tests: +- name: Bcdedit Command Back To Normal Mode Boot + file: endpoint/bcdedit_command_back_to_normal_mode_boot.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/change_to_safe_mode_with_network_config.test.yml b/tests/endpoint/change_to_safe_mode_with_network_config.test.yml new file mode 100644 index 0000000000..6c6dd8e13a --- /dev/null +++ b/tests/endpoint/change_to_safe_mode_with_network_config.test.yml @@ -0,0 +1,12 @@ +name: Change To Safe Mode With Network Config Unit Test +tests: +- name: Change To Safe Mode With Network Config + file: endpoint/change_to_safe_mode_with_network_config.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml b/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml new file mode 100644 index 0000000000..b183b4b538 --- /dev/null +++ b/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml @@ -0,0 +1,12 @@ +name: SchCache Change By App Connect And Create ADSI Object Unit Test +tests: +- name: SchCache Change By App Connect And Create ADSI Object + file: endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file