From 76f05a1af14558945c327e564752b582b80b3b7c Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 6 Sep 2021 16:49:58 +0200 Subject: [PATCH 01/11] blackmatter_ransomware --- ...d_defaultuser_and_password_in_registry.yml | 59 +++++++++++++++++++ .../auto_admin_logon_registry_entry.yml | 59 +++++++++++++++++++ .../known_services_killed_by_ransomware.yml | 8 ++- .../endpoint/modification_of_wallpaper.yml | 1 + .../ransomware_notes_bulk_creation.yml | 1 + ...aultuser_and_password_in_registry.test.yml | 12 ++++ .../auto_admin_logon_registry_entry.test.yml | 12 ++++ 7 files changed, 149 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/add_defaultuser_and_password_in_registry.yml create mode 100644 detections/endpoint/auto_admin_logon_registry_entry.yml create mode 100644 tests/endpoint/add_defaultuser_and_password_in_registry.test.yml create mode 100644 tests/endpoint/auto_admin_logon_registry_entry.test.yml diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml new file mode 100644 index 0000000000..afaeed959b --- /dev/null +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -0,0 +1,59 @@ +name: Add DefaultUser And Password In Registry +id: d4a3eb62-0f1e-11ec-a971-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. + This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. + This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR Registry.registry_key_name= DefaultUserName + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `auto_admin_logon_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Credential Access + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml new file mode 100644 index 0000000000..66b1f1f595 --- /dev/null +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -0,0 +1,59 @@ +name: Auto Admin Logon Registry Entry +id: 1379d2b8-0f18-11ec-8ca3-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. + This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. + This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND Registry.registry_value_name=1 + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `auto_admin_logon_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Credential Access + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index edca4aa62a..1330ba95d9 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -12,9 +12,10 @@ description: This search detects a suspicioous termination of known services kil the targetted files it wants to encrypts because of the open handle of those services to the targetted file. search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", - "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service - entered the stopped state*" | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. @@ -26,6 +27,7 @@ references: tags: analytic_story: - Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 7ffb78901d..abbc9ace22 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -27,6 +27,7 @@ tags: analytic_story: - Ransomware - Revil Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 2b04d700cd..db1f7434ed 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Clop Ransomware - DarkSide Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 90 context: diff --git a/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml b/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml new file mode 100644 index 0000000000..bc31abaa07 --- /dev/null +++ b/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml @@ -0,0 +1,12 @@ +name: Add DefaultUser And Password In Registry Unit Test +tests: +- name: Add DefaultUser And Password In Registry + file: endpoint/add_defaultuser_and_password_in_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/auto_admin_logon_registry_entry.test.yml b/tests/endpoint/auto_admin_logon_registry_entry.test.yml new file mode 100644 index 0000000000..35e38cb16c --- /dev/null +++ b/tests/endpoint/auto_admin_logon_registry_entry.test.yml @@ -0,0 +1,12 @@ +name: Auto Admin Logon Registry Entry Unit Test +tests: +- name: Auto Admin Logon Registry Entry + file: endpoint/auto_admin_logon_registry_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 73ec31d559d652edc6b7ac965f89c6ee691385e7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 6 Sep 2021 16:55:08 +0200 Subject: [PATCH 02/11] blackMatter_ransomware --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index afaeed959b..f141c8176f 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` - | `auto_admin_logon_registry_entry_filter`' + | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure From 7dbd2e82bc6c06a92a2f0dfc2b39e7221f69ed99 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 07:47:09 +0000 Subject: [PATCH 03/11] Added detection testing service results inAuto Admin Logon Registry Entry --- .../auto_admin_logon_registry_entry.yml | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 66b1f1f595..229e7fa1f1 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. - This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. - This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND Registry.registry_value_name=1 - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `auto_admin_logon_registry_entry_filter`' +description: this search is to detect a suspicious registry modification to implement + auto admin logon to a host. This technique was seen in BlackMatter ransomware to + automatically logon to the compromise host after triggering a safemode boot to + continue encrypting the whole network. This behavior is not a common practice and + really a suspicious TTP or alert need to be consider if found within then network + premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND + Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -38,22 +40,22 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest security_domain: endpoint impact: 70 confidence: 90 - # (impact * confidence)/100 risk_score: 63 - context: + context: - Source:Endpoint - Stage:Credential Access - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon - observable: + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ + to prepare autoadminlogon + observable: - name: dest type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 7cfee54f2df789bfdcf0778126e2eb483975bbc5 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 07:49:18 +0000 Subject: [PATCH 04/11] Added detection testing service results inAdd DefaultUser And Password In Registry --- ...d_defaultuser_and_password_in_registry.yml | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index f141c8176f..ce8e2203bf 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. - This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. - This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR Registry.registry_key_name= DefaultUserName - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `add_defaultuser_and_password_in_registry_filter`' +description: this search is to detect a suspicious registry modification to implement + auto admin logon to a host. This technique was seen in BlackMatter ransomware to + automatically logon to the compromise host after triggering a safemode boot to + continue encrypting the whole network. This behavior is not a common practice and + really a suspicious TTP or alert need to be consider if found within then network + premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR + Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -38,22 +40,22 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Credential Access - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon - observable: + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ + to prepare autoadminlogon + observable: - name: dest type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 01cd109007f812d5ec3c09f0a346aa1b6a081e79 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Sep 2021 13:24:13 +0200 Subject: [PATCH 05/11] blackMatter_ransomware --- ...dedit_command_back_to_normal_mode_boot.yml | 66 +++++++++++++++++++ ...hange_to_safe_mode_with_network_config.yml | 66 +++++++++++++++++++ stories/ransomware_blackmatter.yml | 24 +++++++ ..._command_back_to_normal_mode_boot.test.yml | 12 ++++ ..._to_safe_mode_with_network_config.test.yml | 12 ++++ 5 files changed, 180 insertions(+) create mode 100644 detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml create mode 100644 detections/endpoint/change_to_safe_mode_with_network_config.yml create mode 100644 stories/ransomware_blackmatter.yml create mode 100644 tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml create mode 100644 tests/endpoint/change_to_safe_mode_with_network_config.test.yml diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml new file mode 100644 index 0000000000..545daa939f --- /dev/null +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -0,0 +1,66 @@ +name: Bcdedit Command Back To Normal Mode Boot +id: dc7a8004-0f18-11ec-8c54-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. + This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using + bcdedit deletevalue command. + This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe + Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" by Processes.process_name + Processes.process Processes.parent_process_name Processes.dest Processes.user + |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `bcdedit_command_back_to_normal_mode_boot_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml new file mode 100644 index 0000000000..af37653729 --- /dev/null +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -0,0 +1,66 @@ +name: Change To Safe Mode With Network Config +id: 81f1dce0-0f18-11ec-a5d7-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. + This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using + bcdedit deletevalue command. + This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe + Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" Processes.process="*network*" by Processes.process_name + Processes.process Processes.parent_process_name Processes.dest Processes.user + |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `change_to_safe_mode_with_network_config_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to force safemode boot the $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/stories/ransomware_blackmatter.yml b/stories/ransomware_blackmatter.yml new file mode 100644 index 0000000000..e3c6ead217 --- /dev/null +++ b/stories/ransomware_blackmatter.yml @@ -0,0 +1,24 @@ +name: Clop Ransomware +id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the BlackMatter ransomware, including looking for file writes associated + with BlackMatter, force safe mode boot, autadminlogon account registry modification and more. +narrative: blackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of + ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for + ransome of data and threaten deletion and exposure of exfiltrated data. +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/ +- https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/ +tags: + analytic_story: blackMatter Ransomware + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml b/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml new file mode 100644 index 0000000000..4a352d2e57 --- /dev/null +++ b/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml @@ -0,0 +1,12 @@ +name: Bcdedit Command Back To Normal Mode Boot Unit Test +tests: +- name: Bcdedit Command Back To Normal Mode Boot + file: endpoint/bcdedit_command_back_to_normal_mode_boot.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/change_to_safe_mode_with_network_config.test.yml b/tests/endpoint/change_to_safe_mode_with_network_config.test.yml new file mode 100644 index 0000000000..6c6dd8e13a --- /dev/null +++ b/tests/endpoint/change_to_safe_mode_with_network_config.test.yml @@ -0,0 +1,12 @@ +name: Change To Safe Mode With Network Config Unit Test +tests: +- name: Change To Safe Mode With Network Config + file: endpoint/change_to_safe_mode_with_network_config.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From a4e04374ad198f75b6b3ea4bb3dfae57e8251b8d Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Sep 2021 13:26:59 +0200 Subject: [PATCH 06/11] blackMatter_ransomware --- stories/ransomware_blackmatter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/ransomware_blackmatter.yml b/stories/ransomware_blackmatter.yml index e3c6ead217..1263b8e239 100644 --- a/stories/ransomware_blackmatter.yml +++ b/stories/ransomware_blackmatter.yml @@ -1,4 +1,4 @@ -name: Clop Ransomware +name: blackMatter Ransomware id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee version: 1 date: '2021-09-06' From ba61023e496166ab7d054b764e32ae7068d691a0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Sep 2021 13:38:26 +0200 Subject: [PATCH 07/11] blackMatter_ransomware --- stories/ransomware_blackmatter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/ransomware_blackmatter.yml b/stories/ransomware_blackmatter.yml index 1263b8e239..8280c80e75 100644 --- a/stories/ransomware_blackmatter.yml +++ b/stories/ransomware_blackmatter.yml @@ -1,4 +1,4 @@ -name: blackMatter Ransomware +name: BlackMatter Ransomware id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee version: 1 date: '2021-09-06' From e39b2ff3b9d1f80069bf560aa4bfacf7dd9dcfd5 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 12:40:43 +0000 Subject: [PATCH 08/11] Added detection testing service results inBcdedit Command Back To Normal Mode Boot --- ...dedit_command_back_to_normal_mode_boot.yml | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 545daa939f..7373e931ba 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -6,25 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. - This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using - bcdedit deletevalue command. - This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +description: This search is to detect a suspicious bcdedit commandline to configure + the host from safe mode back to normal boot configuration. This technique was seen + in blackMatter ransomware where it force the compromised host to boot in safe mode + to continue its encryption and bring back to normal boot using bcdedit deletevalue + command. This TTP can be a good alert for host that booted from safe mode forcefully + since it need to modify the boot configuration to bring it back to normal. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe - Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" by Processes.process_name - Processes.process Processes.parent_process_name Processes.dest Processes.user - |`drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `bcdedit_command_back_to_normal_mode_boot_filter`' + Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" + by Processes.process_name Processes.process Processes.parent_process_name Processes.dest + Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -41,20 +41,20 @@ tags: required_fields: - _time - Processes.process_name - - Processes.process + - Processes.process - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user + - Processes.parent_process + - Processes.dest + - Processes.user security_domain: endpoint impact: 50 confidence: 70 - # (impact * confidence)/100 risk_score: 35 context: - - Source:Endpoint - - Stage:Impact - message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to bring back to normal boot + configuration the $dest$ observable: - name: user type: User @@ -63,4 +63,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 7c8da13fd8bf431ac986c52acce12fb1e4075a1c Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 12:43:25 +0000 Subject: [PATCH 09/11] Added detection testing service results inChange To Safe Mode With Network Config --- ...hange_to_safe_mode_with_network_config.yml | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index af37653729..2bcd13640e 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -6,25 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. - This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using - bcdedit deletevalue command. - This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +description: This search is to detect a suspicious bcdedit commandline to configure + the host to boot in safe mode with network config. This technique was seen in blackMatter + ransomware where it force the compromised host to boot in safe mode to continue + its encryption and bring back to normal boot using bcdedit deletevalue command. + This TTP can be a good alert for host that booted from safe mode forcefully since + it need to modify the boot configuration to bring it back to normal. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe - Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" Processes.process="*network*" by Processes.process_name - Processes.process Processes.parent_process_name Processes.dest Processes.user - |`drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `change_to_safe_mode_with_network_config_filter`' + Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" + Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name + Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -41,19 +41,18 @@ tags: required_fields: - _time - Processes.process_name - - Processes.process + - Processes.process - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user + - Processes.parent_process + - Processes.dest + - Processes.user security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - - Source:Endpoint - - Stage:Impact + - Source:Endpoint + - Stage:Impact message: bcdedit process with commandline $process$ to force safemode boot the $dest$ observable: - name: user @@ -63,4 +62,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From b2f96c1ff9786daa4bef3e27095b5eb2c17ce8ef Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 8 Sep 2021 10:05:16 +0200 Subject: [PATCH 10/11] blackMatter_ransomware --- ..._by_app_connect_and_create_adsi_object.yml | 61 +++++++++++++++++++ ...pp_connect_and_create_adsi_object.test.yml | 12 ++++ 2 files changed, 73 insertions(+) create mode 100644 detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml create mode 100644 tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml new file mode 100644 index 0000000000..3a84973849 --- /dev/null +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -0,0 +1,61 @@ +name: SchCache Change By App Connect And Create ADSI Object +id: 991eb510-0fc6-11ec-82d3-acde48001122 +version: 1 +date: '2021-09-07' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. + Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. + If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. + We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. + having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. +search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) + |stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `schcache_change_by_app_connect_and_create_adsi_object_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: normal application like mmc.exe and other ldap query tool may trigger this detections. +references: +- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - blackMatter ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - EventCode + - process_id + - process_name + - Computer + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Discovery + message: process $Image$ create a file $TargetFilename$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml b/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml new file mode 100644 index 0000000000..b183b4b538 --- /dev/null +++ b/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml @@ -0,0 +1,12 @@ +name: SchCache Change By App Connect And Create ADSI Object Unit Test +tests: +- name: SchCache Change By App Connect And Create ADSI Object + file: endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From c04a669b6b4cc1f4d29a5da5784fd71b7fcbcbbe Mon Sep 17 00:00:00 2001 From: root Date: Wed, 8 Sep 2021 08:29:03 +0000 Subject: [PATCH 11/11] Added detection testing service results inSchCache Change By App Connect And Create ADSI Object --- ..._by_app_connect_and_create_adsi_object.yml | 51 ++++++++++--------- 1 file changed, 28 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml index 3a84973849..195a869c7b 100644 --- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -6,24 +6,29 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. - Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. - If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. - We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. - having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. -search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) - |stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic is to detect an application try to connect and create ADSI + Object to do LDAP query. Every time an application connects to the directory and + attempts to create an ADSI object, the Active Directory Schema is checked for changes. + If it has changed since the last connection, the schema is downloaded and stored + in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache + or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious + application like blackmatter ransomware that use ADS object api to execute ldap + query. having a good list of ldap or normal AD query tool used within the network + is a good start to reduce the noise. +search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename + = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time) + as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name + Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schcache_change_by_app_connect_and_create_adsi_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: normal application like mmc.exe and other ldap query tool may trigger this detections. + Sysmon TA. +known_false_positives: normal application like mmc.exe and other ldap query tool may + trigger this detections. references: -- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - blackMatter ransomware @@ -39,23 +44,23 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - TargetFilename - - EventCode - - process_id - - process_name - - Computer + - Image + - TargetFilename + - EventCode + - process_id + - process_name + - Computer security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - - source:endpoint - - stage:Discovery + - source:endpoint + - stage:Discovery message: process $Image$ create a file $TargetFilename$ in host $Computer$ observable: - name: Computer type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed