From bf4c3d8a2a9399b2f78f9f326df1a5e7ecea9efa Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 30 Jun 2022 10:30:13 -0600 Subject: [PATCH 1/4] ODBC --- ...s_execute_arbitrary_commands_with_msdt.yml | 6 +- .../endpoint/windows_odbcconf_hunting.yml | 78 ++++++++++++++++++ .../endpoint/windows_odbcconf_load_dll.yml | 82 +++++++++++++++++++ .../windows_odbcconf_load_response_file.yml | 81 ++++++++++++++++++ .../windows_odbcconf_hunting.test.yml | 13 +++ .../windows_odbcconf_load_dll.test.yml | 13 +++ ...ndows_odbcconf_load_response_file.test.yml | 13 +++ 7 files changed, 283 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/windows_odbcconf_hunting.yml create mode 100644 detections/endpoint/windows_odbcconf_load_dll.yml create mode 100644 detections/endpoint/windows_odbcconf_load_response_file.yml create mode 100644 tests/endpoint/windows_odbcconf_hunting.test.yml create mode 100644 tests/endpoint/windows_odbcconf_load_dll.test.yml create mode 100644 tests/endpoint/windows_odbcconf_load_response_file.test.yml diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 6150b3a8bd..d0441635f1 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -1,7 +1,7 @@ name: Windows Execute Arbitrary Commands with MSDT id: e1d5145f-38fe-42b9-a5d5-457796715f97 -version: 2 -date: '2022-05-30' +version: 3 +date: '2022-06-29' author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,7 +10,7 @@ description: The following analytic identifies a recently disclosed arbitraty co During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe - Processes.process IN ("*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml new file mode 100644 index 0000000000..91546579b6 --- /dev/null +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -0,0 +1,78 @@ +name: Windows Odbcconf Hunting +id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 +version: 1 +date: '2022-06-30' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_odbcconf_hunting_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be present as this is meant to assist with filtering and tuning. +references: +- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html +- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 20 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log + impact: 30 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.008 + nist: + - DE.CM + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 6 + security_domain: endpoint diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml new file mode 100644 index 0000000000..9f35474acc --- /dev/null +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -0,0 +1,82 @@ +name: Windows Odbcconf Load DLL +id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b +version: 1 +date: '2022-06-28' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. + An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. + During triage, review parent process, parallel procesess and file modifications. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe + Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_odbcconf_load_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed. +references: +- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html +- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log + impact: 60 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.008 + nist: + - DE.CM + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 42 + security_domain: endpoint diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml new file mode 100644 index 0000000000..1a1b45c008 --- /dev/null +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -0,0 +1,81 @@ +name: Windows Odbcconf Load Response File +id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 +version: 1 +date: '2022-06-30' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. + During triage, review file modifications and parallel processes. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe + Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_odbcconf_load_response_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed. +references: +- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html +- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log + impact: 60 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.008 + nist: + - DE.CM + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 42 + security_domain: endpoint diff --git a/tests/endpoint/windows_odbcconf_hunting.test.yml b/tests/endpoint/windows_odbcconf_hunting.test.yml new file mode 100644 index 0000000000..1d1b6c6f48 --- /dev/null +++ b/tests/endpoint/windows_odbcconf_hunting.test.yml @@ -0,0 +1,13 @@ +name: Windows Odbcconf Hunting Unit Test +tests: +- name: Windows Odbcconf Hunting + file: endpoint/windows_odbcconf_hunting.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true diff --git a/tests/endpoint/windows_odbcconf_load_dll.test.yml b/tests/endpoint/windows_odbcconf_load_dll.test.yml new file mode 100644 index 0000000000..bfefbf034f --- /dev/null +++ b/tests/endpoint/windows_odbcconf_load_dll.test.yml @@ -0,0 +1,13 @@ +name: Windows Odbcconf Load DLL Unit Test +tests: +- name: Windows Odbcconf Load DLL + file: endpoint/windows_odbcconf_load_dll.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon-odbc-regsvr.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_odbcconf_load_response_file.test.yml b/tests/endpoint/windows_odbcconf_load_response_file.test.yml new file mode 100644 index 0000000000..88b19fcd8c --- /dev/null +++ b/tests/endpoint/windows_odbcconf_load_response_file.test.yml @@ -0,0 +1,13 @@ +name: Windows Odbcconf Load Response File Unit Test +tests: +- name: Windows Odbcconf Load Response File + file: endpoint/windows_odbcconf_load_response_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon-odbc-rsp.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 679345b15323741d3c886f00f7cf67bdf7adcc2f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 30 Jun 2022 11:41:22 -0600 Subject: [PATCH 2/4] fix fix --- detections/endpoint/windows_odbcconf_hunting.yml | 2 +- detections/endpoint/windows_odbcconf_load_dll.yml | 2 +- detections/endpoint/windows_odbcconf_load_response_file.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index 91546579b6..37601bb4ca 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -50,7 +50,7 @@ tags: role: - Victim - name: parent_process_name - type: Parent Process + type: Process Name role: - Parent Process - name: process_name diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index 9f35474acc..ae7b78d362 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -54,7 +54,7 @@ tags: role: - Victim - name: parent_process_name - type: Parent Process + type: Process Name role: - Parent Process - name: process_name diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 1a1b45c008..74d58ef9f2 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -53,7 +53,7 @@ tags: role: - Victim - name: parent_process_name - type: Parent Process + type: Process Name role: - Parent Process - name: process_name From bc08339ed44fe0e5b5c4263bfbe8021c937b07ce Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 30 Jun 2022 12:12:23 -0600 Subject: [PATCH 3/4] Update windows_odbcconf_hunting.test.yml --- tests/endpoint/windows_odbcconf_hunting.test.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/windows_odbcconf_hunting.test.yml b/tests/endpoint/windows_odbcconf_hunting.test.yml index 1d1b6c6f48..ef2ef6d1f1 100644 --- a/tests/endpoint/windows_odbcconf_hunting.test.yml +++ b/tests/endpoint/windows_odbcconf_hunting.test.yml @@ -6,8 +6,9 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: windows-sysmon-odbc-regsvr.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true + \ No newline at end of file From cab180904a083dd61e260aeff15228357e44934d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Jul 2022 11:08:43 -0700 Subject: [PATCH 4/4] Update windows_odbcconf_hunting.test.yml --- tests/endpoint/windows_odbcconf_hunting.test.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/endpoint/windows_odbcconf_hunting.test.yml b/tests/endpoint/windows_odbcconf_hunting.test.yml index ef2ef6d1f1..e71b1779cc 100644 --- a/tests/endpoint/windows_odbcconf_hunting.test.yml +++ b/tests/endpoint/windows_odbcconf_hunting.test.yml @@ -11,4 +11,3 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog update_timestamp: true - \ No newline at end of file