Merge branch 'potentially_malicious_code_on_commandline' of github.com:splunk/security_content into potentially_malicious_code_on_commandline

detections/endpoint/add_or_set_windows_defender_exclusion.yml

@@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic will detect a suspicious process commandline related to
-  windows defender exclusion feature. This command is abused by adversaries, malware
-  author and red teams to bypassed Windows Defender Anti-Virus product by excluding  folder
-  path, file path, process, extensions and etc. from its real time or schedule scan
-  to execute their malicious code. This is a good indicator for defense evasion and
+description: This analytic will identify a suspicious process command-line related to Windows Defender exclusion feature. 
+  This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products 
+  by excluding folder path, file path, process and extensions. 
+  From its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and
   to look further for events after this behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference
@@ -23,14 +22,16 @@ how_to_implement: To successfully implement this search you need to be ingesting
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
   that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin or user may choose to use this windows features.
+known_false_positives: Admin or user may choose to use this windows features. Filter as needed.
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos
   - Windows Defense Evasion Tactics
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/attempt_to_stop_security_service.yml

@@ -25,10 +25,12 @@ known_false_positives: None identified. Attempts to disable security-related ser
   should be identified and understood.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Disabling Security Tools
   - Trickbot
+  - WhisperGate
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_autosuid_post_exploitation_tool.yml

@@ -0,0 +1,55 @@
+name: Detect AutoSUID post exploitation tool
+id: 0edd5862-56c9-11ec-b990-acde48001122
+version: 1
+date: '2021-12-06'
+author: Rod Soto
+type: TTP
+datamodel:
+- Endpoint
+description: This search, detects Linux post exploitation tool AutoSUID, which is
+  an a tool that searches for SUID executables files in order to escalate privileges.
+search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm
+  -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory
+  process_path | `detect_autosuid_post_exploitation_tool_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
+  Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Unless an administrator is using these commands to troubleshoot
+  or audit a system, the execution of these commands should be monitored.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+- https://github.com/IvanGlinkin/AutoSUID
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  confidence: 90
+  context:
+  - Source: Endpoint
+  - Stage: Discovery
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  message: AutoSUID post exploitation tool detected
+  mitre_attack_id:
+  - T1069
+  - T1222
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - process
+  - process_path
+  - process_current_directory
+  risk_score: 81
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_linenum_execution.yml

@@ -0,0 +1,63 @@
+name: Detect LinEnum execution
+id: 570e5278-5479-11ec-89c8-acde48001122
+version: 1
+date: '2021-12-03'
+author: Rod Soto
+type: TTP
+datamodel:
+- Endpoint
+description: LinEnum is a bash script that performs discovery commands for accounts,
+  processes, kernel version, applications, services, and uses the information from
+  these commands to present operator with ways of escalating privileges or further
+  exploitation of targeted host.
+search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
+  | stats count by Computer CommandLine user process_exec process_current_directory
+  | `detect_linenum_execution_filter` '
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
+  Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Very rare to perform such an extensive grep on a system, however
+  certain monitoring tools can produce similar results. It is important if monitoring
+  tools are in place to verify what is the actual process directory of execution.
+references:
+- https://github.com/rebootuser/LinEnum
+- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  confidence: 90
+  context:
+  - Source: endpoint
+  - Stage: discovery
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
+  impact: 50
+  kill_chain_phases:
+  - Privilege Escalation
+  message: LinEnum post exploitation tool detected
+  mitre_attack_id:
+  - T1087
+  - T1069
+  - T1083
+  - T1057
+  - T1518
+  - T1082
+  - T1016
+  - T1033
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - CommandLine
+  - user
+  - process_exec
+  - process_current_directory
+  risk_score: 45
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_linpeas_execution.yml

@@ -0,0 +1,58 @@
+name: Detect LinPeas Execution
+id: 4ea6fa10-547c-11ec-a4f9-acde48001122
+version: 1
+date: '2021-12-03'
+author: Rod Soto
+type: TTP
+datamodel:
+- Endpoint
+description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges.
+search: ' `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path
+ | `detect_linpeas_execution_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: This search may produce false positives as it will display many sudo executed processess however, the cve-list within the command line it is a clear indicator, operator is searching for local vulnerabilites. 
+references:
+- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
+- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
+- https://attack.mitre.org/matrices/enterprise/linux/
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  confidence: 100
+  context:
+    - Source: endpoint
+    - Stage: discovery
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  message: LinPEAS post exploitation tool detected
+  mitre_attack_id:
+  - T1082
+  - T1083
+  - T1033
+  - T1087
+  - T1046
+  - T1057
+  - T1518
+  - T1033
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - CommandLine
+  - user
+  - parent_process_exec
+  - process_path
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/detect_linux_exploit_suggester_execution.yml

@@ -0,0 +1,57 @@
+name: Detect Linux Exploit Suggester Execution
+id: a4f34d5c-547b-11ec-ba88-acde48001122
+version: 1
+date: '2021-12-03'
+author: Rod Soto
+type: TTP
+datamodel:
+- Endpoint
+description: This search detects Linux Exploit Suggester tool execution. This is a
+  tool that searches for vulnerabilities based on Kernel and Distribution versions
+  then queries public exploit databases.
+search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR
+  CommandLine="*exploit*" OR CommandLine="*exploit-db*"  | stats count by CommandLine,user,Computer,action,signature,
+  process_name | `detect_linux_exploit_suggester_execution_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
+  Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Monitoring tools may produce similar commands although the
+  presence of "exploit-db" is very unusual.
+references:
+- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
+- https://attack.mitre.org/matrices/enterprise/linux/
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  confidence: 100
+  context:
+  - Source: endpoint
+  - Stage: discovery
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
+  impact: 90
+  message: Linux Exploit Suggester post exploitation tool detected.
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1087
+  - T1083
+  - T1069
+  - T1057
+  - T1518
+  - T1082
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - CommandLine
+  risk_score: 90
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_mimipenguin.yml

@@ -0,0 +1,54 @@
+name: Detect MimiPenguin
+id: 1ad20afa-547b-11ec-b4e7-acde48001122
+version: 1
+date: '2021-12-03'
+author: Rod Soto
+type: TTP
+datamodel:
+- Endpoint
+description: MimiPenguin is a tool that dumps login passwords from current linux destop
+  users. This search detects execution of this tool.
+search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings
+  -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow"  | stats count
+  by Computer parent_process process_current_directory user CommandLine | `detect_mimipenguin_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
+  Need to install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Some of these commands may be executed by sysadmin however
+  not in the proximity and frequency, specially if querying for tools are that knonwn
+  not to be installed at target system.
+references:
+- https://github.com/huntergregal/mimipenguin
+- https://attack.mitre.org/matrices/enterprise/linux/
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  confidence: 70
+  context:
+  - Source: endpoint
+  - Stage: discovery
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
+  impact: 50
+  kill_chain_phases:
+  - Privilege Escalation
+  message: MimiPenguin post exploitation tool detected
+  mitre_attack_id:
+  - T1552
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - Computer
+  - parent_process
+  - process_current_directory
+  risk_score: 35
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/excessive_file_deletion_in_windefender_folder.yml

@@ -0,0 +1,74 @@
+name: Excessive File Deletion In WinDefender Folder
+id: b5baa09a-7a05-11ec-8da4-acde48001122
+version: 1
+date: '2022-01-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic will identify excessive file deletion events
+  in the Windows Defender folder. This technique was seen in the WhisperGate malware campaign in which
+  adversaries abused Nirsofts advancedrun.exe to gain administrative privilege to then execute PowerShell
+  commands to delete files within the Windows Defender application folder. This behavior is a good indicator
+  the offending process is trying to corrupt a Windows Defender installation.
+search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows
+  Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime
+  max(_time) as lastTime count by user EventCode Image ProcessID Computer |where count
+  >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `excessive_file_deletion_in_windefender_folder_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, TargetFilename, and ProcessID executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: Windows Defender AV updates may cause this alert. Please update
+  the filter macros to remove false positives.
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1485
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetFilename
+  - Computer
+  - user
+  - Image
+  - ProcessID
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: High frequency file deletion activity detected on host $Computer$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: deleted_files
+    type: File Name
+    role:
+    - Target
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -21,7 +21,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a
   = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\*
   OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin*
   OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\*
-  OR Filesystem.file_path = *\\AppData\\Local\\Temp*) by Filesystem.file_create_time
+  OR Filesystem.file_path = *\\AppData\\Local\\Temp* OR Filesystem.file_path = *\\PerfLogs\\*) by Filesystem.file_create_time
   Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -31,10 +31,12 @@ known_false_positives: Administrators may allow creation of script or exe in the
   specified. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - XMRig
   - Remcos
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/high_file_deletion_frequency.yml

@@ -23,9 +23,11 @@ known_false_positives: user may delete bunch of pictures or files in a folder.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Clop Ransomware
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/ping_sleep_batch_command.yml

@@ -0,0 +1,80 @@
+name: Ping Sleep Batch Command
+id: ce058d6c-79f2-11ec-b476-acde48001122
+version: 1
+date: '2022-01-20'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic will identify the possible execution of ping sleep batch commands. This
+  technique was seen in several malware samples and is used to trigger sleep times without explicitly calling
+  sleep functions or commandlets. The goal is to delay the execution of malicious code
+  and bypass detection or sandbox analysis. This  detection can be a good indicator of a process 
+  delaying its execution for malicious purposes.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process
+  = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*>*")
+  OR (Processes.process = "*ping*" Processes.process = *-n* Processes.process="* Nul*"Processes.process="*>*")
+  by Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
+  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Administrator or network operator may execute this command.
+  Please update the filter macros to remove false positives.
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1497
+  - T1497.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: suspicious $process$ commandline run in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/powershell_remove_windows_defender_directory.yml

@@ -0,0 +1,67 @@
+name: Powershell Remove Windows Defender Directory
+id: adf47620-79fa-11ec-b248-acde48001122
+version: 1
+date: '2022-01-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic will identify a suspicious PowerShell command used to delete
+  the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where
+  it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell
+  command to delete the Windows Defender folder. This is a good indicator the offending process is 
+  trying corrupt a Windows Defender installation.
+search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows
+  Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
+  Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `powershell_remove_windows_defender_directory_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: unknown
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 100
+  confidence: 90
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: suspicious powershell script $Message$ was executed on the $ComputerName$
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/powershell_windows_defender_exclusion_commands.yml

@@ -24,10 +24,12 @@ known_false_positives: admin or user may choose to use this windows features.
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos
   - Windows Defense Evasion Tactics
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/process_deleting_its_process_file_path.yml

@@ -11,7 +11,7 @@ description: This detection is to identify a suspicious process that tries to de
   evasion once a certain condition of malware is satisfied or not. Clop ransomware
   use this technique where it will try to delete its process file path using a .bat
   command if the keyboard layout is not the layout it tries to infect.
-search: '`sysmon` EventCode=1 cmdline = "*/c del*" Image = "*\\cmd.exe" |eval result
+search: '`sysmon` EventCode=1 cmdline = "* /c *" cmdline = "* del*" Image = "*\\cmd.exe" |eval result
   = if(like(process,"%".parent_process."%"), "Found", "Not Found") | stats min(_time)
   as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine
   Image cmdline EventCode ProcessID result | where result = "Found" | `security_content_ctime(firstTime)`
@@ -25,10 +25,12 @@ known_false_positives: unknown
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Clop Ransomware
   - Remcos
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/suspicious_process_file_path.yml

@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic will detect a suspicious process running in a
   file path where a process is not commonly seen and is most commonly used by malicious
-  softtware. This behavior has been used by adversaries where they drop and run an
+  software. This behavior has been used by adversaries where they drop and run an
   exe in a path that is accessible without admin privileges.
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
@@ -18,9 +18,11 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*"
   OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path
   = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path
-  = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" by Processes.parent_process_name
-  Processes.parent_process Processes.process_path Processes.dest Processes.user |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" 
+  by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
   | `suspicious_process_file_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -29,10 +31,12 @@ known_false_positives: Administrators may allow execution of specific binaries i
   non-standard paths. Filter as needed.
 references:
 - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - XMRig
   - Remcos
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/suspicious_process_with_discord_dns_query.yml

@@ -0,0 +1,73 @@
+name: Suspicious Process With Discord DNS Query
+id: 4d4332ae-792c-11ec-89c1-acde48001122
+version: 1
+date: '2022-01-19'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic identifies a process making a DNS query to Discord, 
+  a well known instant messaging and digital distribution platform. Discord can be 
+  abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. 
+  external files. A process resolving a Discord DNS name could be an indicator
+  of malware trying to download files from Discord for further execution.
+search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*"
+  AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats
+  count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus
+  process_name QueryResults Computer process_path | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`'
+how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query.
+known_false_positives: Noise and false positive can be seen if the following instant
+  messaging is allowed to use within corporate network. In this case, a filter is
+  needed.
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.005
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - QueryName
+  - QueryStatus
+  - process_name
+  - QueryResults
+  - Computer
+  - process_path
+  security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  automated_detection_testing: passed

detections/endpoint/windows_defender_exclusion_registry_entry.yml

@@ -12,11 +12,17 @@ description: This analytic will detect a suspicious process that modify a regist
   excluding folder path, file path, process, extensions and etc. from its real time
   or schedule scan to execute their malicious code. This is a good indicator for a
   defense evasion and to look further for events after this behavior.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows
-  Defender\\Exclusions\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `windows_defender_exclusion_registry_entry_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `windows_defender_exclusion_registry_entry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -25,6 +31,7 @@ known_false_positives: admin or user may choose to use this windows features.
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos

detections/endpoint/wscript_or_cscript_suspicious_child_process.yml

@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious spawned process by wscript or
-  cscript process. This technique was a common technique used by adversaries and malware
-  to execute different LOLBIN, other script like powershell or create a suspended
+description: This analytic identifies a suspicious spawned process by WScript or
+  CScript process. This technique was a common technique used by adversaries and malware
+  to execute different LOLBIN, other scripts like PowerShell or spawn a suspended
   process to inject its code as a defense evasion. This TTP may detect some normal
   script that using several application tool that are in the list of the child process
   it detects but a good pivot and indicator that a script is may execute suspicious
@@ -24,15 +24,17 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: user may create vbs or js script that use several tool as part
-  of its execution.
+known_false_positives: Administrators may create vbs or js script that use several tool as part
+  of its execution. Filter as needed.
 references:
 - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - FIN7
   - Remcos
   - Unusual Processes
+  - WhisperGate
   automated_detection_testing: passed
   confidence: 70
   context:

macros/process_ping.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_ping

macros/sysmon_linux.yml

@@ -0,0 +1,4 @@
+definition: source=Syslog:Linux-Sysmon/Operational
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: sysmon_linux

stories/linux_post_exploitation.yml

@@ -0,0 +1,20 @@
+name: Linux Post-Exploitation
+id: d310ccfe-5477-11ec-ad05-acde48001122
+version: 1
+date: '2021-12-03'
+author: Rod Soto
+description: This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin
+narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  category:
+  - Adversary Tactics
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

stories/whispergate.yml

@@ -0,0 +1,24 @@
+name: WhisperGate
+id: 0150e6e5-3171-442e-83f8-1ccd8599569b
+version: 1
+date: '2022-01-19'
+author: Teoderick Contreras, Splunk
+description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities
+  that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic 
+  story looks for suspicious process execution, command-line activity, downloads, DNS queries and more.
+narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting 
+  multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, 
+  overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques.
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
+tags:
+  analytic_story: WhisperGate
+  category:
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml

@@ -0,0 +1,12 @@
+name: Detect AutoSUID post exploitation tool Unit Test
+tests:
+- name: Detect AutoSUID post exploitation tool
+  file: endpoint/detect_autosuid_post_exploitation_tool.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: autoSUID.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_linenum_execution.test.yml

@@ -0,0 +1,12 @@
+name: Detect LinEnum execution unit Test
+tests:
+- name: Detect LinEnum execution
+  file: endpoint/detect_linenum_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: LinuxEnumd.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_linpeas_execution.test.yml

@@ -0,0 +1,12 @@
+name: Detect LinPeas Execution Unit Test
+tests:
+- name: Detect LinPeas Execution
+  file: endpoint/detect_linpeas_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linpeasdataset.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_linux_exploit_suggester_execution.test.yml

@@ -0,0 +1,12 @@
+name: Detect Linux Exploit Suggester Execution Unit Test
+tests:
+- name: Detect Linux Exploit Suggester Execution
+  file: endpoint/detect_linux_exploit_suggester_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linuxexploitsuggesterdatasets.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_mimipenguin.test.yml

@@ -0,0 +1,12 @@
+name: Detect MimiPenguin Unit Test
+tests:
+- name: Detect MimiPenguin
+  file: endpoint/detect_mimipenguin.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: mimipenguin.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/excessive_file_deletion_in_windefender_folder.test.yml

@@ -0,0 +1,12 @@
+name: Excessive File Deletion In WinDefender Folder Unit Test
+tests:
+- name: Excessive File Deletion In WinDefender Folder
+  file: endpoint/excessive_file_deletion_in_windefender_folder.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/ping_sleep_batch_command.test.yml

@@ -0,0 +1,12 @@
+name: Ping Sleep Batch Command Unit Test
+tests:
+- name: Ping Sleep Batch Command
+  file: endpoint/ping_sleep_batch_command.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/powershell_remove_windows_defender_directory.test.yml

@@ -0,0 +1,12 @@
+name: Powershell Remove Windows Defender Directory Unit Test
+tests:
+- name: Powershell Remove Windows Defender Directory
+  file: endpoint/powershell_remove_windows_defender_directory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/suspicious_process_with_discord_dns_query.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Process With Discord DNS Query Unit Test
+tests:
+- name: Suspicious Process With Discord DNS Query
+  file: endpoint/suspicious_process_with_discord_dns_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog