From 8401c3ace61fb122d0141745e46460e7abd86a34 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 3 Dec 2021 13:04:41 -0800 Subject: [PATCH 01/49] nixpostnewsearches --- .../endpoint/detect_linenum_execution.yml | 50 ++++++++++++++++++ .../endpoint/detect_linpeas_execution.yml | 51 +++++++++++++++++++ ...tect_linux_exploit_suggester_execution.yml | 49 ++++++++++++++++++ detections/endpoint/detect_mimipenguin.yml | 43 ++++++++++++++++ stories/linux_post_exploitation.yml | 20 ++++++++ .../detect_linenum_execution.test.yml | 12 +++++ .../detect_linpeas_execution.test.yml | 12 +++++ ...linux_exploit_suggester_execution.test.yml | 12 +++++ tests/endpoint/detect_mimipenguin.test.yml | 12 +++++ 9 files changed, 261 insertions(+) create mode 100644 detections/endpoint/detect_linenum_execution.yml create mode 100644 detections/endpoint/detect_linpeas_execution.yml create mode 100644 detections/endpoint/detect_linux_exploit_suggester_execution.yml create mode 100644 detections/endpoint/detect_mimipenguin.yml create mode 100644 stories/linux_post_exploitation.yml create mode 100644 tests/endpoint/detect_linenum_execution.test.yml create mode 100644 tests/endpoint/detect_linpeas_execution.test.yml create mode 100644 tests/endpoint/detect_linux_exploit_suggester_execution.test.yml create mode 100644 tests/endpoint/detect_mimipenguin.test.yml diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml new file mode 100644 index 0000000000..b79fde84f3 --- /dev/null +++ b/detections/endpoint/detect_linenum_execution.yml @@ -0,0 +1,50 @@ +name: Detect LinEnum execution +id: 570e5278-5479-11ec-89c8-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype="sysmon_linux" wget CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1087 + - T1069 + - T1083 + - T1057 + - T1518 + - T1082 + - T1016 + - T1033 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml new file mode 100644 index 0000000000..4623458867 --- /dev/null +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -0,0 +1,51 @@ +name: Detect LinPeas Execution +id: 4ea6fa10-547c-11ec-a4f9-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype=sysmon_linux CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path + | `detect_linpeas_execution_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1082 + - T1083 + - T1033 + - T1087 + - T1046 + - T1057 + - T1518 + - T1033 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml new file mode 100644 index 0000000000..d6e9f9fca3 --- /dev/null +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -0,0 +1,49 @@ +name: Detect Linux Exploit Suggester Execution +id: a4f34d5c-547b-11ec-ba88-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype="sysmon_linux" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name + | `detect_linux_exploit_suggester_execution_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1087 + - T1083 + - T1069 + - T1057 + - T1518 + - T1082 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml new file mode 100644 index 0000000000..73f2c64552 --- /dev/null +++ b/detections/endpoint/detect_mimipenguin.yml @@ -0,0 +1,43 @@ +name: Detect MimiPenguin +id: 1ad20afa-547b-11ec-b4e7-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| sourcetype=sysmon_linux CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user + | `detect_mimipenguin_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1552 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml new file mode 100644 index 0000000000..69e1260f73 --- /dev/null +++ b/stories/linux_post_exploitation.yml @@ -0,0 +1,20 @@ +name: Linux Post-Exploitation +id: d310ccfe-5477-11ec-ad05-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: +- https://www.destroyallsoftware.com/talks/wat +tags: + analytic_story: + - Linux Post-Exploitation + category: + - Adversary Tactics + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring \ No newline at end of file diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml new file mode 100644 index 0000000000..b63e1783f5 --- /dev/null +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect LinEnum execution Unit Test +tests: +- name: Detect LinEnum execution + file: endpoint/detect_linenum_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml new file mode 100644 index 0000000000..d015b088ff --- /dev/null +++ b/tests/endpoint/detect_linpeas_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect LinPeas Execution Unit Test +tests: +- name: Detect LinPeas Execution + file: endpoint/detect_linpeas_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml new file mode 100644 index 0000000000..d472d2ba8c --- /dev/null +++ b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect Linux Exploit Suggester Execution Unit Test +tests: +- name: Detect Linux Exploit Suggester Execution + file: endpoint/detect_linux_exploit_suggester_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml new file mode 100644 index 0000000000..65e9e05c9f --- /dev/null +++ b/tests/endpoint/detect_mimipenguin.test.yml @@ -0,0 +1,12 @@ +name: Detect MimiPenguin Unit Test +tests: +- name: Detect MimiPenguin + file: endpoint/detect_mimipenguin.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 3f377be712ca72e936ed9855412c849a62164bde Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Mon, 6 Dec 2021 11:35:47 -0800 Subject: [PATCH 02/49] autosuidsearch --- ...detect_autosuid_post_exploitation_tool.yml | 55 +++++++++++++++++++ .../endpoint/detect_linenum_execution.yml | 36 +++++++----- .../endpoint/detect_linpeas_execution.yml | 36 +++++++----- ...tect_linux_exploit_suggester_execution.yml | 27 +++++---- detections/endpoint/detect_mimipenguin.yml | 36 +++++++----- ...t_autosuid_post_exploitation_tool.test.yml | 12 ++++ 6 files changed, 147 insertions(+), 55 deletions(-) create mode 100644 detections/endpoint/detect_autosuid_post_exploitation_tool.yml create mode 100644 tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml new file mode 100644 index 0000000000..337434a9db --- /dev/null +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -0,0 +1,55 @@ +name: Detect AutoSUID post exploitation tool +id: 0edd5862-56c9-11ec-b990-acde48001122 +version: 1 +date: '2021-12-06' +author: Rod Soto +type: TTP +datamodel: +- Endpoint +description: + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path + | `detect_autosuid_post_exploitation_tool_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. +references: +- https://attack.mitre.org/matrices/enterprise/linux/ +- https://github.com/IvanGlinkin/AutoSUID +tags: + analytic_story: + - Linux Post Exploitation + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1069 + - T1222 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - process + - process_current_directory + - process_path + security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source: endpoint + - Stage: discovery + message: AutoSUID post exploitation tool detected + observable: + observable: + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index b79fde84f3..09caa0dd33 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,20 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| sourcetype="sysmon_linux" wget CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory +description: + LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory | `detect_linenum_execution_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. references: -- +- https://github.com/rebootuser/LinEnum +- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -39,12 +37,20 @@ tags: - Splunk Cloud required_fields: - _time + - CommandLine + - user + - process_exec + - process_current_directory security_domain: endpoint - impact: - confidence: + impact: 50 + confidence: 90 # (impact * confidence)/100 - risk_score: + risk_score: 90 context: - message: + - Source: endpoint + - Stage: discovery + message: LinEnum post exploitation tool detected observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 4623458867..081fe1bfa4 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -6,20 +6,19 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| sourcetype=sysmon_linux CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path +description: + Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: -- +- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist +- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -40,12 +39,21 @@ tags: - Splunk Cloud required_fields: - _time + - Computer + - CommandLine + - user + - parent_process_exec + - process_path security_domain: endpoint - impact: - confidence: + impact: 90 + confidence: 100 # (impact * confidence)/100 - risk_score: + risk_score: 90 context: - message: + - Source: endpoint + - Stage: discovery + message: LinPEAS post exploitation tool detected observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index d6e9f9fca3..cfbc774903 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,20 +6,21 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: +description: UPDATE_DESCRIPTION WHAT IS THIS? WHAT DOES IT LOOK LIKE? HOW DO YOU TRIAGE IT? -search: '| sourcetype="sysmon_linux" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. references: -- +- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -39,11 +40,15 @@ tags: required_fields: - _time security_domain: endpoint - impact: - confidence: + impact: 90 + confidence: 100 # (impact * confidence)/100 - risk_score: + risk_score: 90 context: - message: + - Source: endpoint + - Stage: discovery + message: Linux Exploit Suggester post exploitation tool detected. observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 73f2c64552..a590ef3ddf 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,20 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| sourcetype=sysmon_linux CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user +description: + MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. +search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. references: -- +- https://github.com/huntergregal/mimipenguin +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - UPDATE_STORY_NAME + - Linux Post Exploitation dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -32,12 +30,20 @@ tags: - Splunk Cloud required_fields: - _time + - Computer + - parent_process + - process_current_directory + - user security_domain: endpoint - impact: - confidence: + impact: 50 + confidence: 70 # (impact * confidence)/100 - risk_score: + risk_score: 60 context: - message: + - Source: endpoint + - Stage: discovery + message: MimiPenguin post exploitation tool detected observable: - \ No newline at end of file + - name: Computer + - Type: Hostname + - role: Victim diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml new file mode 100644 index 0000000000..faa9b8ea4b --- /dev/null +++ b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml @@ -0,0 +1,12 @@ +name: Detect AutoSUID post exploitation tool Unit Test +tests: +- name: Detect AutoSUID post exploitation tool + file: endpoint/detect_autosuid_post_exploitation_tool.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From b2cc42aa108305e6cc497c719d56867c62b4c5ff Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 13:31:15 -0800 Subject: [PATCH 03/49] fixdatasetsinyml --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 7 ++----- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 2 +- .../detect_autosuid_post_exploitation_tool.test.yml | 8 ++++---- tests/endpoint/detect_linenum_execution.test.yml | 8 ++++---- tests/endpoint/detect_linpeas_execution.test.yml | 8 ++++---- .../detect_linux_exploit_suggester_execution.test.yml | 8 ++++---- tests/endpoint/detect_mimipenguin.test.yml | 8 ++++---- 10 files changed, 26 insertions(+), 29 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 337434a9db..11546f770a 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,10 +7,7 @@ type: TTP datamodel: - Endpoint description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? + This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. @@ -22,7 +19,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt kill_chain_phases: - Exploitation - Privilege Escalation diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 09caa0dd33..ebfd8bc5b3 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -19,7 +19,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt kill_chain_phases: - Privilege Escalation mitre_attack_id: diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 081fe1bfa4..413f200375 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -20,7 +20,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt kill_chain_phases: - Exploitation - Privilege Escalation diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index cfbc774903..c77a5e5158 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -22,7 +22,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt kill_chain_phases: - Exploitation - Privilege Escalation diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index a590ef3ddf..98a57d0d47 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -19,7 +19,7 @@ tags: analytic_story: - Linux Post Exploitation dataset: - - UPDATE_DATASET_URL + - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt kill_chain_phases: - Privilege Escalation mitre_attack_id: diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml index faa9b8ea4b..29c16b458d 100644 --- a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml +++ b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: autoSUID.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index b63e1783f5..825656a7dd 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: LinuxEnumd.tx + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml index d015b088ff..1e7397a056 100644 --- a/tests/endpoint/detect_linpeas_execution.test.yml +++ b/tests/endpoint/detect_linpeas_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: linpeasdataset.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml index d472d2ba8c..1efcd32d23 100644 --- a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml +++ b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: linuxexploitsuggesterdatasets.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml index 65e9e05c9f..a2fff212b5 100644 --- a/tests/endpoint/detect_mimipenguin.test.yml +++ b/tests/endpoint/detect_mimipenguin.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: mimipenguin.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" From f0ad0eeccb378aca7f376b5e5e8c20401e4ac0d2 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 13:39:21 -0800 Subject: [PATCH 04/49] fixautosuid --- detections/endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 11546f770a..be0d981f97 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: - This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. +This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. From ae3cfa6bc80f2efe5a47ddf67a7ca8b3f8d2aa92 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 13:49:34 -0800 Subject: [PATCH 05/49] fixedspaces --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 3 +-- detections/endpoint/detect_linenum_execution.yml | 3 +-- detections/endpoint/detect_linpeas_execution.yml | 3 +-- .../endpoint/detect_linux_exploit_suggester_execution.yml | 6 +----- detections/endpoint/detect_mimipenguin.yml | 3 +-- 5 files changed, 5 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index be0d981f97..dfc0e737a6 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: -This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. +description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index ebfd8bc5b3..50368e4c36 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. +description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory | `detect_linenum_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 413f200375..1478c4a07a 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. +description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index c77a5e5158..7eb4815876 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,11 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? +description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 98a57d0d47..061ca181fe 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,8 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: - MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. +description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. From 7fc627e2a72a096025833a3365786a84b3225004 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 7 Dec 2021 14:48:09 -0800 Subject: [PATCH 06/49] fixesnixpost --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 4 ++-- detections/endpoint/detect_mimipenguin.yml | 2 +- stories/linux_post_exploitation.yml | 8 ++++---- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index dfc0e737a6..bc44d314c9 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -16,7 +16,7 @@ references: - https://github.com/IvanGlinkin/AutoSUID tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt kill_chain_phases: diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 50368e4c36..d4b4750c0d 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -16,7 +16,7 @@ references: - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt kill_chain_phases: diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 1478c4a07a..ff375941c7 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -17,7 +17,7 @@ references: - https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt kill_chain_phases: diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 7eb4815876..2c08705cad 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,7 +6,7 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. +description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. @@ -16,7 +16,7 @@ references: - https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt kill_chain_phases: diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 061ca181fe..a4c6635f8f 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -16,7 +16,7 @@ references: - https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - - Linux Post Exploitation + - Linux Post-Exploitation dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt kill_chain_phases: diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml index 69e1260f73..9ca9a638bb 100644 --- a/stories/linux_post_exploitation.yml +++ b/stories/linux_post_exploitation.yml @@ -3,10 +3,10 @@ id: d310ccfe-5477-11ec-ad05-acde48001122 version: 1 date: '2021-12-03' author: Rod Soto -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE +description: This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin +narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version. references: -- https://www.destroyallsoftware.com/talks/wat +- https://attack.mitre.org/matrices/enterprise/linux/ tags: analytic_story: - Linux Post-Exploitation @@ -17,4 +17,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Security Monitoring \ No newline at end of file + usecase: Security Monitoring From 5f71b501f2f7c1382e0d8ef2a0bc1b04ec60fc06 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 07:47:14 -0800 Subject: [PATCH 07/49] addedmacros --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 2 +- macros/sysmon_linux.yml | 4 ++++ 6 files changed, 9 insertions(+), 5 deletions(-) create mode 100644 macros/sysmon_linux.yml diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index bc44d314c9..d852a68b8e 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path +search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index d4b4750c0d..f04e91a58d 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory +search: '| `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory | `detect_linenum_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index ff375941c7..18aab33a48 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path +search: '| `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 2c08705cad..18cc2d0889 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name +search: '| `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index a4c6635f8f..52c0d50d33 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. -search: '| source="Syslog:Linux-Sysmon/Operational" CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user +search: '| `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. diff --git a/macros/sysmon_linux.yml b/macros/sysmon_linux.yml new file mode 100644 index 0000000000..7482f5a592 --- /dev/null +++ b/macros/sysmon_linux.yml @@ -0,0 +1,4 @@ +definition: source=Syslog:Linux-Sysmon/Operational +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: sysmon_linux From f4bcc6b1c487c0270d34f13019584a6d98f8da58 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 07:59:08 -0800 Subject: [PATCH 08/49] fixedrisk --- detections/endpoint/detect_linenum_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index f04e91a58d..6d23996689 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -44,7 +44,7 @@ tags: impact: 50 confidence: 90 # (impact * confidence)/100 - risk_score: 90 + risk_score: 45 context: - Source: endpoint - Stage: discovery diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 52c0d50d33..e401eaf759 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -37,7 +37,7 @@ tags: impact: 50 confidence: 70 # (impact * confidence)/100 - risk_score: 60 + risk_score: 35 context: - Source: endpoint - Stage: discovery From 7d8e5e3973bb602c18edc4bc15a6260b30c84dff Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 08:03:39 -0800 Subject: [PATCH 09/49] fixrs --- detections/endpoint/detect_autosuid_post_exploitation_tool.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index d852a68b8e..0119717ec5 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -39,7 +39,7 @@ tags: impact: 90 confidence: 90 # (impact * confidence)/100 - risk_score: 90 + risk_score: 81 context: - Source: endpoint - Stage: discovery From c9f12163a87e1b292e07ff84d3422787cf7ff976 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 09:46:50 -0800 Subject: [PATCH 10/49] fixedformatt --- ...detect_autosuid_post_exploitation_tool.yml | 29 +++++++++---------- .../endpoint/detect_linenum_execution.yml | 26 ++++++++--------- ...tect_linux_exploit_suggester_execution.yml | 25 ++++++++-------- detections/endpoint/detect_mimipenguin.yml | 28 +++++++++--------- 4 files changed, 54 insertions(+), 54 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 0119717ec5..0208783ffd 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -5,7 +5,7 @@ date: '2021-12-06' author: Rod Soto type: TTP datamodel: -- Endpoint +- Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' @@ -17,14 +17,25 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 90 + context: + - Source: Endpoint + - Stage: Discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt + impact: 90 kill_chain_phases: - Exploitation - Privilege Escalation + message: AutoSUID post exploitation tool detected mitre_attack_id: - T1069 - T1222 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -33,19 +44,7 @@ tags: - _time - Computer - process - - process_current_directory - process_path - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 + - process_current_directory risk_score: 81 - context: - - Source: endpoint - - Stage: discovery - message: AutoSUID post exploitation tool detected - observable: - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 6d23996689..2ac72a50cd 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -17,10 +17,16 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 90 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt + impact: 50 kill_chain_phases: - Privilege Escalation + message: LinEnum post exploitation tool detected mitre_attack_id: - T1087 - T1069 @@ -30,6 +36,11 @@ tags: - T1082 - T1016 - T1033 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -39,17 +50,6 @@ tags: - CommandLine - user - process_exec - - process_current_directory - security_domain: endpoint - impact: 50 - confidence: 90 - # (impact * confidence)/100 + - process_current_directory risk_score: 45 - context: - - Source: endpoint - - Stage: discovery - message: LinEnum post exploitation tool detected - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 18cc2d0889..699b59b2fa 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -17,8 +17,14 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 100 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt + impact: 90 + message: Linux Exploit Suggester post exploitation tool detected. kill_chain_phases: - Exploitation - Privilege Escalation @@ -29,22 +35,17 @@ tags: - T1057 - T1518 - T1082 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 + - CommandLine risk_score: 90 - context: - - Source: endpoint - - Stage: discovery - message: Linux Exploit Suggester post exploitation tool detected. - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index e401eaf759..2df037ae16 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -17,32 +17,32 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 70 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt + impact: 50 kill_chain_phases: - Privilege Escalation + message: MimiPenguin post exploitation tool detected mitre_attack_id: - T1552 + observable: + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time + - user - Computer - parent_process - - process_current_directory - - user - security_domain: endpoint - impact: 50 - confidence: 70 - # (impact * confidence)/100 + - process_current_directory risk_score: 35 - context: - - Source: endpoint - - Stage: discovery - message: MimiPenguin post exploitation tool detected - observable: - - name: Computer - - Type: Hostname - - role: Victim + security_domain: endpoint From 020e9d5f580855fe7565a79504b1f7ff0f7eae9a Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 09:56:26 -0800 Subject: [PATCH 11/49] endpfx --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 4 ++-- detections/endpoint/detect_linenum_execution.yml | 4 ++-- detections/endpoint/detect_linpeas_execution.yml | 2 +- .../endpoint/detect_linux_exploit_suggester_execution.yml | 2 +- detections/endpoint/detect_mimipenguin.yml | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 0208783ffd..329dab4f62 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -5,7 +5,7 @@ date: '2021-12-06' author: Rod Soto type: TTP datamodel: -- Endpoint +- Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' @@ -33,7 +33,7 @@ tags: - T1222 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 2ac72a50cd..0cd16c5e66 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -38,7 +38,7 @@ tags: - T1033 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: @@ -50,6 +50,6 @@ tags: - CommandLine - user - process_exec - - process_current_directory + - process_current_directory risk_score: 45 security_domain: endpoint diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 18aab33a48..00f20b90ab 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -54,5 +54,5 @@ tags: message: LinPEAS post exploitation tool detected observable: - name: Computer - - Type: Hostname + - Type: Endpoint - role: Victim diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 699b59b2fa..861b5211fe 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -37,7 +37,7 @@ tags: - T1082 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 2df037ae16..3972d419c4 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -31,7 +31,7 @@ tags: - T1552 observable: - name: Computer - type: Hostname + type: Endpoint role: - Victim product: @@ -43,6 +43,6 @@ tags: - user - Computer - parent_process - - process_current_directory + - process_current_directory risk_score: 35 security_domain: endpoint From 86328655ec694270ef14c293eb7f8a843094e5cf Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 12 Jan 2022 10:21:50 -0800 Subject: [PATCH 12/49] fixlinpe --- .../endpoint/detect_linpeas_execution.yml | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index 00f20b90ab..ad21c5fd7c 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -18,11 +18,17 @@ references: tags: analytic_story: - Linux Post-Exploitation + confidence: 100 + context: + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt + impact: 90 kill_chain_phases: - Exploitation - Privilege Escalation + message: LinPEAS post exploitation tool detected mitre_attack_id: - T1082 - T1083 @@ -32,6 +38,11 @@ tags: - T1057 - T1518 - T1033 + observable: + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -42,17 +53,6 @@ tags: - CommandLine - user - parent_process_exec - - process_path - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 + - process_path risk_score: 90 - context: - - Source: endpoint - - Stage: discovery - message: LinPEAS post exploitation tool detected - observable: - - name: Computer - - Type: Endpoint - - role: Victim + security_domain: endpoint From b8820575151a0aefca6b56a765f5b9aded3ca578 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 13 Jan 2022 14:57:24 -0800 Subject: [PATCH 13/49] erictests --- .../endpoint/detect_autosuid_post_exploitation_tool.yml | 4 ++-- detections/endpoint/detect_linenum_execution.yml | 6 +++--- detections/endpoint/detect_linpeas_execution.yml | 4 ++-- .../endpoint/detect_linux_exploit_suggester_execution.yml | 4 ++-- detections/endpoint/detect_mimipenguin.yml | 4 ++-- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index 329dab4f62..b8013a397e 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. -search: '| `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path +search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path | `detect_autosuid_post_exploitation_tool_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. @@ -33,7 +33,7 @@ tags: - T1222 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index 0cd16c5e66..acc6d20ce2 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -7,8 +7,8 @@ type: TTP datamodel: - Endpoint description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: '| `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory - | `detect_linenum_execution_filter`' +search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter` ' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. references: @@ -38,7 +38,7 @@ tags: - T1033 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index ad21c5fd7c..f342b9b874 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script that searches for possible paths to escalate privileges. -search: '| `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path +search: ' `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES @@ -53,6 +53,6 @@ tags: - CommandLine - user - parent_process_exec - - process_path + - process_path risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 861b5211fe..50389d0d4d 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. -search: '| `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name +search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name | `detect_linux_exploit_suggester_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. @@ -37,7 +37,7 @@ tags: - T1082 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index 3972d419c4..b56685e78a 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. -search: '| `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user +search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. @@ -31,7 +31,7 @@ tags: - T1552 observable: - name: Computer - type: Endpoint + type: Endpoint role: - Victim product: From 4a4b309b051a4cb9be33ec8c8a0a98d74518af83 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 13 Jan 2022 17:32:42 -0800 Subject: [PATCH 14/49] addfieldtommpgn --- detections/endpoint/detect_mimipenguin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index b56685e78a..e639c8522a 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user - | `detect_mimipenguin_filter`' + CommandLine | `detect_mimipenguin_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. references: From db4732f94a84704359a1c177beea8ba128ab29ba Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 02:16:54 +0000 Subject: [PATCH 15/49] Added detection testing service results inDetect AutoSUID post exploitation tool --- ...detect_autosuid_post_exploitation_tool.yml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml index b8013a397e..6ef5248982 100644 --- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml +++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml @@ -6,11 +6,15 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: This search, detects Linux post exploitation tool AutoSUID, which is an a tool that searches for SUID executables files in order to escalate privileges. -search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory process_path - | `detect_autosuid_post_exploitation_tool_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored. +description: This search, detects Linux post exploitation tool AutoSUID, which is + an a tool that searches for SUID executables files in order to escalate privileges. +search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm + -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory + process_path | `detect_autosuid_post_exploitation_tool_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Unless an administrator is using these commands to troubleshoot + or audit a system, the execution of these commands should be monitored. references: - https://attack.mitre.org/matrices/enterprise/linux/ - https://github.com/IvanGlinkin/AutoSUID @@ -19,8 +23,8 @@ tags: - Linux Post-Exploitation confidence: 90 context: - - Source: Endpoint - - Stage: Discovery + - Source: Endpoint + - Stage: Discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt impact: 90 @@ -48,3 +52,4 @@ tags: - process_current_directory risk_score: 81 security_domain: endpoint + automated_detection_testing: passed From 67f02ac50aee718a48732631f60fc2f966a19b3e Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 05:07:31 -0800 Subject: [PATCH 16/49] fplp --- detections/endpoint/detect_linpeas_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml index f342b9b874..873814f318 100644 --- a/detections/endpoint/detect_linpeas_execution.yml +++ b/detections/endpoint/detect_linpeas_execution.yml @@ -10,7 +10,7 @@ description: Linux local Privilege Escalation Awesome Script (linPEAS) is a scri search: ' `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec process_path | `detect_linpeas_execution_filter`' how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: This search may produce false positives as it will display many sudo executed processess however, the cve-list within the command line it is a clear indicator, operator is searching for local vulnerabilites. references: - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS From d643ea9701490efc244ca8ba86e5b5aaff68717e Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 13:54:20 +0000 Subject: [PATCH 17/49] Added detection testing service results inDetect LinEnum execution --- .../endpoint/detect_linenum_execution.yml | 30 ++++++++++++------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml index acc6d20ce2..88344869e8 100644 --- a/detections/endpoint/detect_linenum_execution.yml +++ b/detections/endpoint/detect_linenum_execution.yml @@ -6,11 +6,18 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: LinEnum is a bash script that performs discovery commands for accounts, processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host. -search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" | stats count by Computer CommandLine user process_exec process_current_directory - | `detect_linenum_execution_filter` ' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Very rare to perform such an extensive grep on a system, however certain monitoring tools can produce similar results. It is important if monitoring tools are in place to verify what is the actual process directory of execution. +description: LinEnum is a bash script that performs discovery commands for accounts, + processes, kernel version, applications, services, and uses the information from + these commands to present operator with ways of escalating privileges or further + exploitation of targeted host. +search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh" + | stats count by Computer CommandLine user process_exec process_current_directory + | `detect_linenum_execution_filter` ' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Very rare to perform such an extensive grep on a system, however + certain monitoring tools can produce similar results. It is important if monitoring + tools are in place to verify what is the actual process directory of execution. references: - https://github.com/rebootuser/LinEnum - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist @@ -19,8 +26,8 @@ tags: - Linux Post-Exploitation confidence: 90 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt impact: 50 @@ -37,10 +44,10 @@ tags: - T1016 - T1033 observable: - - name: Computer - type: Endpoint - role: - - Victim + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,3 +60,4 @@ tags: - process_current_directory risk_score: 45 security_domain: endpoint + automated_detection_testing: passed From 9c987e42220b05a92747699521a7b29f9ffdbd99 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:47:41 +0000 Subject: [PATCH 18/49] Added detection testing service results inDetect AutoSUID post exploitation tool From 16302611bee45ab05e38b0e64a82134e3cff25aa Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:48:21 +0000 Subject: [PATCH 19/49] Added detection testing service results inDetect Linux Exploit Suggester Execution --- ...tect_linux_exploit_suggester_execution.yml | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml index 50389d0d4d..4bec3353fa 100644 --- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml +++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml @@ -6,11 +6,16 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: This search detects Linux Exploit Suggester tool execution. This is a tool that searches for vulnerabilities based on Kernel and Distribution versions then queries public exploit databases. -search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, process_name - | `detect_linux_exploit_suggester_execution_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Monitoring tools may produce similar commands although the presence of "exploit-db" is very unusual. +description: This search detects Linux Exploit Suggester tool execution. This is a + tool that searches for vulnerabilities based on Kernel and Distribution versions + then queries public exploit databases. +search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR + CommandLine="*exploit*" OR CommandLine="*exploit-db*" | stats count by CommandLine,user,Computer,action,signature, + process_name | `detect_linux_exploit_suggester_execution_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Monitoring tools may produce similar commands although the + presence of "exploit-db" is very unusual. references: - https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist - https://attack.mitre.org/matrices/enterprise/linux/ @@ -19,8 +24,8 @@ tags: - Linux Post-Exploitation confidence: 100 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt impact: 90 @@ -49,3 +54,4 @@ tags: - CommandLine risk_score: 90 security_domain: endpoint + automated_detection_testing: passed From 95be1b79b067e955bd8144cb4bd75595c3ea870f Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 14:48:40 +0000 Subject: [PATCH 20/49] Added detection testing service results inDetect MimiPenguin --- detections/endpoint/detect_mimipenguin.yml | 28 +++++++++++++--------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml index e639c8522a..00544506b3 100644 --- a/detections/endpoint/detect_mimipenguin.yml +++ b/detections/endpoint/detect_mimipenguin.yml @@ -6,11 +6,16 @@ author: Rod Soto type: TTP datamodel: - Endpoint -description: MimiPenguin is a tool that dumps login passwords from current linux destop users. This search detects execution of this tool. -search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count by Computer parent_process process_current_directory user - CommandLine | `detect_mimipenguin_filter`' -how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. Need to install this add-on to parse fields correctly and execute detection search. -known_false_positives: Some of these commands may be executed by sysadmin however not in the proximity and frequency, specially if querying for tools are that knonwn not to be installed at target system. +description: MimiPenguin is a tool that dumps login passwords from current linux destop + users. This search detects execution of this tool. +search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings + -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow" | stats count + by Computer parent_process process_current_directory user CommandLine | `detect_mimipenguin_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux. + Need to install this add-on to parse fields correctly and execute detection search. +known_false_positives: Some of these commands may be executed by sysadmin however + not in the proximity and frequency, specially if querying for tools are that knonwn + not to be installed at target system. references: - https://github.com/huntergregal/mimipenguin - https://attack.mitre.org/matrices/enterprise/linux/ @@ -19,8 +24,8 @@ tags: - Linux Post-Exploitation confidence: 70 context: - - Source: endpoint - - Stage: discovery + - Source: endpoint + - Stage: discovery dataset: - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt impact: 50 @@ -30,10 +35,10 @@ tags: mitre_attack_id: - T1552 observable: - - name: Computer - type: Endpoint - role: - - Victim + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,3 +51,4 @@ tags: - process_current_directory risk_score: 35 security_domain: endpoint + automated_detection_testing: passed From 82e32f0db635b5bf9dc9d07ccddd87c060f1c9a9 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 06:53:23 -0800 Subject: [PATCH 21/49] fixedtestfile --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 825656a7dd..4f0f44d620 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,7 +1,7 @@ name: Detect LinEnum execution Unit Test tests: - name: Detect LinEnum execution - file: endpoint/detect_linenum_execution.yml + file: endpoint/detect_linenum_execution.test.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 09f07639137323dd13fac5ff51c7404b8d3c358e Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Fri, 14 Jan 2022 07:00:45 -0800 Subject: [PATCH 22/49] Update detect_linenum_execution.test.yml --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 825656a7dd..4f0f44d620 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,7 +1,7 @@ name: Detect LinEnum execution Unit Test tests: - name: Detect LinEnum execution - file: endpoint/detect_linenum_execution.yml + file: endpoint/detect_linenum_execution.test.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 17513786165816290d187182edfb189c587f1574 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:14:38 -0800 Subject: [PATCH 23/49] fixedtestfileag --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 4f0f44d620..06b16b374c 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,4 +1,4 @@ -name: Detect LinEnum execution Unit Test +name: Detect LinEnum execution unit test tests: - name: Detect LinEnum execution file: endpoint/detect_linenum_execution.test.yml From d4155c8030272b0e413313814caa2256f84e64a9 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:20:45 -0800 Subject: [PATCH 24/49] tftest --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 06b16b374c..3c4b0b164c 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,4 +1,4 @@ -name: Detect LinEnum execution unit test +name: Detect LinEnum execution unit Test tests: - name: Detect LinEnum execution file: endpoint/detect_linenum_execution.test.yml From 329d1433abd7fe78a5ea921f7abd9ec29472500b Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:28:06 -0800 Subject: [PATCH 25/49] allabouttheT --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 3c4b0b164c..85cf4dde13 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: LinuxEnumd.tx + - file_name: LinuxEnumd.txt data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt source: "Syslog:Linux-Sysmon/Operational" sourcetype: "sysmon_linux" From 774feed60928de57c0047daa2c9a42953c752f7f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 14 Jan 2022 07:32:16 -0800 Subject: [PATCH 26/49] fix1k --- tests/endpoint/detect_linenum_execution.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml index 85cf4dde13..85d7de99da 100644 --- a/tests/endpoint/detect_linenum_execution.test.yml +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -1,7 +1,7 @@ name: Detect LinEnum execution unit Test tests: - name: Detect LinEnum execution - file: endpoint/detect_linenum_execution.test.yml + file: endpoint/detect_linenum_execution.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From e5403b97c6238d27179db6a4ca6ac70592f16d4c Mon Sep 17 00:00:00 2001 From: root Date: Fri, 14 Jan 2022 17:24:17 +0000 Subject: [PATCH 27/49] Added detection testing service results inDetect LinEnum execution From 312be225c0a0cba581a800980bc62fbfbf4fa464 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 19 Jan 2022 13:41:50 +0100 Subject: [PATCH 28/49] WhisperGateIsOpen --- ...ll_windows_defender_exclusion_commands.yml | 1 + .../endpoint/suspicious_process_file_path.yml | 9 ++++--- ...dows_defender_exclusion_registry_entry.yml | 16 +++++++++---- stories/whispergate.yml | 24 +++++++++++++++++++ 4 files changed, 42 insertions(+), 8 deletions(-) create mode 100644 stories/whispergate.yml diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 77326342b3..252218e519 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Remcos - Windows Defense Evasion Tactics + - WhisperGate automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 58aa39e8dd..0afe45cc40 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -18,9 +18,11 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*" OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path - = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" by Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" + by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -33,6 +35,7 @@ tags: analytic_story: - XMRig - Remcos + - WhisperGate automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index c767cc7558..1adfb72304 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -12,11 +12,17 @@ description: This analytic will detect a suspicious process that modify a regist excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. This is a good indicator for a defense evasion and to look further for events after this behavior. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows - Defender\\Exclusions\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_defender_exclusion_registry_entry_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*" + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `windows_defender_exclusion_registry_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/stories/whispergate.yml b/stories/whispergate.yml new file mode 100644 index 0000000000..5bc135e24a --- /dev/null +++ b/stories/whispergate.yml @@ -0,0 +1,24 @@ +name: WhisperGate +id: 0150e6e5-3171-442e-83f8-1ccd8599569b +version: 1 +date: '2022-01-19' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Destructive malware targeting Ukrainian organizations also known as the "whispergate". This analytic + story looks for suspicious process execution, commandlines, downloads, dns query and many more. +narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting + multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, + overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques. +references: +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 +tags: + analytic_story: WhisperGate + category: + - Malware + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 05218c71e8ce6ac4ed1c0e91c702cbf92754e067 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 19 Jan 2022 13:46:17 +0100 Subject: [PATCH 29/49] WhisperGateIsOpen --- .../executables_or_script_creation_in_suspicious_path.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 097f5f9978..2d127339e8 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -21,7 +21,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\* OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin* OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\* - OR Filesystem.file_path = *\\AppData\\Local\\Temp*) by Filesystem.file_create_time + OR Filesystem.file_path = *\\AppData\\Local\\Temp* OR Filesystem.file_path = *\\PerfLogs\\*) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -35,6 +35,7 @@ tags: analytic_story: - XMRig - Remcos + - WhisperGate automated_detection_testing: passed confidence: 70 context: From 4cff83c86da280b9990a0fd903357d0553b6fa52 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 19 Jan 2022 14:06:45 +0100 Subject: [PATCH 30/49] WhisperGateIsOpen --- detections/endpoint/add_or_set_windows_defender_exclusion.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index 8fe360863f..15ef104fbd 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Remcos - Windows Defense Evasion Tactics + - WhisperGate automated_detection_testing: passed confidence: 80 context: From 4e971b693cb541d9ec9198eca8467ca96e834a1a Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 19 Jan 2022 14:51:20 +0100 Subject: [PATCH 31/49] WhisperGateIsOpen --- ...picious_process_with_discord_dns_query.yml | 72 +++++++++++++++++++ ...us_process_with_discord_dns_query.test.yml | 12 ++++ 2 files changed, 84 insertions(+) create mode 100644 detections/endpoint/suspicious_process_with_discord_dns_query.yml create mode 100644 tests/endpoint/suspicious_process_with_discord_dns_query.test.yml diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml new file mode 100644 index 0000000000..768cc0ed22 --- /dev/null +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -0,0 +1,72 @@ +name: Suspicious Process With Discord DNS Query +id: 4d4332ae-792c-11ec-89c1-acde48001122 +version: 1 +date: '2022-01-19' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic detects a suspicious process making a DNS query via known, + abused VoIP, instant messaging, and digital distribution platforms used to download external files. + This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. + This is a good TTP indicator for possible initial access techniques for possible suspicious process aside from discord applications and application + like browser accessing discord link or create dns query. +search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer process_path + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_process_with_discord_dns_query_filter`' +how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query. +known_false_positives: Noise and false positive can be seen if the following instant + messaging is allowed to use within corporate network. In this case, a filter is + needed. +references: +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 +tags: + analytic_story: + - WhisperGate + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.005 + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults + - Computer + - process_path + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Execution + message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/suspicious_process_with_discord_dns_query.test.yml b/tests/endpoint/suspicious_process_with_discord_dns_query.test.yml new file mode 100644 index 0000000000..ff0a78b213 --- /dev/null +++ b/tests/endpoint/suspicious_process_with_discord_dns_query.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Process With Discord DNS Query Unit Test +tests: +- name: Suspicious Process With Discord DNS Query + file: endpoint/suspicious_process_with_discord_dns_query.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From a28d611cbc4bc2e98013ce267f0a8c6f144b30a5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 19 Jan 2022 14:55:02 +0100 Subject: [PATCH 32/49] WhisperGateIsOpen --- detections/endpoint/attempt_to_stop_security_service.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 1f5645aacf..151ee49fa2 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Disabling Security Tools - Trickbot + - WhisperGate asset_type: Endpoint automated_detection_testing: passed cis20: From 7d5cfe5ad5ee4809d87309dac262418b508b41c0 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 Jan 2022 09:15:37 -0700 Subject: [PATCH 33/49] added source --- detections/endpoint/add_or_set_windows_defender_exclusion.yml | 1 + detections/endpoint/attempt_to_stop_security_service.yml | 1 + .../executables_or_script_creation_in_suspicious_path.yml | 1 + .../powershell_windows_defender_exclusion_commands.yml | 1 + detections/endpoint/suspicious_process_file_path.yml | 1 + .../endpoint/suspicious_process_with_discord_dns_query.yml | 1 + .../endpoint/windows_defender_exclusion_registry_entry.yml | 1 + stories/whispergate.yml | 4 ++-- 8 files changed, 9 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index 15ef104fbd..0bcd25ae26 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -27,6 +27,7 @@ known_false_positives: admin or user may choose to use this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Remcos diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 151ee49fa2..fe2fd4b662 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -25,6 +25,7 @@ known_false_positives: None identified. Attempts to disable security-related ser should be identified and understood. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Disabling Security Tools diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 2d127339e8..b973d2989d 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -31,6 +31,7 @@ known_false_positives: Administrators may allow creation of script or exe in the specified. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - XMRig diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 252218e519..73b3d2921e 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -24,6 +24,7 @@ known_false_positives: admin or user may choose to use this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Remcos diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 0afe45cc40..ecc5950d4c 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -31,6 +31,7 @@ known_false_positives: Administrators may allow execution of specific binaries i non-standard paths. Filter as needed. references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - XMRig diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 768cc0ed22..9890592aa4 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -23,6 +23,7 @@ known_false_positives: Noise and false positive can be seen if the following ins references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - WhisperGate diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 1adfb72304..809fd245ac 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -31,6 +31,7 @@ known_false_positives: admin or user may choose to use this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Remcos diff --git a/stories/whispergate.yml b/stories/whispergate.yml index 5bc135e24a..bf707931a0 100644 --- a/stories/whispergate.yml +++ b/stories/whispergate.yml @@ -4,8 +4,8 @@ version: 1 date: '2022-01-19' author: Teoderick Contreras, Splunk description: Leverage searches that allow you to detect and investigate unusual activities - that might relate to the Destructive malware targeting Ukrainian organizations also known as the "whispergate". This analytic - story looks for suspicious process execution, commandlines, downloads, dns query and many more. + that might relate to the Destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic + story looks for suspicious process execution, command-line activity, downloads, DNS queries and many more. narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques. From d3aa2403d103a08a9b912b421c0f34675279f87d Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 19 Jan 2022 18:53:16 +0100 Subject: [PATCH 34/49] WhisperGateIsOpen --- .../endpoint/wscript_or_cscript_suspicious_child_process.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index a81bbfaa16..7b070efcd3 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -28,11 +28,13 @@ known_false_positives: user may create vbs or js script that use several tool as of its execution. references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - FIN7 - Remcos - Unusual Processes + - WhisperGate automated_detection_testing: passed confidence: 70 context: From 79f96d3270bbe449aa412837892d98c88594a228 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 20 Jan 2022 12:29:00 +0100 Subject: [PATCH 35/49] WhisperGateIsOpen --- detections/endpoint/high_file_deletion_frequency.yml | 2 ++ .../endpoint/process_deleting_its_process_file_path.yml | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/high_file_deletion_frequency.yml b/detections/endpoint/high_file_deletion_frequency.yml index b94a60f156..0a10071263 100644 --- a/detections/endpoint/high_file_deletion_frequency.yml +++ b/detections/endpoint/high_file_deletion_frequency.yml @@ -23,9 +23,11 @@ known_false_positives: user may delete bunch of pictures or files in a folder. references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Clop Ransomware + - WhisperGate automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 10f1aa4c83..86b393a6d7 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -11,7 +11,7 @@ description: This detection is to identify a suspicious process that tries to de evasion once a certain condition of malware is satisfied or not. Clop ransomware use this technique where it will try to delete its process file path using a .bat command if the keyboard layout is not the layout it tries to infect. -search: '`sysmon` EventCode=1 cmdline = "*/c del*" Image = "*\\cmd.exe" |eval result +search: '`sysmon` EventCode=1 cmdline = "* /c *" cmdline = "* del*" Image = "*\\cmd.exe" |eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine Image cmdline EventCode ProcessID result | where result = "Found" | `security_content_ctime(firstTime)` @@ -25,10 +25,12 @@ known_false_positives: unknown references: - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - Clop Ransomware - Remcos + - WhisperGate automated_detection_testing: passed confidence: 100 context: From 1b510a09297ee7d45aa64110c3b489bcec2c0e47 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 20 Jan 2022 15:11:12 +0100 Subject: [PATCH 36/49] WhisperGateIsOpen --- .../endpoint/ping_sleep_batch_command.yml | 78 +++++++++++++++++++ macros/process_ping.yml | 3 + .../ping_sleep_batch_command.test.yml | 12 +++ 3 files changed, 93 insertions(+) create mode 100644 detections/endpoint/ping_sleep_batch_command.yml create mode 100644 macros/process_ping.yml create mode 100644 tests/endpoint/ping_sleep_batch_command.test.yml diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml new file mode 100644 index 0000000000..6735adf2c2 --- /dev/null +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -0,0 +1,78 @@ +name: Ping Sleep Batch Command +id: ce058d6c-79f2-11ec-b476-acde48001122 +version: 1 +date: '2022-01-20' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a possible ping sleep batch command. This technique was seen in several malware and adversaries + to trigger sleep without calling sleep function of commandlets to either bypassed detection and sandbox analysis. + This anomaly detection can be a good indicator to a process might delete itself or delaying its execution. Better to check the parent process and the process name + that execute this command and the event before and after this technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_ping` (Processes.parent_process = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*>*") OR + (Processes.process = "*ping*" Processes.process = *-n* Processes.process="* Nul*"Processes.process="*>*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `ping_sleep_batch_command_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator or network operator may execute this command. Please update the filter macros to remove false positives. +references: +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +tags: + analytic_story: + - WhisperGate + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1497 + - T1497.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: suspicious $process$ commandline run in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/macros/process_ping.yml b/macros/process_ping.yml new file mode 100644 index 0000000000..c3e849b7a3 --- /dev/null +++ b/macros/process_ping.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_ping \ No newline at end of file diff --git a/tests/endpoint/ping_sleep_batch_command.test.yml b/tests/endpoint/ping_sleep_batch_command.test.yml new file mode 100644 index 0000000000..966eb62e76 --- /dev/null +++ b/tests/endpoint/ping_sleep_batch_command.test.yml @@ -0,0 +1,12 @@ +name: Ping Sleep Batch Command Unit Test +tests: +- name: Ping Sleep Batch Command + file: endpoint/ping_sleep_batch_command.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From a8e92874102e32b5014f35f30ead3e0b96d76d7d Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 20 Jan 2022 16:13:00 +0100 Subject: [PATCH 37/49] WhisperGateIsOpen --- ...hell_remove_windows_defender_directory.yml | 67 +++++++++++++++++++ ...remove_windows_defender_directory.test.yml | 12 ++++ 2 files changed, 79 insertions(+) create mode 100644 detections/endpoint/powershell_remove_windows_defender_directory.yml create mode 100644 tests/endpoint/powershell_remove_windows_defender_directory.test.yml diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml new file mode 100644 index 0000000000..73653f4c55 --- /dev/null +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -0,0 +1,67 @@ +name: Powershell Remove Windows Defender Directory +id: adf47620-79fa-11ec-b248-acde48001122 +version: 1 +date: '2022-01-20' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious powershell command to delete Windows Defender folder. + This technique was seen in whispergate operation where it uses advancedrun.exe nirsoft too gain admin privilege to execute + this powershell command to delete or evade windows defender application. This is a good indicator that some suspicious behavior + is happening on the system. +search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows Defender*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_remove_windows_defender_directory_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: unknown +references: +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +tags: + analytic_story: + - WhisperGate + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 100 + confidence: 90 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: suspicious powershell script $Message$ was executed on the $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/powershell_remove_windows_defender_directory.test.yml b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml new file mode 100644 index 0000000000..7d2b2a107f --- /dev/null +++ b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml @@ -0,0 +1,12 @@ +name: Powershell Remove Windows Defender Directory Unit Test +tests: +- name: Powershell Remove Windows Defender Directory + file: endpoint/powershell_remove_windows_defender_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file From 044b81b922cb7c54bb5dea421be4b4e9dd5b07e3 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 21 Jan 2022 09:34:41 +0100 Subject: [PATCH 38/49] Update add_or_set_windows_defender_exclusion.yml --- .../endpoint/add_or_set_windows_defender_exclusion.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index 0bcd25ae26..c62c06ac71 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic will detect a suspicious process commandline related to - windows defender exclusion feature. This command is abused by adversaries, malware - author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder - path, file path, process, extensions and etc. from its real time or schedule scan - to execute their malicious code. This is a good indicator for defense evasion and +description: This analytic will detect a suspicious process command-line related to windows defender exclusion feature. + This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products + by excluding folder path, file path, process, extensions and etc. + From its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and to look further for events after this behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference From eef369a633c119e801b6ba6f89a242026f972b85 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 21 Jan 2022 09:37:16 +0100 Subject: [PATCH 39/49] Update wscript_or_cscript_suspicious_child_process.yml --- .../endpoint/wscript_or_cscript_suspicious_child_process.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 7b070efcd3..a18129465f 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware - to execute different LOLBIN, other script like powershell or create a suspended + to execute different LOLBIN, other scripts like powershell or spawn a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious From bc0e4454c28b0c96662bb8017b044a5dae95154a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 21 Jan 2022 09:38:21 +0100 Subject: [PATCH 40/49] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index ecc5950d4c..6cdd94b4bd 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious - softtware. This behavior has been used by adversaries where they drop and run an + software. This behavior has been used by adversaries where they drop and run an exe in a path that is accessible without admin privileges. search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) From 742441eb3d6b931b46c8136ff1f38c6b9db21efc Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 21 Jan 2022 09:45:25 +0100 Subject: [PATCH 41/49] Update ping_sleep_batch_command.yml --- detections/endpoint/ping_sleep_batch_command.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 6735adf2c2..d3da37372c 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: This analytic is to detect a possible ping sleep batch command. This technique was seen in several malware and adversaries - to trigger sleep without calling sleep function of commandlets to either bypassed detection and sandbox analysis. + to trigger sleep without calling sleep function or commandlets to delay its execution to bypass detection and sandbox analysis. This anomaly detection can be a good indicator to a process might delete itself or delaying its execution. Better to check the parent process and the process name that execute this command and the event before and after this technique. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes @@ -75,4 +75,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From 2b4f34956d3473e3e6c935f4fa48019a46f4f843 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 21 Jan 2022 10:45:00 +0100 Subject: [PATCH 42/49] WhisperGateIsOpen --- ...ve_file_deletion_in_windefender_folder.yml | 74 +++++++++++++++++++ ...le_deletion_in_windefender_folder.test.yml | 12 +++ 2 files changed, 86 insertions(+) create mode 100644 detections/endpoint/excessive_file_deletion_in_windefender_folder.yml create mode 100644 tests/endpoint/excessive_file_deletion_in_windefender_folder.test.yml diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml new file mode 100644 index 0000000000..7c2249b114 --- /dev/null +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -0,0 +1,74 @@ +name: Excessive File Deletion In WinDefender Folder +id: b5baa09a-7a05-11ec-8da4-acde48001122 +version: 1 +date: '2022-01-20' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect suspicious file deletion events in Windows Defender folder. + This technique was seen in whispergate operation where it uses advancedrun.exe nirsoft too gain admin privilege to execute + this powershell command to delete or evade windows defender application. This is a good indicator that some suspicious behavior + is happening on the system. +search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" + | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by user EventCode Image ProcessID Computer + |where count >=50 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_file_deletion_in_windefender_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, TargetFilename, and ProcessID executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Windefender AV updates may cause this alert. Please update the filter macros to remove false positives. +references: +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +tags: + analytic_story: + - WhisperGate + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetFilename + - Computer + - user + - Image + - ProcessID + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: High frequency file deletion activity detected on host $Computer$ + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Endpoint + role: + - Victim + - name: deleted_files + type: File Name + role: + - Target + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/excessive_file_deletion_in_windefender_folder.test.yml b/tests/endpoint/excessive_file_deletion_in_windefender_folder.test.yml new file mode 100644 index 0000000000..9aab835e9b --- /dev/null +++ b/tests/endpoint/excessive_file_deletion_in_windefender_folder.test.yml @@ -0,0 +1,12 @@ +name: Excessive File Deletion In WinDefender Folder Unit Test +tests: +- name: Excessive File Deletion In WinDefender Folder + file: endpoint/excessive_file_deletion_in_windefender_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 4752ceea0f1a77fec51acf1f24ea808e3bb8995e Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 21 Jan 2022 10:46:28 +0100 Subject: [PATCH 43/49] WhisperGateIsOpen --- .../endpoint/excessive_file_deletion_in_windefender_folder.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index 7c2249b114..d0e355dd51 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect suspicious file deletion events in Windows Defender folder. +description: This analytic is to detect suspicious excessive file deletion events in Windows Defender folder. This technique was seen in whispergate operation where it uses advancedrun.exe nirsoft too gain admin privilege to execute this powershell command to delete or evade windows defender application. This is a good indicator that some suspicious behavior is happening on the system. From 99462820e17b9eab60b5d067fa58970161db8cca Mon Sep 17 00:00:00 2001 From: root Date: Mon, 24 Jan 2022 08:27:32 +0000 Subject: [PATCH 44/49] Added detection testing service results inSuspicious Process With Discord DNS Query --- ...picious_process_with_discord_dns_query.yml | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 9890592aa4..f05e35246e 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -7,15 +7,17 @@ type: Anomaly datamodel: - Endpoint description: This analytic detects a suspicious process making a DNS query via known, - abused VoIP, instant messaging, and digital distribution platforms used to download external files. - This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. - This is a good TTP indicator for possible initial access techniques for possible suspicious process aside from discord applications and application - like browser accessing discord link or create dns query. -search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" - | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer process_path - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_process_with_discord_dns_query_filter`' + abused VoIP, instant messaging, and digital distribution platforms used to download + external files. This technique is abused by adversaries, malware actors, and red + teams to download a malicious file on the target host. This is a good TTP indicator + for possible initial access techniques for possible suspicious process aside from + discord applications and application like browser accessing discord link or create + dns query. +search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" + AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats + count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus + process_name QueryResults Computer process_path | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`' how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query. known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is @@ -49,8 +51,7 @@ tags: - process_path security_domain: endpoint impact: 80 - confidence: 80 - # (impact * confidence)/100 + confidence: 80 risk_score: 64 context: - Source:Endpoint @@ -70,4 +71,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 49f5de98361b7bc54e8690814707fa1d9d041ef3 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 24 Jan 2022 08:45:36 +0000 Subject: [PATCH 45/49] Added detection testing service results inPowershell Remove Windows Defender Directory --- ...hell_remove_windows_defender_directory.yml | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 73653f4c55..12fb9cca0a 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -6,21 +6,21 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious powershell command to delete Windows Defender folder. - This technique was seen in whispergate operation where it uses advancedrun.exe nirsoft too gain admin privilege to execute - this powershell command to delete or evade windows defender application. This is a good indicator that some suspicious behavior - is happening on the system. -search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows Defender*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic is to detect a suspicious powershell command to delete + Windows Defender folder. This technique was seen in whispergate operation where + it uses advancedrun.exe nirsoft too gain admin privilege to execute this powershell + command to delete or evade windows defender application. This is a good indicator + that some suspicious behavior is happening on the system. +search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows + Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode + Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: unknown references: -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - WhisperGate @@ -44,9 +44,8 @@ tags: security_domain: endpoint impact: 100 confidence: 90 - # (impact * confidence)/100 risk_score: 90 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: suspicious powershell script $Message$ was executed on the $ComputerName$ @@ -64,4 +63,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From 83e24a88e98701dc61a2d8b064a82133d975aa4c Mon Sep 17 00:00:00 2001 From: root Date: Mon, 24 Jan 2022 09:12:02 +0000 Subject: [PATCH 46/49] Added detection testing service results inPing Sleep Batch Command --- .../endpoint/ping_sleep_batch_command.yml | 37 ++++++++++--------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index d3da37372c..a59e8cff38 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -6,25 +6,28 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a possible ping sleep batch command. This technique was seen in several malware and adversaries - to trigger sleep without calling sleep function or commandlets to delay its execution to bypass detection and sandbox analysis. - This anomaly detection can be a good indicator to a process might delete itself or delaying its execution. Better to check the parent process and the process name - that execute this command and the event before and after this technique. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_ping` (Processes.parent_process = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*>*") OR - (Processes.process = "*ping*" Processes.process = *-n* Processes.process="* Nul*"Processes.process="*>*") - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest - | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `ping_sleep_batch_command_filter`' +description: This analytic is to detect a possible ping sleep batch command. This + technique was seen in several malware and adversaries to trigger sleep without calling + sleep function or commandlets to delay its execution to bypass detection and sandbox + analysis. This anomaly detection can be a good indicator to a process might delete + itself or delaying its execution. Better to check the parent process and the process + name that execute this command and the event before and after this technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process + = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*>*") + OR (Processes.process = "*ping*" Processes.process = *-n* Processes.process="* Nul*"Processes.process="*>*") + by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.process_guid + Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator or network operator may execute this command. Please update the filter macros to remove false positives. + Sysmon TA. +known_false_positives: administrator or network operator may execute this command. + Please update the filter macros to remove false positives. references: -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - WhisperGate @@ -54,8 +57,7 @@ tags: - Processes.parent_process_id security_domain: endpoint impact: 60 - confidence: 60 - # (impact * confidence)/100 + confidence: 60 risk_score: 36 context: - Source:Endpoint @@ -76,3 +78,4 @@ tags: - CIS 3 - CIS 5 - CIS 16 + automated_detection_testing: passed From 8537e07fee18f9e848cbbd4bdd4250e691ea12c7 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 24 Jan 2022 09:29:59 +0000 Subject: [PATCH 47/49] Added detection testing service results inExcessive File Deletion In WinDefender Folder --- ...ve_file_deletion_in_windefender_folder.yml | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index d0e355dd51..d9638b498b 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -6,23 +6,23 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect suspicious excessive file deletion events in Windows Defender folder. - This technique was seen in whispergate operation where it uses advancedrun.exe nirsoft too gain admin privilege to execute - this powershell command to delete or evade windows defender application. This is a good indicator that some suspicious behavior - is happening on the system. -search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" - | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by user EventCode Image ProcessID Computer - |where count >=50 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic is to detect suspicious excessive file deletion events + in Windows Defender folder. This technique was seen in whispergate operation where + it uses advancedrun.exe nirsoft too gain admin privilege to execute this powershell + command to delete or evade windows defender application. This is a good indicator + that some suspicious behavior is happening on the system. +search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows + Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime + max(_time) as lastTime count by user EventCode Image ProcessID Computer |where count + >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_file_deletion_in_windefender_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, TargetFilename, and ProcessID executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: Windefender AV updates may cause this alert. Please update the filter macros to remove false positives. + logs with the process name, TargetFilename, and ProcessID executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Windefender AV updates may cause this alert. Please update + the filter macros to remove false positives. references: -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - WhisperGate @@ -46,8 +46,7 @@ tags: - ProcessID security_domain: endpoint impact: 50 - confidence: 50 - # (impact * confidence)/100 + confidence: 50 risk_score: 25 context: - Source:Endpoint @@ -71,4 +70,5 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 + automated_detection_testing: passed From fbbaef0c991293651a6dcb19f42e7103017b2f94 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 24 Jan 2022 07:33:36 -0700 Subject: [PATCH 48/49] Quick fixes --- .../endpoint/add_or_set_windows_defender_exclusion.yml | 6 +++--- .../excessive_file_deletion_in_windefender_folder.yml | 10 +++++----- detections/endpoint/ping_sleep_batch_command.yml | 6 +++--- .../powershell_remove_windows_defender_directory.yml | 8 ++++---- .../suspicious_process_with_discord_dns_query.yml | 2 +- .../wscript_or_cscript_suspicious_child_process.yml | 10 +++++----- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index c62c06ac71..b8885772a2 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic will detect a suspicious process command-line related to windows defender exclusion feature. +description: This analytic will identify a suspicious process command-line related to Windows Defender exclusion feature. This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products - by excluding folder path, file path, process, extensions and etc. + by excluding folder path, file path, process and extensions. From its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and to look further for events after this behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -22,7 +22,7 @@ how_to_implement: To successfully implement this search you need to be ingesting on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: admin or user may choose to use this windows features. +known_false_positives: Admin or user may choose to use this windows features. Filter as needed. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index d9638b498b..18b550af0e 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect suspicious excessive file deletion events - in Windows Defender folder. This technique was seen in whispergate operation where - it uses advancedrun.exe nirsoft too gain admin privilege to execute this powershell - command to delete or evade windows defender application. This is a good indicator +description: This analytic will identify excessive file deletion events + in Windows Defender folder. This technique was seen in WhisperGate operation where + it uses advancedrun.exe Nirsoft to gain administrative privilege to execute the PowerShell + command to delete or evade Windows Defender application. This is a good indicator that some suspicious behavior is happening on the system. search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime @@ -19,7 +19,7 @@ search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Wind how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and ProcessID executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: Windefender AV updates may cause this alert. Please update +known_false_positives: Windows Defender AV updates may cause this alert. Please update the filter macros to remove false positives. references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index a59e8cff38..bb58dec87b 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a possible ping sleep batch command. This +description: This analytic will identify possible ping sleep batch command. This technique was seen in several malware and adversaries to trigger sleep without calling sleep function or commandlets to delay its execution to bypass detection and sandbox - analysis. This anomaly detection can be a good indicator to a process might delete + analysis. This anomaly detection can be a good indicator to a process which may delete itself or delaying its execution. Better to check the parent process and the process name that execute this command and the event before and after this technique. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrator or network operator may execute this command. +known_false_positives: Administrator or network operator may execute this command. Please update the filter macros to remove false positives. references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 12fb9cca0a..22e4fc750a 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious powershell command to delete - Windows Defender folder. This technique was seen in whispergate operation where - it uses advancedrun.exe nirsoft too gain admin privilege to execute this powershell - command to delete or evade windows defender application. This is a good indicator +description: This analytic will identify a suspicious PowerShell command to delete + Windows Defender folder. This technique was seen in WhisperGate operation where + it uses advancedrun.exe Nirsoft to gain administrative privileges to execute the PowerShell + command to delete or evade Windows Defender application. This is a good indicator that some suspicious behavior is happening on the system. search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index f05e35246e..b38e628ffe 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic detects a suspicious process making a DNS query via known, +description: This analytic identifies a suspicious process making a DNS query via known, abused VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, malware actors, and red teams to download a malicious file on the target host. This is a good TTP indicator diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index a18129465f..0b0c68474c 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious spawned process by wscript or - cscript process. This technique was a common technique used by adversaries and malware - to execute different LOLBIN, other scripts like powershell or spawn a suspended +description: This analytic identifies a suspicious spawned process by WScript or + CScript process. This technique was a common technique used by adversaries and malware + to execute different LOLBIN, other scripts like PowerShell or spawn a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious @@ -24,8 +24,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: user may create vbs or js script that use several tool as part - of its execution. +known_false_positives: Administrators may create vbs or js script that use several tool as part + of its execution. Filter as needed. references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ From 321fd725f177ca1e21f7ba77f64afc1d045aba11 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Jan 2022 13:23:11 -0500 Subject: [PATCH 49/49] minor changes --- ...excessive_file_deletion_in_windefender_folder.yml | 8 ++++---- detections/endpoint/ping_sleep_batch_command.yml | 11 +++++------ .../powershell_remove_windows_defender_directory.yml | 10 +++++----- .../suspicious_process_with_discord_dns_query.yml | 12 +++++------- stories/whispergate.yml | 6 +++--- 5 files changed, 22 insertions(+), 25 deletions(-) diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index 18b550af0e..01ce4e15ae 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -7,10 +7,10 @@ type: TTP datamodel: - Endpoint description: This analytic will identify excessive file deletion events - in Windows Defender folder. This technique was seen in WhisperGate operation where - it uses advancedrun.exe Nirsoft to gain administrative privilege to execute the PowerShell - command to delete or evade Windows Defender application. This is a good indicator - that some suspicious behavior is happening on the system. + in the Windows Defender folder. This technique was seen in the WhisperGate malware campaign in which + adversaries abused Nirsofts advancedrun.exe to gain administrative privilege to then execute PowerShell + commands to delete files within the Windows Defender application folder. This behavior is a good indicator + the offending process is trying to corrupt a Windows Defender installation. search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by user EventCode Image ProcessID Computer |where count diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index bb58dec87b..b21c7a4dcb 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -6,12 +6,11 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic will identify possible ping sleep batch command. This - technique was seen in several malware and adversaries to trigger sleep without calling - sleep function or commandlets to delay its execution to bypass detection and sandbox - analysis. This anomaly detection can be a good indicator to a process which may delete - itself or delaying its execution. Better to check the parent process and the process - name that execute this command and the event before and after this technique. +description: This analytic will identify the possible execution of ping sleep batch commands. This + technique was seen in several malware samples and is used to trigger sleep times without explicitly calling + sleep functions or commandlets. The goal is to delay the execution of malicious code + and bypass detection or sandbox analysis. This detection can be a good indicator of a process + delaying its execution for malicious purposes. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*>*") diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 22e4fc750a..34f7dadfe3 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -6,11 +6,11 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic will identify a suspicious PowerShell command to delete - Windows Defender folder. This technique was seen in WhisperGate operation where - it uses advancedrun.exe Nirsoft to gain administrative privileges to execute the PowerShell - command to delete or evade Windows Defender application. This is a good indicator - that some suspicious behavior is happening on the system. +description: This analytic will identify a suspicious PowerShell command used to delete + the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where + it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell + command to delete the Windows Defender folder. This is a good indicator the offending process is + trying corrupt a Windows Defender installation. search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index b38e628ffe..e5cb3c5023 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -6,13 +6,11 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic identifies a suspicious process making a DNS query via known, - abused VoIP, instant messaging, and digital distribution platforms used to download - external files. This technique is abused by adversaries, malware actors, and red - teams to download a malicious file on the target host. This is a good TTP indicator - for possible initial access techniques for possible suspicious process aside from - discord applications and application like browser accessing discord link or create - dns query. +description: This analytic identifies a process making a DNS query to Discord, + a well known instant messaging and digital distribution platform. Discord can be + abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. + external files. A process resolving a Discord DNS name could be an indicator + of malware trying to download files from Discord for further execution. search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus diff --git a/stories/whispergate.yml b/stories/whispergate.yml index bf707931a0..e00e92fa5a 100644 --- a/stories/whispergate.yml +++ b/stories/whispergate.yml @@ -3,9 +3,9 @@ id: 0150e6e5-3171-442e-83f8-1ccd8599569b version: 1 date: '2022-01-19' author: Teoderick Contreras, Splunk -description: Leverage searches that allow you to detect and investigate unusual activities - that might relate to the Destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic - story looks for suspicious process execution, command-line activity, downloads, DNS queries and many more. +description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities + that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic + story looks for suspicious process execution, command-line activity, downloads, DNS queries and more. narrative: WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques.