Branch was auto-updated.

detections/endpoint/disabling_remote_user_account_control.yml

@@ -25,6 +25,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Suspicious Windows Registry Activities
+  - Remcos
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Remcos
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/process_deleting_its_process_file_path.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
+  - Remcos
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -41,7 +42,7 @@ tags:
   message: A process $Image$ tries to delete its process path in commandline $cmdline$
     as part of defense evasion in host $Computer$
   mitre_attack_id:
-  - T1003.002
+  - T1070
   observable:
   - name: Computer
     type: Hostname

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -45,6 +45,7 @@ tags:
   - Windows Persistence Techniques
   - 'Emotet Malware  DHS Report TA18-201A '
   - IcedID
+  - Remcos
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml

@@ -0,0 +1,58 @@
+name: Remcos RAT File Creation in Remcos Folder
+id: 25ae862a-1ac3-11ec-94a1-acde48001122
+version: 1
+date: '2021-09-21'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect file creation in remcos folder in appdata which
+  is the keylog and clipboard logs that will be send to its c2 server. This is really
+  a good TTP indicator that there is a remcos rat in the system that do keylogging,
+  clipboard grabbing and audio recording.
+search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat")
+  Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path
+  Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` |
+  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1113
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - file_create_time
+  - file_name
+  - file_path
+  security_domain: endpoint
+  impact: 100
+  confidence: 100
+  risk_score: 100
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: file $file_name$ created in $file_path$ of $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/suspicious_image_creation_in_appdata_folder.yml

@@ -0,0 +1,72 @@
+name: Suspicious Image Creation In Appdata Folder
+id: f6f904c4-1ac0-11ec-806b-acde48001122
+version: 1
+date: '2021-09-21'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious creation of image in appdata folder
+  made by process that also has a file reference in appdata folder. This technique
+  was seen in remcos rat that capture screenshot of the compromised machine and place
+  it in the appdata and will be send to its C2 server. This TTP is really a good indicator
+  to check that process because it is in suspicious folder path and image files are
+  not commonly created by user in this folder path.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
+  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path
+  = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
+  fields _time dest file_create_time file_name file_path process_name process_path
+  process] | `suspicious_image_creation_in_appdata_folder_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1113
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - file_create_time
+  - file_name
+  - file_path
+  - process_name
+  - process_path
+  - process
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: process $process_name$ creating image file $file_path$ in $dest$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/suspicious_process_file_path.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Remcos
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/suspicious_wav_file_in_appdata_folder.yml

@@ -0,0 +1,71 @@
+name: Suspicious WAV file in Appdata Folder
+id: 5be109e6-1ac5-11ec-b421-acde48001122
+version: 1
+date: '2021-09-21'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious creation of .wav file in appdata
+  folder. This behavior was seen in Remcos RAT malware where it put the audio recording
+  in the appdata\audio folde as part of data collection. this recording can be send
+  to its C2 server as part of its exfiltration to the compromised machine. creation
+  of wav files in this folder path is not a ussual disk place used by user to save
+  audio format file.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
+  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*"
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields file_name file_path
+  process_name process_path process dest file_create_time _time ] | `suspicious_wav_file_in_appdata_folder_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, file_name, file_path and command-line
+  executions from your endpoints. If you are using Sysmon, you must have at least
+  version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1113
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - file_create_time
+  - file_name
+  - file_path
+  - process_name
+  - process_path
+  - process
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Collection
+  message: process $process_name$ creating image file $file_path$ in $dest$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

stories/remcos.yml

@@ -0,0 +1,23 @@
+name: Remcos
+id: 2bd4aa08-b9a5-40cf-bfe5-7d43f13d496c
+version: 1
+date: '2021-09-23'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Remcos RAT trojan, including looking for file writes associated
+  with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection..
+narrative: Remcos or Remote Control and Surveillance, marketed as a legitimate software for 
+  remotely managing Windows systems is now widely used in multiple malicious campaigns both APT and commodity malware by threat actors.
+references:
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://attack.mitre.org/software/S0332/
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos#:~:text=Remcos%20(acronym%20of%20Remote%20Control,used%20to%20remotely%20control%20computers.&text=Remcos%20can%20be%20used%20for,been%20used%20in%20hacking%20campaigns.
+tags:
+  analytic_story: Remcos
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/remcos_rat_file_creation_in_remcos_folder.test.yml

@@ -0,0 +1,14 @@
+name: Remcos RAT File Creation in Remcos Folder Unit Test
+tests:
+- name: Remcos RAT File Creation in Remcos Folder
+  file: endpoint/remcos_rat_file_creation_in_remcos_folder.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+    

tests/endpoint/suspicious_image_creation_in_appdata_folder.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Image Creation In Appdata Folder Unit Test
+tests:
+- name: Suspicious Image Creation In Appdata Folder
+  file: endpoint/suspicious_image_creation_in_appdata_folder.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_wav_file_in_appdata_folder.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious WAV file in Appdata Folder Unit Test
+tests:
+- name: Suspicious WAV file in Appdata Folder
+  file: endpoint/suspicious_wav_file_in_appdata_folder.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_wav.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog