diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index f01f53cb3f..7880312f6d 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -25,6 +25,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Suspicious Windows Registry Activities + - Remcos asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 35f5181447..097f5f9978 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - XMRig + - Remcos automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 34879dc76f..10f1aa4c83 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Clop Ransomware + - Remcos automated_detection_testing: passed confidence: 100 context: @@ -41,7 +42,7 @@ tags: message: A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ mitre_attack_id: - - T1003.002 + - T1070 observable: - name: Computer type: Hostname diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 0725a9de98..36b0346da1 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -45,6 +45,7 @@ tags: - Windows Persistence Techniques - 'Emotet Malware DHS Report TA18-201A ' - IcedID + - Remcos asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml new file mode 100644 index 0000000000..faadb097dc --- /dev/null +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -0,0 +1,58 @@ +name: Remcos RAT File Creation in Remcos Folder +id: 25ae862a-1ac3-11ec-94a1-acde48001122 +version: 1 +date: '2021-09-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect file creation in remcos folder in appdata which + is the keylog and clipboard logs that will be send to its c2 server. This is really + a good TTP indicator that there is a remcos rat in the system that do keylogging, + clipboard grabbing and audio recording. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") + Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path + Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://success.trendmicro.com/solution/1123281-remcos-malware-information +- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1113 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - file_create_time + - file_name + - file_path + security_domain: endpoint + impact: 100 + confidence: 100 + risk_score: 100 + context: + - Source:Endpoint + - Stage:Collection + message: file $file_name$ created in $file_path$ of $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml new file mode 100644 index 0000000000..dbbc13c1e0 --- /dev/null +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -0,0 +1,72 @@ +name: Suspicious Image Creation In Appdata Folder +id: f6f904c4-1ac0-11ec-806b-acde48001122 +version: 1 +date: '2021-09-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious creation of image in appdata folder + made by process that also has a file reference in appdata folder. This technique + was seen in remcos rat that capture screenshot of the compromised machine and place + it in the appdata and will be send to its C2 server. This TTP is really a good indicator + to check that process because it is in suspicious folder path and image files are + not commonly created by user in this folder path. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path + = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | + fields _time dest file_create_time file_name file_path process_name process_path + process] | `suspicious_image_creation_in_appdata_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://success.trendmicro.com/solution/1123281-remcos-malware-information +- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1113 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - file_create_time + - file_name + - file_path + - process_name + - process_path + - process + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Collection + message: process $process_name$ creating image file $file_path$ in $dest$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 2fb6f76db5..58aa39e8dd 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - XMRig + - Remcos automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml new file mode 100644 index 0000000000..d1b3fa912e --- /dev/null +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -0,0 +1,71 @@ +name: Suspicious WAV file in Appdata Folder +id: 5be109e6-1ac5-11ec-b421-acde48001122 +version: 1 +date: '2021-09-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious creation of .wav file in appdata + folder. This behavior was seen in Remcos RAT malware where it put the audio recording + in the appdata\audio folde as part of data collection. this recording can be send + to its C2 server as part of its exfiltration to the compromised machine. creation + of wav files in this folder path is not a ussual disk place used by user to save + audio format file. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields file_name file_path + process_name process_path process dest file_create_time _time ] | `suspicious_wav_file_in_appdata_folder_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, file_name, file_path and command-line + executions from your endpoints. If you are using Sysmon, you must have at least + version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: +- https://success.trendmicro.com/solution/1123281-remcos-malware-information +- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/ +tags: + analytic_story: + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1113 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - file_create_time + - file_name + - file_path + - process_name + - process_path + - process + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Collection + message: process $process_name$ creating image file $file_path$ in $dest$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/stories/remcos.yml b/stories/remcos.yml new file mode 100644 index 0000000000..ed4339758c --- /dev/null +++ b/stories/remcos.yml @@ -0,0 +1,23 @@ +name: Remcos +id: 2bd4aa08-b9a5-40cf-bfe5-7d43f13d496c +version: 1 +date: '2021-09-23' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Remcos RAT trojan, including looking for file writes associated + with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.. +narrative: Remcos or Remote Control and Surveillance, marketed as a legitimate software for + remotely managing Windows systems is now widely used in multiple malicious campaigns both APT and commodity malware by threat actors. +references: +- https://success.trendmicro.com/solution/1123281-remcos-malware-information +- https://attack.mitre.org/software/S0332/ +- https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos#:~:text=Remcos%20(acronym%20of%20Remote%20Control,used%20to%20remotely%20control%20computers.&text=Remcos%20can%20be%20used%20for,been%20used%20in%20hacking%20campaigns. +tags: + analytic_story: Remcos + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/remcos_rat_file_creation_in_remcos_folder.test.yml b/tests/endpoint/remcos_rat_file_creation_in_remcos_folder.test.yml new file mode 100644 index 0000000000..edfa3f3863 --- /dev/null +++ b/tests/endpoint/remcos_rat_file_creation_in_remcos_folder.test.yml @@ -0,0 +1,14 @@ +name: Remcos RAT File Creation in Remcos Folder Unit Test +tests: +- name: Remcos RAT File Creation in Remcos Folder + file: endpoint/remcos_rat_file_creation_in_remcos_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + \ No newline at end of file diff --git a/tests/endpoint/suspicious_image_creation_in_appdata_folder.test.yml b/tests/endpoint/suspicious_image_creation_in_appdata_folder.test.yml new file mode 100644 index 0000000000..cdd3f0f988 --- /dev/null +++ b/tests/endpoint/suspicious_image_creation_in_appdata_folder.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Image Creation In Appdata Folder Unit Test +tests: +- name: Suspicious Image Creation In Appdata Folder + file: endpoint/suspicious_image_creation_in_appdata_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_wav_file_in_appdata_folder.test.yml b/tests/endpoint/suspicious_wav_file_in_appdata_folder.test.yml new file mode 100644 index 0000000000..8b4268b8a0 --- /dev/null +++ b/tests/endpoint/suspicious_wav_file_in_appdata_folder.test.yml @@ -0,0 +1,12 @@ +name: Suspicious WAV file in Appdata Folder Unit Test +tests: +- name: Suspicious WAV file in Appdata Folder + file: endpoint/suspicious_wav_file_in_appdata_folder.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon_wav.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file