From bd69016d7e333048970e10a5e911e5b1a5789aab Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Jul 2021 13:57:10 -0600
Subject: [PATCH 1/6] PowerShell 4104 copy of Security HIVES

Modified macro to capture both XML rendered and non. Issue is, if you renderXML for powershell logging, it will have different fields. Something to be aware of.
---
 ...f_shadowcopy_with_script_block_logging.yml | 61 +++++++++++++++++++
 macros/powershell.yml                         |  2 +-
 2 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml

diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
new file mode 100644
index 0000000000..d9db5ee836
--- /dev/null
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -0,0 +1,61 @@
+name: Detect Copy of ShadowCopy with Script Block Logging
+id: 9251299c-ea5b-11eb-a8de-acde48001122
+version: 1
+date: '2021-07-21'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify suspicious PowerShell execution. Script Block Logging captures the command
+  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+
+  This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in
+  script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
+
+  During triage, review parallel processes using an EDR product or 4688 events. It
+  will be important to understand the timeline of events around this activity. Review
+  the entire logged PowerShell script block.'
+search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`  | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
+references:
+tags:
+  analytic_story:
+  - Credential Dumping
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
\ No newline at end of file
diff --git a/macros/powershell.yml b/macros/powershell.yml
index 69edb779a1..d6b8f842d3 100644
--- a/macros/powershell.yml
+++ b/macros/powershell.yml
@@ -1,4 +1,4 @@
-definition: sourcetype=wineventlog OR source=WinEventLog:Microsoft-Windows-PowerShell/Operational
+definition: (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: powershell

From b87f262923c2dd349afafdc72f438fdb2cb89789 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Jul 2021 15:41:42 -0600
Subject: [PATCH 2/6] test file

---
 ..._copy_of_shadowcopy_with_script_block_logging.yml |  2 +-
 ..._of_shadowcopy_with_script_block_logging.test.yml | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml

diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index d9db5ee836..4f146516a3 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -19,7 +19,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | stats count min(_time) as firstTime max(_time)
   as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`  | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
+  | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
 references:
diff --git a/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
new file mode 100644
index 0000000000..46481ad652
--- /dev/null
+++ b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
@@ -0,0 +1,12 @@
+name: Detect Copy of ShadowCopy with Script Block Logging Unit Test
+tests:
+- name: Detect Copy of ShadowCopy with Script Block Logging
+  file: detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/hivenightmare/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file

From e9e56493f8927e85adefbc310df1ec4cba8ef286 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Jul 2021 15:44:04 -0600
Subject: [PATCH 3/6] Update
 detect_copy_of_shadowcopy_with_script_block_logging.test.yml

---
 ...detect_copy_of_shadowcopy_with_script_block_logging.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
index 46481ad652..03ddbbca70 100644
--- a/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
+++ b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
@@ -1,7 +1,7 @@
 name: Detect Copy of ShadowCopy with Script Block Logging Unit Test
 tests:
 - name: Detect Copy of ShadowCopy with Script Block Logging
-  file: detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+  file: endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 28af2af96c018302db94b777827ed69690d4e871 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Jul 2021 15:46:49 -0600
Subject: [PATCH 4/6] Update
 detect_copy_of_shadowcopy_with_script_block_logging.yml

---
 .../detect_copy_of_shadowcopy_with_script_block_logging.yml    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index 4f146516a3..2ed8cac06d 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -9,7 +9,8 @@ datamodel:
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
-  to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all. 
+  \
 
   This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in
   script block. This will catch the most basic use cases for credentials being taken for offline cracking. \

From e5d24fba22013042313f8704a5aa3219d66dab3e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 21 Jul 2021 15:48:36 -0600
Subject: [PATCH 5/6] Update
 detect_copy_of_shadowcopy_with_script_block_logging.yml

---
 .../detect_copy_of_shadowcopy_with_script_block_logging.yml  | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index 2ed8cac06d..41c36b85f7 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2021-07-21'
 author: Michael Haag, Splunk
 type: batch
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
@@ -23,7 +22,7 @@ search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Co
   | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
-references:
+references: []
 tags:
   analytic_story:
   - Credential Dumping

From afe1d8a286843656b7838543af34b6793df3d374 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 22 Jul 2021 06:55:12 -0600
Subject: [PATCH 6/6] Update
 detect_copy_of_shadowcopy_with_script_block_logging.yml

---
 .../detect_copy_of_shadowcopy_with_script_block_logging.yml  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index 41c36b85f7..7ecacf0b50 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -22,7 +22,10 @@ search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Co
   | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
-references: []
+references: 
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+  - https://github.com/GossiTheDog/HiveNightmare
+  - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
 tags:
   analytic_story:
   - Credential Dumping