icedid

detections/endpoint/rundll32_create_remote_thread_to_a_process.yml

@@ -0,0 +1,66 @@
+name: Rundll32 Create Remote Thread To A Process
+id: 2dbeee3a-f067-11eb-96c0-acde48001122
+version: 1
+date: '2021-07-29'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process
+  . This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive 
+  information the the compromised host.
+  browser process.
+search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe"
+  | stats count min(_time) as firstTime max(_time) as lastTime
+  by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `rundll32_create_remote_thread_to_a_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the SourceImage, TargetImage, and EventCode executions from your
+  endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: unknown
+references:
+- https://www.joesandbox.com/analysis/380662/0/html
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage 
+  - TargetImage 
+  - TargetProcessId 
+  - SourceProcessId 
+  - StartAddress 
+  - EventCode 
+  - Computer 
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 56
+  context: 
+  - source: endpoint 
+  - stage: Defense Evasion
+  message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$
+  observable:
+  - name: Computer 
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  

detections/endpoint/rundll32_createremotethread_in_browser.yml

@@ -0,0 +1,64 @@
+name: Rundll32 CreateRemoteThread In Browser
+id: f8a22586-ee2d-11eb-a193-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe"
+  browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted 
+  browser process.
+search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe")
+  | stats count min(_time) as firstTime max(_time) as lastTime
+  by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `rundll32_createremotethread_in_browser_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the SourceImage, TargetImage, and EventCode executions from your
+  endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: unknown
+references:
+- https://www.joesandbox.com/analysis/380662/0/html
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage 
+  - TargetImage 
+  - TargetProcessId 
+  - SourceProcessId 
+  - StartAddress 
+  - EventCode 
+  - Computer 
+  security_domain: endpoint
+  impact: 70
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 70
+  context: 
+  - source: endpoint 
+  - stage: Defense Evasion
+  message: rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$
+  observable:
+  - name: Computer 
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker

detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml

@@ -0,0 +1,68 @@
+name: Suspicious IcedID Regsvr32 Cmdline
+id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
+version: 1
+date: '2021-07-27'
+author: Teoderick Contreras,
+type: batch
+datamodel:
+- Endpoint
+description: this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. 
+  This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader 
+  that will download and decrypt the config payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe
+  Processes.process=*-s* by  Processes.process_name Processes.process Processes.parent_process_name 
+  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `suspicious_icedid_regsvr32_cmdline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used.
+known_false_positives: minimal. but network operator can use this application to load dll. 
+references:
+- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.010
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name 
+  - process 
+  - parent_process_name 
+  - parent_process 
+  - process_id 
+  - parent_process_id 
+  - dest 
+  - user
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - source: endpoint 
+  - stage: Defense Evasion
+  message: regsvr32 process $process_name$ with commandline $process$ in host $dest$
+  observable:
+  - name: dest 
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  

detections/endpoint/suspicious_icedid_rundll32_cmdline.yml

@@ -0,0 +1,70 @@
+name: Suspicious IcedID Rundll32 Cmdline
+id: bed761f8-ee29-11eb-8bf3-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious rundll32.exe commandline to execute dll file. 
+  This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted 
+  dll payload which is the license.dat.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*/i:* by  Processes.process_name Processes.process 
+  Processes.parent_process_name Processes.parent_process Processes.process_id 
+  Processes.parent_process_id Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `suspicious_icedid_rundll32_cmdline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: limitted. this parameter is not commonly used by 
+  windows application but can be used by the network operator.
+references:
+- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name 
+  - process 
+  - parent_process_name 
+  - parent_process 
+  - process_id 
+  - parent_process_id 
+  - dest 
+  - user 
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - source: endpoint 
+  - stage: Defense Evasion
+  message: rundll32 process $process_name$ with commandline $process$ in host $dest$
+  observable:
+  - name: dest 
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  

detections/endpoint/suspicious_rundll32_plugininit.yml

@@ -0,0 +1,69 @@
+name: Suspicious Rundll32 PluginInit
+id: 92d51712-ee29-11eb-b1ae-acde48001122
+version: 1
+date: '2021-07-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious rundll32.exe process with plugininit parameter. 
+  This technique is commonly seen in IceID malware to execute its initial dll stager to download another 
+  payload to the compromised machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*PluginInit* by  Processes.process_name Processes.process
+  Processes.parent_process_name Processes.parent_process Processes.process_id 
+  Processes.parent_process_id Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_plugininit_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: third party application may used this dll export name to execute function.
+references:
+- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
+tags:
+  analytic_story:
+  - Icedid
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name 
+  - process
+  - parent_process_name 
+  - parent_process 
+  - process_id 
+  - parent_process_id 
+  - dest 
+  - user
+  security_domain: endpoint
+  impact: 60
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 42
+  context:
+  - source: endpoint 
+  - stage: Defense Evasion
+  message: rundll32 process $process_name$ with commandline $process$ in host $dest$
+  observable:
+  - name: dest 
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  

tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 Create Remote Thread To A Process Unit Test
+tests:
+- name: Rundll32 Create Remote Thread To A Process
+  file: endpoint/rundll32_create_remote_thread_to_a_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rundll32_createremotethread_in_browser.test.yml

@@ -0,0 +1,12 @@
+name: Rundll32 CreateRemoteThread In Browser Unit Test
+tests:
+- name: Rundll32 CreateRemoteThread In Browser
+  file: endpoint/rundll32_createremotethread_in_browser.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious IcedID Regsvr32 Cmdline Unit Test
+tests:
+- name: Suspicious IcedID Regsvr32 Cmdline
+  file: endpoint/suspicious_icedid_regsvr32_cmdline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious IcedID Rundll32 Cmdline Unit Test
+tests:
+- name: Suspicious IcedID Rundll32 Cmdline
+  file: endpoint/suspicious_icedid_rundll32_cmdline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_rundll32_plugininit.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Rundll32 PluginInit Unit Test
+tests:
+- name: Suspicious Rundll32 PluginInit
+  file: endpoint/suspicious_rundll32_plugininit.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog