From d2129cb6d2ef594352d5babb4e7402a05207ce94 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 29 Jul 2021 15:19:44 +0200 Subject: [PATCH] icedid --- ...ll32_create_remote_thread_to_a_process.yml | 66 +++++++++++++++++ ...rundll32_createremotethread_in_browser.yml | 64 +++++++++++++++++ .../suspicious_icedid_regsvr32_cmdline.yml | 68 ++++++++++++++++++ .../suspicious_icedid_rundll32_cmdline.yml | 70 +++++++++++++++++++ .../suspicious_rundll32_plugininit.yml | 69 ++++++++++++++++++ ...create_remote_thread_to_a_process.test.yml | 12 ++++ ...l32_createremotethread_in_browser.test.yml | 12 ++++ ...uspicious_icedid_regsvr32_cmdline.test.yml | 12 ++++ ...uspicious_icedid_rundll32_cmdline.test.yml | 12 ++++ .../suspicious_rundll32_plugininit.test.yml | 12 ++++ 10 files changed, 397 insertions(+) create mode 100644 detections/endpoint/rundll32_create_remote_thread_to_a_process.yml create mode 100644 detections/endpoint/rundll32_createremotethread_in_browser.yml create mode 100644 detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml create mode 100644 detections/endpoint/suspicious_icedid_rundll32_cmdline.yml create mode 100644 detections/endpoint/suspicious_rundll32_plugininit.yml create mode 100644 tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml create mode 100644 tests/endpoint/rundll32_createremotethread_in_browser.test.yml create mode 100644 tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml create mode 100644 tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml create mode 100644 tests/endpoint/suspicious_rundll32_plugininit.test.yml diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml new file mode 100644 index 0000000000..ec3808d37f --- /dev/null +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -0,0 +1,66 @@ +name: Rundll32 Create Remote Thread To A Process +id: 2dbeee3a-f067-11eb-96c0-acde48001122 +version: 1 +date: '2021-07-29' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process + . This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive + information the the compromised host. + browser process. +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" + | stats count min(_time) as firstTime max(_time) as lastTime + by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_create_remote_thread_to_a_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your + endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source: endpoint + - stage: Defense Evasion + message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml new file mode 100644 index 0000000000..755c9df043 --- /dev/null +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -0,0 +1,64 @@ +name: Rundll32 CreateRemoteThread In Browser +id: f8a22586-ee2d-11eb-a193-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" + browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted + browser process. +search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe") + | stats count min(_time) as firstTime max(_time) as lastTime + by SourceImage TargetImage TargetProcessId SourceProcessId StartAddress EventCode Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_createremotethread_in_browser_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the SourceImage, TargetImage, and EventCode executions from your + endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/380662/0/html +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - TargetProcessId + - SourceProcessId + - StartAddress + - EventCode + - Computer + security_domain: endpoint + impact: 70 + confidence: 100 + # (impact * confidence)/100 + risk_score: 70 + context: + - source: endpoint + - stage: Defense Evasion + message: rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker \ No newline at end of file diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml new file mode 100644 index 0000000000..52fb962aa2 --- /dev/null +++ b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml @@ -0,0 +1,68 @@ +name: Suspicious IcedID Regsvr32 Cmdline +id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 +version: 1 +date: '2021-07-27' +author: Teoderick Contreras, +type: batch +datamodel: +- Endpoint +description: this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. + This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader + that will download and decrypt the config payload. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe + Processes.process=*-s* by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_icedid_regsvr32_cmdline_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used. +known_false_positives: minimal. but network operator can use this application to load dll. +references: +- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.010 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source: endpoint + - stage: Defense Evasion + message: regsvr32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml new file mode 100644 index 0000000000..c8f30af051 --- /dev/null +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -0,0 +1,70 @@ +name: Suspicious IcedID Rundll32 Cmdline +id: bed761f8-ee29-11eb-8bf3-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe commandline to execute dll file. + This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted + dll payload which is the license.dat. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + Processes.process=*/i:* by Processes.process_name Processes.process + Processes.parent_process_name Processes.parent_process Processes.process_id + Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_icedid_rundll32_cmdline_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: limitted. this parameter is not commonly used by + windows application but can be used by the network operator. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - source: endpoint + - stage: Defense Evasion + message: rundll32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml new file mode 100644 index 0000000000..21b2d37c0a --- /dev/null +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -0,0 +1,69 @@ +name: Suspicious Rundll32 PluginInit +id: 92d51712-ee29-11eb-b1ae-acde48001122 +version: 1 +date: '2021-07-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32.exe process with plugininit parameter. + This technique is commonly seen in IceID malware to execute its initial dll stager to download another + payload to the compromised machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + Processes.process=*PluginInit* by Processes.process_name Processes.process + Processes.parent_process_name Processes.parent_process Processes.process_id + Processes.parent_process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_rundll32_plugininit_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: third party application may used this dll export name to execute function. +references: +- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/ +tags: + analytic_story: + - Icedid + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + security_domain: endpoint + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - source: endpoint + - stage: Defense Evasion + message: rundll32 process $process_name$ with commandline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml b/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml new file mode 100644 index 0000000000..3e73848153 --- /dev/null +++ b/tests/endpoint/rundll32_create_remote_thread_to_a_process.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 Create Remote Thread To A Process Unit Test +tests: +- name: Rundll32 Create Remote Thread To A Process + file: endpoint/rundll32_create_remote_thread_to_a_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_createremotethread_in_browser.test.yml b/tests/endpoint/rundll32_createremotethread_in_browser.test.yml new file mode 100644 index 0000000000..a42be77dff --- /dev/null +++ b/tests/endpoint/rundll32_createremotethread_in_browser.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 CreateRemoteThread In Browser Unit Test +tests: +- name: Rundll32 CreateRemoteThread In Browser + file: endpoint/rundll32_createremotethread_in_browser.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml b/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml new file mode 100644 index 0000000000..6d0535e5e8 --- /dev/null +++ b/tests/endpoint/suspicious_icedid_regsvr32_cmdline.test.yml @@ -0,0 +1,12 @@ +name: Suspicious IcedID Regsvr32 Cmdline Unit Test +tests: +- name: Suspicious IcedID Regsvr32 Cmdline + file: endpoint/suspicious_icedid_regsvr32_cmdline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml b/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml new file mode 100644 index 0000000000..32c62eb72c --- /dev/null +++ b/tests/endpoint/suspicious_icedid_rundll32_cmdline.test.yml @@ -0,0 +1,12 @@ +name: Suspicious IcedID Rundll32 Cmdline Unit Test +tests: +- name: Suspicious IcedID Rundll32 Cmdline + file: endpoint/suspicious_icedid_rundll32_cmdline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_rundll32_plugininit.test.yml b/tests/endpoint/suspicious_rundll32_plugininit.test.yml new file mode 100644 index 0000000000..9c3b0018a8 --- /dev/null +++ b/tests/endpoint/suspicious_rundll32_plugininit.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Rundll32 PluginInit Unit Test +tests: +- name: Suspicious Rundll32 PluginInit + file: endpoint/suspicious_rundll32_plugininit.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file