Branch was auto-updated.

detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -0,0 +1,91 @@
+name: Clear Unallocated Sector Using Cipher App
+id: 8f907d90-6173-11ec-9c23-acde48001122
+version: 1
+date: '2021-12-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: this search is to detect execution of `cipher.exe` to clear the unallocated
+  sectors of a specific disk. This technique was seen in some ransomware to make it
+  impossible to forensically recover deleted files.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%/w:%") AND process_name="cipher.exe" 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: administrator may execute this app to manage disk
+references:
+- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
+- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
+tags:
+  analytic_story:
+  - Ransomware
+  - Information Sabotage
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1070.004
+  - T1070
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 100 
+  # (impact * confidence)/100
+  risk_score: 90
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors
+    of a specific disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  nist:
+  - PR.AC
+  - PR.IP
+  cis20:
+  - CIS 14
+  - CIS 16
+  

detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -0,0 +1,80 @@
+name: Hiding Files And Directories With Attrib exe
+id: 028e4406-6176-11ec-aec2-acde48001122
+version: 1
+date: '2021-12-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
+  as hidden by using specific flags so that the victim does not see the file.  The
+  search looks for specific command-line arguments to detect the use of attrib.exe
+  to hide files.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) 
+  | into write_ssa_detected_events();'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: 'Some applications and users may legitimately use attrib.exe
+  to interact with the files. '
+references:
+-  https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Persistence Techniques
+  - Information Sabotage
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222.001
+  - T1222
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 80
+  confidence: 90 
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  - Stage:Persistence
+  message: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process
+    type: Other
+    role:
+    - Attacker
+    - Parent Process
+  nist:
+  - PR.AC
+  - PR.IP
+  cis20:
+  - CIS 14
+  - CIS 16
+  

tests/endpoint/ssa___clear_unallocated_sector_using_cipher_app.test.yml

@@ -0,0 +1,10 @@
+name: Clear Unallocated Sector Using Cipher - SSA Unit test
+tests:
+  - name: Clear Unallocated Sector Using Cipher App
+    file: endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of Cipher Application execution
+    attack_data:
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log
+        source: WinEventLog:Security

tests/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.test.yml

@@ -0,0 +1,10 @@
+name: Hiding Files And Directories With Attrib exe - SSA Unit test
+tests:
+  - name: Hiding Files And Directories With Attrib exe
+    file: endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of attrib Application execution
+    attack_data:
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log
+        source: WinEventLog:Security