Merge pull request #2446 from splunk/new_110422

Update common_ransomware_extensions.yml

detections/endpoint/common_ransomware_extensions.yml

@@ -1,40 +1,32 @@
 name: Common Ransomware Extensions
 id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
-version: 4
-date: '2020-11-09'
-author: David Dorsey, Splunk
+version: 5
+date: '2022-11-10'
+author: David Dorsey, Michael Haag, Splunk, nterl0k
 type: Hunting
 datamodel:
 - Endpoint
 description: The search looks for file modifications with extensions commonly used
   by Ransomware
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
-  as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex
-  field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime count latest(Filesystem.user) as user values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest _time span=1h
+  | `drop_dm_object_name(Filesystem)` 
+  | rex field=file_name "(?<file_extension>\.[^\.]+)$" 
+  | rex field=file_path "(?<true_file_path>([^\\\]*\\\)*).*" 
+  | stats min(firstTime) as firstTime max(lastTime) as lastTime latest(user) as user dc(true_file_path) as path_count dc(file_name) as file_count latest(file_name) as file_name latest(true_file_path) as file_path by dest file_extension
+  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(firstTime)`
+  | `ransomware_extensions`
+  | where path_count > 1 OR file_count > 20
+  | `common_ransomware_extensions_filter`'
 how_to_implement: 'You must be ingesting data that records the filesystem activity
-  from your hosts to populate the Endpoint file-system data model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.\
-
-  This search produces fields (`query`,`query_length`,`count`) that are not yet supported
-  by ES Incident Review and therefore cannot be viewed when a notable event is raised.
-  These fields contribute additional context to the notable. To see the additional
-  metadata, add the following fields, if not already present, to Incident Review -
-  Event Attributes (Configure > Incident Management > Incident Review Settings > Add
-  New Entry):\\n1. **Label:** Name, **Field:** Name\
-
-  1. \
-
-  1. **Label:** File Extension, **Field:** file_extension\
-
-  Detailed documentation on how to create a new field within Incident Review may be
+  from your hosts to populate the Endpoint Filesystem data model node. To see the additional
+  metadata, add the following fields, if not already present, please review the detailed documentation on how to create a new field within Incident Review may be
   found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
 known_false_positives: It is possible for a legitimate file with these extensions
   to be created. If this is a true ransomware attack, there will be a large number
   of files created with these extensions.
-references: []
+references: 
+  - https://github.com/splunk/security_content/issues/2448 
 tags:
   Consequence: Data Destruction
   analytic_story:
@@ -50,7 +42,7 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log
   impact: 90
   kill_chain_phases:
   - Actions on Objectives

stories/qakbot.yml

@@ -1,19 +1,19 @@
 name: Qakbot
 id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6
-version: 1
-date: '2022-10-12'
+version: 2
+date: '2022-11-14'
 author: Teoderick Contreras, Splunk
-description: Leverage searches that allow you to detect and investigate unusual activities
-  that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more.
-  Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals 
-  financial data from infected or compromised system. 
-narrative: Qakbot is also known to leverage tools like powershell, process injection, and mimikatz 
-  for its malicious activities. This malware was on the CISA top malware list for 2021. 
+description: QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware (ref. MITRE ATT&CK).
+narrative: QakBot notably has made its way on the CISA top malware list for 2021. QakBot for years has been under continious improvement when it comes to initial access, injection and post-exploitation. Multiple adversaries use QakBot to gain initial access and persist, most notably TA551. 
+  The actor(s) behind QakBot possess a modular framework consisting of maldoc builders, signed loaders, and DLLs that produce initially low detection rates at the beginning of the attack, which creates opportunities to deliver additional malware such as Egregor and Cobalt Strike. (ref. Cybersecurity ATT)
+  The more recent campaigns utilize HTML smuggling to deliver a ISO container that has a LNK and QakBot payload. QakBot will either load via regsvr32.exe directly, it will attempt to perform DLL sideloading. 
 references:
-- https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf
-- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
-- https://securelist.com/qakbot-technical-analysis/103931/
-- https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails
+  - https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf
+  - https://malpedia.caad.fkie.fraunhofer.de/details/win.QakBot
+  - https://securelist.com/QakBot-technical-analysis/103931/
+  - https://www.fortinet.com/blog/threat-research/new-variant-of-QakBot-spread-by-phishing-emails
+  - https://attack.mitre.org/software/S0650/
+  - https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot
 tags:
   analytic_story: Qakbot
   category:

tests/endpoint/common_ransomware_extensions.test.yml

@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog