diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8b87759b90..74aa6d9ece 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,40 +1,32 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 4 -date: '2020-11-09' -author: David Dorsey, Splunk +version: 5 +date: '2022-11-10' +author: David Dorsey, Michael Haag, Splunk, nterl0k type: Hunting datamodel: - Endpoint description: The search looks for file modifications with extensions commonly used by Ransomware -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) - as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex - field=file_name "(?\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime count latest(Filesystem.user) as user values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest _time span=1h + | `drop_dm_object_name(Filesystem)` + | rex field=file_name "(?\.[^\.]+)$" + | rex field=file_path "(?([^\\\]*\\\)*).*" + | stats min(firstTime) as firstTime max(lastTime) as lastTime latest(user) as user dc(true_file_path) as path_count dc(file_name) as file_count latest(file_name) as file_name latest(true_file_path) as file_path by dest file_extension + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `ransomware_extensions` + | where path_count > 1 OR file_count > 20 + | `common_ransomware_extensions_filter`' how_to_implement: 'You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data.\ - - This search produces fields (`query`,`query_length`,`count`) that are not yet supported - by ES Incident Review and therefore cannot be viewed when a notable event is raised. - These fields contribute additional context to the notable. To see the additional - metadata, add the following fields, if not already present, to Incident Review - - Event Attributes (Configure > Incident Management > Incident Review Settings > Add - New Entry):\\n1. **Label:** Name, **Field:** Name\ - - 1. \ - - 1. **Label:** File Extension, **Field:** file_extension\ - - Detailed documentation on how to create a new field within Incident Review may be + from your hosts to populate the Endpoint Filesystem data model node. To see the additional + metadata, add the following fields, if not already present, please review the detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' known_false_positives: It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions. -references: [] +references: + - https://github.com/splunk/security_content/issues/2448 tags: Consequence: Data Destruction analytic_story: @@ -50,7 +42,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log impact: 90 kill_chain_phases: - Actions on Objectives diff --git a/stories/qakbot.yml b/stories/qakbot.yml index e9241f2ed7..319e4492af 100644 --- a/stories/qakbot.yml +++ b/stories/qakbot.yml @@ -1,19 +1,19 @@ name: Qakbot id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6 -version: 1 -date: '2022-10-12' +version: 2 +date: '2022-11-14' author: Teoderick Contreras, Splunk -description: Leverage searches that allow you to detect and investigate unusual activities - that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. - Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals - financial data from infected or compromised system. -narrative: Qakbot is also known to leverage tools like powershell, process injection, and mimikatz - for its malicious activities. This malware was on the CISA top malware list for 2021. +description: QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware (ref. MITRE ATT&CK). +narrative: QakBot notably has made its way on the CISA top malware list for 2021. QakBot for years has been under continious improvement when it comes to initial access, injection and post-exploitation. Multiple adversaries use QakBot to gain initial access and persist, most notably TA551. + The actor(s) behind QakBot possess a modular framework consisting of maldoc builders, signed loaders, and DLLs that produce initially low detection rates at the beginning of the attack, which creates opportunities to deliver additional malware such as Egregor and Cobalt Strike. (ref. Cybersecurity ATT) + The more recent campaigns utilize HTML smuggling to deliver a ISO container that has a LNK and QakBot payload. QakBot will either load via regsvr32.exe directly, it will attempt to perform DLL sideloading. references: -- https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf -- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot -- https://securelist.com/qakbot-technical-analysis/103931/ -- https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails + - https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf + - https://malpedia.caad.fkie.fraunhofer.de/details/win.QakBot + - https://securelist.com/QakBot-technical-analysis/103931/ + - https://www.fortinet.com/blog/threat-research/new-variant-of-QakBot-spread-by-phishing-emails + - https://attack.mitre.org/software/S0650/ + - https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot tags: analytic_story: Qakbot category: diff --git a/tests/endpoint/common_ransomware_extensions.test.yml b/tests/endpoint/common_ransomware_extensions.test.yml index 814a6498fe..0ff9971a76 100644 --- a/tests/endpoint/common_ransomware_extensions.test.yml +++ b/tests/endpoint/common_ransomware_extensions.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog