From 4d105caac825f776ac13fb5ae832e353d42329a9 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 9 Nov 2022 09:26:14 -0700 Subject: [PATCH 1/5] Update common_ransomware_extensions.yml Issue https://github.com/splunk/security_content/issues/2392 --- .../endpoint/common_ransomware_extensions.yml | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8b87759b90..fb9f5ac1d8 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -14,22 +14,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex field=file_name "(?\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`' how_to_implement: 'You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data.\ - + from your hosts to populate the Endpoint file-system data model node. This search produces fields (`query`,`query_length`,`count`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional - metadata, add the following fields, if not already present, to Incident Review - - Event Attributes (Configure > Incident Management > Incident Review Settings > Add - New Entry):\\n1. **Label:** Name, **Field:** Name\ - - 1. \ - - 1. **Label:** File Extension, **Field:** file_extension\ - - Detailed documentation on how to create a new field within Incident Review may be + metadata, add the following fields, if not already present, please review the detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' known_false_positives: It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number From e65aabb3113e8dd9d8cdb1c1577e9421082a6dc1 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 10 Nov 2022 11:58:27 -0700 Subject: [PATCH 2/5] Update common_ransomware_extensions.yml --- .../endpoint/common_ransomware_extensions.yml | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index fb9f5ac1d8..957f97f997 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,18 +1,23 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 4 -date: '2020-11-09' -author: David Dorsey, Splunk +version: 5 +date: '2022-11-10' +author: David Dorsey, Michael Haag, Splunk, nterl0k type: Hunting datamodel: - Endpoint description: The search looks for file modifications with extensions commonly used by Ransomware -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) - as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex - field=file_name "(?\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime count latest(Filesystem.user) as user values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest _time span=1h + | `drop_dm_object_name(Filesystem)` + | rex field=file_name "(?\.[^\.]+)$" + | rex field=file_path "(?([^\\\]*\\\)*).*" + | stats min(firstTime) as firstTime max(lastTime) as lastTime latest(user) as user dc(true_file_path) as path_count dc(file_name) as file_count latest(file_name) as file_name latest(true_file_path) as file_path by dest file_extension + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `ransomware_extensions` + | where path_count > 1 OR file_count > 20 + | `common_ransomware_extensions_filter`' how_to_implement: 'You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This search produces fields (`query`,`query_length`,`count`) that are not yet supported @@ -23,7 +28,8 @@ how_to_implement: 'You must be ingesting data that records the filesystem activi known_false_positives: It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions. -references: [] +references: + - https://github.com/splunk/security_content/issues/2448 tags: Consequence: Data Destruction analytic_story: From d8bbc555058c7e52c16b4594b53f8a6ee94150c9 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 10 Nov 2022 15:03:22 -0700 Subject: [PATCH 3/5] notes --- detections/endpoint/common_ransomware_extensions.yml | 2 +- tests/endpoint/common_ransomware_extensions.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 957f97f997..17cb69c96b 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -45,7 +45,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log impact: 90 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/common_ransomware_extensions.test.yml b/tests/endpoint/common_ransomware_extensions.test.yml index 814a6498fe..0ff9971a76 100644 --- a/tests/endpoint/common_ransomware_extensions.test.yml +++ b/tests/endpoint/common_ransomware_extensions.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From e3c8450eea394c59333ffb605abfd253643d9b69 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 11 Nov 2022 12:17:45 -0800 Subject: [PATCH 4/5] Update common_ransomware_extensions.yml --- detections/endpoint/common_ransomware_extensions.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 17cb69c96b..74aa6d9ece 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -19,10 +19,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ | where path_count > 1 OR file_count > 20 | `common_ransomware_extensions_filter`' how_to_implement: 'You must be ingesting data that records the filesystem activity - from your hosts to populate the Endpoint file-system data model node. - This search produces fields (`query`,`query_length`,`count`) that are not yet supported - by ES Incident Review and therefore cannot be viewed when a notable event is raised. - These fields contribute additional context to the notable. To see the additional + from your hosts to populate the Endpoint Filesystem data model node. To see the additional metadata, add the following fields, if not already present, please review the detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' known_false_positives: It is possible for a legitimate file with these extensions From 8256d14f76ddfb2cea59592cab52b372e587a45c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 14 Nov 2022 09:39:31 -0700 Subject: [PATCH 5/5] Update qakbot.yml --- stories/qakbot.yml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/stories/qakbot.yml b/stories/qakbot.yml index e9241f2ed7..319e4492af 100644 --- a/stories/qakbot.yml +++ b/stories/qakbot.yml @@ -1,19 +1,19 @@ name: Qakbot id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6 -version: 1 -date: '2022-10-12' +version: 2 +date: '2022-11-14' author: Teoderick Contreras, Splunk -description: Leverage searches that allow you to detect and investigate unusual activities - that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. - Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals - financial data from infected or compromised system. -narrative: Qakbot is also known to leverage tools like powershell, process injection, and mimikatz - for its malicious activities. This malware was on the CISA top malware list for 2021. +description: QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware (ref. MITRE ATT&CK). +narrative: QakBot notably has made its way on the CISA top malware list for 2021. QakBot for years has been under continious improvement when it comes to initial access, injection and post-exploitation. Multiple adversaries use QakBot to gain initial access and persist, most notably TA551. + The actor(s) behind QakBot possess a modular framework consisting of maldoc builders, signed loaders, and DLLs that produce initially low detection rates at the beginning of the attack, which creates opportunities to deliver additional malware such as Egregor and Cobalt Strike. (ref. Cybersecurity ATT) + The more recent campaigns utilize HTML smuggling to deliver a ISO container that has a LNK and QakBot payload. QakBot will either load via regsvr32.exe directly, it will attempt to perform DLL sideloading. references: -- https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf -- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot -- https://securelist.com/qakbot-technical-analysis/103931/ -- https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails + - https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf + - https://malpedia.caad.fkie.fraunhofer.de/details/win.QakBot + - https://securelist.com/QakBot-technical-analysis/103931/ + - https://www.fortinet.com/blog/threat-research/new-variant-of-QakBot-spread-by-phishing-emails + - https://attack.mitre.org/software/S0650/ + - https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot tags: analytic_story: Qakbot category: