From c3dbdfa3cca8d0a57d7c622e6f4e115b02c00376 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 12 Sep 2022 10:29:00 -0500 Subject: [PATCH 1/7] updated search from 2343 --- .../recursive_delete_of_directory_in_batch_cmd.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 45e58f02e7..5e413213f3 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -1,7 +1,7 @@ name: Recursive Delete of Directory In Batch CMD id: ba570b3a-d356-11eb-8358-acde48001122 -version: 2 -date: '2021-06-22' +version: 3 +date: '2022-11-12' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,8 +11,8 @@ description: This search is to detect a suspicious commandline designed to delet (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process=* - rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name + as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process="* + rd *" Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`' From 56917d780e88324b02a6afc8ab5a0417d1122989 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 12 Sep 2022 18:21:33 -0500 Subject: [PATCH 2/7] 2352 --- .../endpoint/svchost_exe_lolbas_execution_process_spawn.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index 90587f65be..82d9c2ac84 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -1,6 +1,6 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 1 +version: 2 date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP @@ -50,7 +50,7 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: Svchost.exe spawned a LOLBAS process on $dest + message: Svchost.exe spawned a LOLBAS process on $dest$ mitre_attack_id: - T1053 - T1053.005 From fd475e9625e42632e73ad25c0c6405cfbe7eeff9 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 13 Sep 2022 15:33:46 -0500 Subject: [PATCH 3/7] adding datasets --- .../get_aduser_with_powershell_script_block.yml | 12 ++++++------ .../get_aduser_with_powershell_script_block.test.yml | 8 ++++---- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index f061a9f684..26995b7f42 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 -version: 1 -date: '2021-08-24' +version: 2 +date: '2022-13-11' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText + Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -30,7 +30,7 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log impact: 50 kill_chain_phases: - Reconnaissance diff --git a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml index 9c45b48d09..8aaca00268 100644 --- a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: aduser_powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog From 7ae6ec7be181f1492f765d942cc1ab0fe8cf3f03 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 13 Sep 2022 17:37:24 -0500 Subject: [PATCH 4/7] search updates and datasets --- .../endpoint/adsisearcher_account_discovery.yml | 16 +++++++--------- ...t_domainuser_with_powershell_script_block.yml | 10 +++++----- .../adsisearcher_account_discovery.test.yml | 8 ++++---- 3 files changed, 16 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index e9538f85fd..2e38b9b197 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -1,7 +1,7 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 -version: 1 -date: '2021-08-24' +version: 2 +date: '2022-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -9,10 +9,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" - Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `adsisearcher_account_discovery_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Computer ScriptBlockText UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -30,7 +28,7 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log impact: 50 kill_chain_phases: - Reconnaissance @@ -39,11 +37,11 @@ tags: - T1087.002 - T1087 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index c3f3fe2e49..11aef9f1cc 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get DomainUser with PowerShell Script Block id: 61994268-04f4-11ec-865c-acde48001122 -version: 2 -date: '2022-03-22' +version: 3 +date: '2022-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -11,7 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' @@ -38,11 +38,11 @@ tags: - T1087.002 - T1087 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim diff --git a/tests/endpoint/adsisearcher_account_discovery.test.yml b/tests/endpoint/adsisearcher_account_discovery.test.yml index 17f130c5bf..a9e623de53 100644 --- a/tests/endpoint/adsisearcher_account_discovery.test.yml +++ b/tests/endpoint/adsisearcher_account_discovery.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: adsisearcher_powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog From 3a0fefff7397f089ab26bef69b6ba55bbc24662a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 13 Sep 2022 17:40:20 -0500 Subject: [PATCH 5/7] validationn --- detections/endpoint/get_aduser_with_powershell_script_block.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 26995b7f42..8a8b60d48c 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 2 -date: '2022-13-11' +date: '2022-09-13' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: [] From 10e820d817ae8db4af89102abaec58c759252210 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 13 Sep 2022 18:37:55 -0500 Subject: [PATCH 6/7] search updates --- ...tantiation_via_wmi_and_powershell_script_block.yml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index f9cb59a258..109265fc2e 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WMI and PowerShell Script Block id: 2a048c14-4634-11ec-a618-3e22fbd008af -version: 1 -date: '2021-11-15' +version: 2 +date: '2022-11-15' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -9,10 +9,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote code execution. -search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" - AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText="*Invoke-WmiMethod*" AND (ScriptBlockText="*-CN*" OR ScriptBlockText="*-ComputerName*") AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -30,7 +27,7 @@ tags: - Source:Endpoint - Stage:Lateral Movement dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log impact: 90 kill_chain_phases: - Exploitation From 96e81ef195169ad0d90ce772e7febdcd410449c6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 13 Sep 2022 18:49:00 -0500 Subject: [PATCH 7/7] adding test file updates --- ...antiation_via_wmi_and_powershell_script_block.test.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml index 63e192f7db..91d6e02da2 100644 --- a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml +++ b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: wmi_remote_process_powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog