From 5f5e51255aad9436d5e26bfafc2510a838d5708b Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 28 Sep 2021 11:04:27 +0200 Subject: [PATCH 01/58] priv_esc --- .../registry_keys_used_for_persistence.yml | 2 +- .../screensaver_event_trigger_execution.yml | 68 +++++++++++++++++++ ...reensaver_event_trigger_execution.test.yml | 12 ++++ 3 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/screensaver_event_trigger_execution.yml create mode 100644 tests/endpoint/screensaver_event_trigger_execution.test.yml diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 36b0346da1..3fa7167986 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -11,7 +11,7 @@ description: The search looks for modifications to registry keys that can be use search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* - OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml new file mode 100644 index 0000000000..dd457c5f95 --- /dev/null +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -0,0 +1,68 @@ +name: Screensaver Event Trigger Execution +id: 58cea3ec-1f6d-11ec-8560-acde48001122 +version: 1 +date: '2021-09-27' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification. + This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution + to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `screensaver_event_trigger_execution_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://attack.mitre.org/techniques/T1546/002/ +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1546.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/screensaver_event_trigger_execution.test.yml b/tests/endpoint/screensaver_event_trigger_execution.test.yml new file mode 100644 index 0000000000..4e398660f6 --- /dev/null +++ b/tests/endpoint/screensaver_event_trigger_execution.test.yml @@ -0,0 +1,12 @@ +name: Screensaver Event Trigger Execution Unit Test +tests: +- name: Screensaver Event Trigger Execution + file: endpoint/screensaver_event_trigger_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From ea2e44f0665f1c1ebe1f0ef0de608177315901f4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 28 Sep 2021 11:13:54 +0200 Subject: [PATCH 02/58] privilege_esc_persistence --- detections/endpoint/registry_keys_used_for_persistence.yml | 3 ++- detections/endpoint/screensaver_event_trigger_execution.yml | 2 +- tests/endpoint/screensaver_event_trigger_execution.test.yml | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 3fa7167986..33f290cdd1 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -11,7 +11,8 @@ description: The search looks for modifications to registry keys that can be use search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* - OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* + OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index dd457c5f95..697e489eed 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification. +description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/tests/endpoint/screensaver_event_trigger_execution.test.yml b/tests/endpoint/screensaver_event_trigger_execution.test.yml index 4e398660f6..1f3ad83e56 100644 --- a/tests/endpoint/screensaver_event_trigger_execution.test.yml +++ b/tests/endpoint/screensaver_event_trigger_execution.test.yml @@ -1,6 +1,6 @@ name: Screensaver Event Trigger Execution Unit Test tests: -- name: Screensaver Event Trigger Execution +- name: Manual datasets generation for Screensaver Event Trigger Execution. file: endpoint/screensaver_event_trigger_execution.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' From 20f659970ecbe845483e74c4a1a70b7b54f61289 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 28 Sep 2021 15:20:25 +0200 Subject: [PATCH 03/58] privilege_esc_persistence --- .../change_default_file_association.yml | 67 +++++++++++++++++++ .../change_default_file_association.test.yml | 12 ++++ 2 files changed, 79 insertions(+) create mode 100644 detections/endpoint/change_default_file_association.yml create mode 100644 tests/endpoint/change_default_file_association.test.yml diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml new file mode 100644 index 0000000000..4a0b68584a --- /dev/null +++ b/detections/endpoint/change_default_file_association.yml @@ -0,0 +1,67 @@ +name: Change Default File Association +id: 462d17d8-1f71-11ec-ad07-acde48001122 +version: 1 +date: '2021-09-27' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. + This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script + or other payload that will load malicious command to the compromised host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `change_default_file_association_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1546.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/change_default_file_association.test.yml b/tests/endpoint/change_default_file_association.test.yml new file mode 100644 index 0000000000..42dd4b8324 --- /dev/null +++ b/tests/endpoint/change_default_file_association.test.yml @@ -0,0 +1,12 @@ +name: Change Default File Association Unit Test +tests: +- name: Change Default File Association + file: endpoint/change_default_file_association.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 993f0adb87f5e6c00ad39950d878ce7a1010f7e5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 10:42:05 +0200 Subject: [PATCH 04/58] privilege_escalation_persistence --- .../logon_script_event_trigger_execution.yml | 67 +++++++++++++++++++ .../endpoint/verclsid_clsid_execution.yml | 67 +++++++++++++++++++ macros/process_verclsid.yml | 3 + ...on_script_event_trigger_execution.test.yml | 12 ++++ .../verclsid_clsid_execution.test.yml | 12 ++++ 5 files changed, 161 insertions(+) create mode 100644 detections/endpoint/logon_script_event_trigger_execution.yml create mode 100644 detections/endpoint/verclsid_clsid_execution.yml create mode 100644 macros/process_verclsid.yml create mode 100644 tests/endpoint/logon_script_event_trigger_execution.test.yml create mode 100644 tests/endpoint/verclsid_clsid_execution.test.yml diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml new file mode 100644 index 0000000000..9be28d8257 --- /dev/null +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -0,0 +1,67 @@ +name: Logon Script Event Trigger Execution +id: 4c38c264-1f74-11ec-b5fa-acde48001122 +version: 1 +date: '2021-09-27' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. + This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine since + this is a +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `logon_script_event_trigger_execution_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://attack.mitre.org/techniques/T1037/001 +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1037.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml new file mode 100644 index 0000000000..6e438751a3 --- /dev/null +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -0,0 +1,67 @@ +name: Verclsid CLSID Execution +id: 61e9a56a-20fa-11ec-8ba3-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. + This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. + This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" AND Processes.process="*}*" + by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `verclsid_clsid_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: windows can used this application for its normal COm object validation +references: +- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 +- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ +tags: + analytic_story: + - Unusual Processes + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.original_file_name + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Defense Evasion + message: process $process_name$ to execute possible clsid commandline $process$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/macros/process_verclsid.yml b/macros/process_verclsid.yml new file mode 100644 index 0000000000..a70fbd2e0d --- /dev/null +++ b/macros/process_verclsid.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_verclsid \ No newline at end of file diff --git a/tests/endpoint/logon_script_event_trigger_execution.test.yml b/tests/endpoint/logon_script_event_trigger_execution.test.yml new file mode 100644 index 0000000000..dcb74a0a02 --- /dev/null +++ b/tests/endpoint/logon_script_event_trigger_execution.test.yml @@ -0,0 +1,12 @@ +name: Logon Script Event Trigger Execution Unit Test +tests: +- name: Logon Script Event Trigger Execution + file: endpoint/logon_script_event_trigger_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/verclsid_clsid_execution.test.yml b/tests/endpoint/verclsid_clsid_execution.test.yml new file mode 100644 index 0000000000..cbbc1bfc62 --- /dev/null +++ b/tests/endpoint/verclsid_clsid_execution.test.yml @@ -0,0 +1,12 @@ +name: Verclsid CLSID Execution Unit Test +tests: +- name: Verclsid CLSID Execution + file: endpoint/verclsid_clsid_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From f9662d73938c72dd924217de8e54f1ac3ab348b7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 10:42:52 +0200 Subject: [PATCH 05/58] privilege_escalation_persistence --- detections/endpoint/verclsid_clsid_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 6e438751a3..331e9489a6 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -30,7 +30,7 @@ tags: analytic_story: - Unusual Processes dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: From 7f49a1dedc7b933f6ab6f0f6e4bcb8eb545f691d Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 09:20:38 +0000 Subject: [PATCH 06/58] Added detection testing service results inVerclsid CLSID Execution --- .../endpoint/verclsid_clsid_execution.yml | 41 ++++++++++--------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 331e9489a6..5144212fd7 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -6,25 +6,27 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. - This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. - This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +description: This analytic is to detect a possible abuse of verclsid to execute malicious + file through generate CLSID. This process is a normal application of windows to + verify the CLSID COM object before it is instantiated by Windows Explorer. This + hunting query can be a good pivot point to analyze what is he CLSID or COM object + pointing too to check if it is a valid application or not. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" AND Processes.process="*}*" - by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" + AND Processes.process="*}*" by Processes.process_name Processes.original_file_name + Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: windows can used this application for its normal COm object validation + Sysmon TA. +known_false_positives: windows can used this application for its normal COm object + validation references: -- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 +- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ tags: analytic_story: @@ -41,21 +43,21 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.original_file_name - - Processes.dest - - Processes.user - - Processes.parent_process_name + - Processes.process_name + - Processes.original_file_name + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.parent_process security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint - stage:Defense Evasion - message: process $process_name$ to execute possible clsid commandline $process$ in $dest$ + message: process $process_name$ to execute possible clsid commandline $process$ + in $dest$ observable: - name: dest type: Hostname @@ -64,4 +66,5 @@ tags: - name: user type: user role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 65d6bacee6fd8fe7c77a8c75a02171db9479471f Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 09:50:10 +0000 Subject: [PATCH 07/58] Added detection testing service results inManual datasets generation for Screensaver Event Trigger Execution. --- .../screensaver_event_trigger_execution.yml | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index 697e489eed..00b8914da3 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -1,4 +1,4 @@ -name: Screensaver Event Trigger Execution +name: Screensaver Event Trigger Execution id: 58cea3ec-1f6d-11ec-8560-acde48001122 version: 1 date: '2021-09-27' @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. - This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution - to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. +description: This analytic is developed to detect possible event trigger execution + through screensaver registry entry modification for persistence or privilege escalation. + This technique was seen in several APT and malware where they put the malicious + payload path to the SCRNSAVE.EXE registry key to redirect the execution to their + malicious payload path. This TTP is a good indicator that some attacker may modify + this entry for their persistence and privilege escalation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `screensaver_event_trigger_execution_filter`' + max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control + Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -24,8 +25,8 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: unknown references: -- https://attack.mitre.org/techniques/T1546/002/ -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver +- https://attack.mitre.org/techniques/T1546/002/ +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver tags: analytic_story: - Windows Persistence Techniques @@ -42,15 +43,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 90 - # (impact * confidence)/100 risk_score: 72 context: - source:endpoint @@ -65,4 +65,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 5d2bb19efe1dda2f6a7c62a3c065b0dc2c766370 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 10:47:38 +0000 Subject: [PATCH 08/58] Added detection testing service results inLogon Script Event Trigger Execution --- .../logon_script_event_trigger_execution.yml | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 9be28d8257..d27bdca08a 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. - This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine since - this is a +description: This search is to detect a suspicious modification of registry entry + to persist and gain privilege escalation upon booting up of compromised host. This + technique was seen in several APT and malware where it modify UserInitMprLogonScript + registry entry to its malicious payload to be executed upon boot up of the machine + since this is a search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `logon_script_event_trigger_execution_filter`' + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: unknown references: -- https://attack.mitre.org/techniques/T1037/001 +- https://attack.mitre.org/techniques/T1037/001 tags: analytic_story: - Windows Persistence Techniques @@ -41,15 +41,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -64,4 +63,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From a83fee590a3cd84fbfd7cc4b004b5dd539bf5fe4 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 11:53:36 +0000 Subject: [PATCH 09/58] Added detection testing service results inChange Default File Association --- .../change_default_file_association.yml | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 4a0b68584a..44cab51f50 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. - This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script - or other payload that will load malicious command to the compromised host. +description: This analytic is developed to detect suspicious registry modification + to change the default file association of windows to malicious payload. This techninique + was seen in some APT where it modify the default process to run file association, + like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other + payload that will load malicious command to the compromised host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user + Registry.registry_path Registry.registry_key_name Registry.registry_value_name | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `change_default_file_association_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -25,7 +25,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: unknown references: -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features tags: analytic_story: - Windows Persistence Techniques @@ -42,15 +42,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -64,4 +63,5 @@ tags: - name: user type: user role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 24d740b66c38f44a57c7c6ddd11c337a00065e4e Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 15:21:03 +0200 Subject: [PATCH 10/58] privilege_escalation_persistence --- .../active_setup_registry_autostart.yml | 55 +++++++++++++++ .../print_processor_registry_autostart.yml | 69 +++++++++++++++++++ .../active_setup_registry_autostart.test.yml | 12 ++++ ...rint_processor_registry_autostart.test.yml | 12 ++++ 4 files changed, 148 insertions(+) create mode 100644 detections/endpoint/active_setup_registry_autostart.yml create mode 100644 detections/endpoint/print_processor_registry_autostart.yml create mode 100644 tests/endpoint/active_setup_registry_autostart.test.yml create mode 100644 tests/endpoint/print_processor_registry_autostart.test.yml diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml new file mode 100644 index 0000000000..10484e2631 --- /dev/null +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -0,0 +1,55 @@ +name: Active Setup Registry Autostart +id: f64579c0-203f-11ec-abcc-acde48001122 +version: 1 +date: '2021-09-28' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. + This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. + This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. + check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `active_setup_registry_autostart_filter`' +how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry.TO_IMPLEMENT +known_false_positives: active setup installer may add or modify this registry +references: +- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E +- https://attack.mitre.org/techniques/T1547/014/ +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.014 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml new file mode 100644 index 0000000000..144544ae94 --- /dev/null +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -0,0 +1,69 @@ +name: Print Processor Registry Autostart +id: 1f5b68aa-2037-11ec-898e-acde48001122 +version: 1 +date: '2021-09-28' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification or new registry entry regarding print processor. + This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. + This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `print_processor_registry_autostart_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: possible new printer installation may add driver component on this registry. +references: +- https://attack.mitre.org/techniques/T1547/012/ +- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/active_setup_registry_autostart.test.yml b/tests/endpoint/active_setup_registry_autostart.test.yml new file mode 100644 index 0000000000..e1fb06c684 --- /dev/null +++ b/tests/endpoint/active_setup_registry_autostart.test.yml @@ -0,0 +1,12 @@ +name: Active Setup Registry Autostart Unit Test +tests: +- name: Active Setup Registry Autostart + file: endpoint/active_setup_registry_autostart.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml new file mode 100644 index 0000000000..a40d16f744 --- /dev/null +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -0,0 +1,12 @@ +name: Print Processor Registry Autostart Unit Test +tests: +- name: Print Processor Registry Autostart + file: endpoint/print_processor_registry_autostart.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + source: WinEventLog:Microsoft-Windows-PrintService/Operational + sourcetype: WinEventLog \ No newline at end of file From e9e9edd6591f6d31c50c354d89800bba113fec75 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 15:25:45 +0200 Subject: [PATCH 11/58] privilege_escalation_persistence --- .../active_setup_registry_autostart.yml | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 10484e2631..4612b2dbee 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -44,12 +44,28 @@ tags: - Splunk Cloud required_fields: - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint - impact: - confidence: + impact: 80 + confidence: 100 # (impact * confidence)/100 - risk_score: + risk_score: 80 context: - message: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file From 5276ba85ce5987da3b4edcb66ee6974083119f52 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 15:27:18 +0200 Subject: [PATCH 12/58] privilege_escalation_persistence --- detections/endpoint/active_setup_registry_autostart.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 4612b2dbee..13b140310b 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -51,9 +51,9 @@ tags: - Registry.registry_value_name security_domain: endpoint impact: 80 - confidence: 100 + confidence: 80 # (impact * confidence)/100 - risk_score: 80 + risk_score: 64 context: - source:endpoint - stage:Privilege Escalation Persistence From 27539045d6cfc907115946842028cbe6b6d3fe5b Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 13:57:15 +0000 Subject: [PATCH 13/58] Added detection testing service results inActive Setup Registry Autostart --- .../active_setup_registry_autostart.yml | 47 +++++++++---------- 1 file changed, 23 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 13b140310b..b90601b450 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -6,28 +6,29 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. - This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. - This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. - check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +description: This analytic is to detect a suspicious modification of the active setup + registry for persistence and privilege escalation. This technique was seen in several + malware (poisonIvy), adware and APT to gain persistence to the compromised machine + upon boot up. This TTP is a good indicator to further check the process id that + do the modification since modification of this registry is not commonly done. check + the legitimacy of the file and process involve in this rules to check if it is a + valid setup installer that creating or modifying this registry. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `active_setup_registry_autostart_filter`' -how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name + = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed + Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name + Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`' +how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.TO_IMPLEMENT known_false_positives: active setup installer may add or modify this registry references: -- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E -- https://attack.mitre.org/techniques/T1547/014/ +- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E +- https://attack.mitre.org/techniques/T1547/014/ tags: analytic_story: - Windows Persistence Techniques @@ -44,15 +45,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 80 - # (impact * confidence)/100 risk_score: 64 context: - source:endpoint @@ -67,5 +67,4 @@ tags: type: user role: - Victim - - \ No newline at end of file + automated_detection_testing: passed From 766497b4ef77d200534e30001d7cb7f3518a7e2c Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 30 Sep 2021 09:33:47 +0200 Subject: [PATCH 14/58] privilege_escalation_persistence --- tests/endpoint/print_processor_registry_autostart.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index a40d16f744..8723a93d14 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -3,7 +3,7 @@ tests: - name: Print Processor Registry Autostart file: endpoint/print_processor_registry_autostart.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-21d' latest_time: 'now' attack_data: - file_name: sysmon.log From e6e1004bd4e507a5150d27ff2d98488aa9855159 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 30 Sep 2021 10:29:01 +0200 Subject: [PATCH 15/58] privilege_escalation_persistence --- .../disable_uac_remote_restriction.yml | 70 +++++++++++++++++++ .../time_provider_persistence_registry.yml | 69 ++++++++++++++++++ .../disable_uac_remote_restriction.test.yml | 12 ++++ ...ime_provider_persistence_registry.test.yml | 12 ++++ 4 files changed, 163 insertions(+) create mode 100644 detections/endpoint/disable_uac_remote_restriction.yml create mode 100644 detections/endpoint/time_provider_persistence_registry.yml create mode 100644 tests/endpoint/disable_uac_remote_restriction.test.yml create mode 100644 tests/endpoint/time_provider_persistence_registry.test.yml diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml new file mode 100644 index 0000000000..b4edf0f040 --- /dev/null +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -0,0 +1,70 @@ +name: Disable UAC Remote Restriction +id: 9928b732-210e-11ec-b65e-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. + This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. + This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `disable_uac_remote_restriction_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: admin may set this policy for non-critical machine. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Suspicious Windows Registry Activities + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1548.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + + \ No newline at end of file diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml new file mode 100644 index 0000000000..2361331d40 --- /dev/null +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -0,0 +1,69 @@ +name: Time Provider Persistence Registry +id: 5ba382c4-2105-11ec-8d8f-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. + This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. + This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `time_provider_persistence_registry_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://pentestlab.blog/2019/10/22/persistence-time-providers/ +- https://attack.mitre.org/techniques/T1547/003/ +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/disable_uac_remote_restriction.test.yml b/tests/endpoint/disable_uac_remote_restriction.test.yml new file mode 100644 index 0000000000..4adb6f2d25 --- /dev/null +++ b/tests/endpoint/disable_uac_remote_restriction.test.yml @@ -0,0 +1,12 @@ +name: Disable UAC Remote Restriction Unit Test +tests: +- name: Disable UAC Remote Restriction + file: endpoint/disable_uac_remote_restriction.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/time_provider_persistence_registry.test.yml b/tests/endpoint/time_provider_persistence_registry.test.yml new file mode 100644 index 0000000000..4de49c3411 --- /dev/null +++ b/tests/endpoint/time_provider_persistence_registry.test.yml @@ -0,0 +1,12 @@ +name: Time Provider Persistence Registry Unit Test +tests: +- name: Time Provider Persistence Registry + file: endpoint/time_provider_persistence_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 79ff8104e57ee00f96cebc37c4b57a31af435117 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 30 Sep 2021 08:49:13 +0000 Subject: [PATCH 16/58] Added detection testing service results inTime Provider Persistence Registry --- .../time_provider_persistence_registry.yml | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 2361331d40..fcf99f419e 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. - This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. - This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +description: This analytic is to detect a suspiciouos modification of time provider + registry for persistence and autostart. This technique can allow the attacker to + persist on the compromised host and autostart as soon as the machine boot up. This + TTP can be a good indicator of suspicious behavior since this registry is not commonly + modified by normal user or even an admin. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest Registry.user + Registry.registry_path Registry.registry_key_name Registry.registry_value_name | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -43,15 +43,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -66,4 +65,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From a7e7935b54e698164b9f694e6a91fe53637ea8e8 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 30 Sep 2021 08:55:04 +0000 Subject: [PATCH 17/58] Added detection testing service results inDisable UAC Remote Restriction --- .../disable_uac_remote_restriction.yml | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index b4edf0f040..80d564165f 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. - This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. - This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +description: This analytic is to detect a suspicious modification of registry to disable + UAC remote restriction. This technique was well documented in Microsoft page where + attacker may modify this registry value to bypassed UAC feature of windows host. + This is a good indicator that some tries to bypassed UAC to suspicious process or + gain privilege escalation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" + Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_uac_remote_restriction_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -25,7 +26,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: admin may set this policy for non-critical machine. references: -- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction tags: analytic_story: - Windows Defense Evasion Tactics @@ -42,16 +43,15 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name - Registry.registry_value_data security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -66,5 +66,4 @@ tags: type: user role: - Victim - - \ No newline at end of file + automated_detection_testing: passed From a2132aa445080ce562dbaf68d3844aebc9ddcffe Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 1 Oct 2021 10:25:56 +0200 Subject: [PATCH 18/58] privilege_escalation_persistence --- .../vbscript_execution_using_wscript_app.yml | 70 +++++++++++++++++++ ...cript_execution_using_wscript_app.test.yml | 12 ++++ 2 files changed, 82 insertions(+) create mode 100644 detections/endpoint/vbscript_execution_using_wscript_app.yml create mode 100644 tests/endpoint/vbscript_execution_using_wscript_app.test.yml diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml new file mode 100644 index 0000000000..ec5be43d3c --- /dev/null +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -0,0 +1,70 @@ +name: Vbscript Execution Using Wscript App +id: 35159940-228f-11ec-8a49-acde48001122 +version: 1 +date: '2021-10-01' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious wscript commandline to execute vbscript. + This technique was seen in several malware to execute malicious vbs file using wscript application. + commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or + even some av script emulation system. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name + = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process_id Processes.process + Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `vbscript_execution_using_wscript_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/369332/0/html +tags: + analytic_story: + - FIN7 + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ to execute vbsscript + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/vbscript_execution_using_wscript_app.test.yml b/tests/endpoint/vbscript_execution_using_wscript_app.test.yml new file mode 100644 index 0000000000..2139a83584 --- /dev/null +++ b/tests/endpoint/vbscript_execution_using_wscript_app.test.yml @@ -0,0 +1,12 @@ +name: Vbscript Execution Using Wscript App Unit Test +tests: +- name: Vbscript Execution Using Wscript App + file: endpoint/vbscript_execution_using_wscript_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 22809d6cf3a84f73e84221ddf797b08f373f4fd2 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 1 Oct 2021 08:47:12 +0000 Subject: [PATCH 19/58] Added detection testing service results inVbscript Execution Using Wscript App --- .../vbscript_execution_using_wscript_app.yml | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index ec5be43d3c..9abcbf230d 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -6,27 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious wscript commandline to execute vbscript. - This technique was seen in several malware to execute malicious vbs file using wscript application. - commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or - even some av script emulation system. +description: This analytic is to detect a suspicious wscript commandline to execute + vbscript. This technique was seen in several malware to execute malicious vbs file + using wscript application. commonly vbs script is associated to cscript process + and this can be a technique to evade process parent child detections or even some + av script emulation system. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process - Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `vbscript_execution_using_wscript_app_filter`' + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: -- https://www.joesandbox.com/analysis/369332/0/html +- https://www.joesandbox.com/analysis/369332/0/html tags: analytic_story: - FIN7 @@ -53,7 +51,6 @@ tags: security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 context: - Source:Endpoint @@ -67,4 +64,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From f4856f0d102e3c3e34f3827b9dc113df8c2a41ad Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 1 Oct 2021 10:54:47 +0200 Subject: [PATCH 20/58] privilege_escalation_persistence --- tests/endpoint/print_processor_registry_autostart.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index 8723a93d14..35d0f7985e 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -3,7 +3,7 @@ tests: - name: Print Processor Registry Autostart file: endpoint/print_processor_registry_autostart.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-21d' + earliest_time: '-365d' latest_time: 'now' attack_data: - file_name: sysmon.log From 1bd28e6bd323fba64aee950add52b93ef99b94c0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 1 Oct 2021 11:31:37 +0200 Subject: [PATCH 21/58] privilege_escalation_persistence --- detections/endpoint/print_processor_registry_autostart.yml | 2 +- tests/endpoint/print_processor_registry_autostart.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml index 144544ae94..dab28eac10 100644 --- a/detections/endpoint/print_processor_registry_autostart.yml +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -32,7 +32,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index 35d0f7985e..c32f529f1b 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-365d' latest_time: 'now' attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + - file_name: sysmon_print.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log source: WinEventLog:Microsoft-Windows-PrintService/Operational sourcetype: WinEventLog \ No newline at end of file From ff39ef4a931ca6f44c947e32925c55aaee81ad14 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Oct 2021 11:33:46 +0200 Subject: [PATCH 22/58] cars-mitre --- ...d_suspicious_spawned_by_script_process.yml | 65 +++++++++++++++++ .../endpoint/powershell_reflective_load.yml | 59 ++++++++++++++++ .../regsvr32_silent_param_dll_loading.yml | 69 +++++++++++++++++++ ...picious_spawned_by_script_process.test.yml | 12 ++++ .../powershell_reflective_load.test.yml | 12 ++++ ...regsvr32_silent_param_dll_loading.test.yml | 12 ++++ 6 files changed, 229 insertions(+) create mode 100644 detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml create mode 100644 detections/endpoint/powershell_reflective_load.yml create mode 100644 detections/endpoint/regsvr32_silent_param_dll_loading.yml create mode 100644 tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml create mode 100644 tests/endpoint/powershell_reflective_load.test.yml create mode 100644 tests/endpoint/regsvr32_silent_param_dll_loading.test.yml diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml new file mode 100644 index 0000000000..3366e7112d --- /dev/null +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -0,0 +1,65 @@ +name: MSBuild Suspicious Spawned By Script Process +id: 213b3148-24ea-11ec-93a2-acde48001122 +version: 1 +date: '2021-10-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious msbuild process by MS scripting process. + This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the + compromised host. This behavior is not common and can be a good indicator to start checking the content of the script that execute the said msbuild process. +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("wscript.exe", "cscript.exe") + AND `process_msbuild` by Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `msbuild_suspicious_spawned_by_script_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +tags: + analytic_story: + - Trusted Developer Utilities Proxy Execution MSBuild + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1127.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.original_file_name + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Stage:Execution + - Stage:Defense Evasion + message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml new file mode 100644 index 0000000000..8fa5537f7a --- /dev/null +++ b/detections/endpoint/powershell_reflective_load.yml @@ -0,0 +1,59 @@ +name: Powershell Reflective Load +id: 8aa0d0a2-24f4-11ec-b77a-acde48001122 +version: 1 +date: '2021-10-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious powershell loading a dll or executable using reflective load function. + this technique is commonly seen in file less malware where it download a file and directly load the downloaded file that are place in a stream memory to execute it. + this TTP is a good indicator to check the powershell that execute and what file or stream it execute. +search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_reflective_load_filter`' +how_to_implement: o successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: third party powershell may use this function to execute binary. +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +tags: + analytic_story: + - Malicious PowerShell + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage: Defense Evasion + message: a powershell that execute binary using reflective load in command $Message$ in $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_param_dll_loading.yml new file mode 100644 index 0000000000..1562c09624 --- /dev/null +++ b/detections/endpoint/regsvr32_silent_param_dll_loading.yml @@ -0,0 +1,69 @@ +name: Regsvr32 Silent Param Dll Loading +id: f421c250-24e7-11ec-bc43-acde48001122 +version: 1 +date: '2021-10-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. + This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. + This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" + by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `regsvr32_silent_param_dll_loading_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: other third part application may used this parameter but not so common in base windows environment +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +tags: + analytic_story: + - Suspicious Regsvr32 Activity + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.010 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: regsvr32 process with $process$ commandline in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml new file mode 100644 index 0000000000..4f5a6f717d --- /dev/null +++ b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml @@ -0,0 +1,12 @@ +name: MSBuild Suspicious Spawned By Script Process Unit Test +tests: +- name: MSBuild Suspicious Spawned By Script Process + file: endpoint/msbuild_suspicious_spawned_by_script_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml new file mode 100644 index 0000000000..36020cf594 --- /dev/null +++ b/tests/endpoint/powershell_reflective_load.test.yml @@ -0,0 +1,12 @@ +name: Powershell Reflective Load Unit Test +tests: +- name: Powershell Reflective Load + file: endpoint/powershell_reflective_load.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: powershell.log + data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml b/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml new file mode 100644 index 0000000000..a28aa579c6 --- /dev/null +++ b/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml @@ -0,0 +1,12 @@ +name: Regsvr32 Silent Param Dll Loading Unit Test +tests: +- name: Regsvr32 Silent Param Dll Loading + file: endpoint/regsvr32_silent_param_dll_loading.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 31f5669d11c156a60209c6e7db2896b50862db28 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Oct 2021 11:36:50 +0200 Subject: [PATCH 23/58] cars-mitre --- tests/endpoint/powershell_reflective_load.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml index 36020cf594..765708d510 100644 --- a/tests/endpoint/powershell_reflective_load.test.yml +++ b/tests/endpoint/powershell_reflective_load.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: powershell.log - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log source: WinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: WinEventLog \ No newline at end of file From 2f32f733a8a8ea459ba1030b1486d717a3326a65 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 4 Oct 2021 10:13:07 +0000 Subject: [PATCH 24/58] Added detection testing service results inRegsvr32 Silent Param Dll Loading --- .../regsvr32_silent_param_dll_loading.yml | 33 ++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_param_dll_loading.yml index 1562c09624..c9d0d3b0cc 100644 --- a/detections/endpoint/regsvr32_silent_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_param_dll_loading.yml @@ -6,23 +6,26 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. - This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. - This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +description: This analytic is to detect a loading of dll using regsvr32 application + with silent parameter and dllinstall execution. This technique was seen in several + RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised + machine. This TTP may executed by normal 3rd party application so it is better to + pivot the parent process, parent commandline and commandline of the file that execute + this regsvr32. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" - by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `regsvr32_silent_param_dll_loading_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe + Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process + Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: other third part application may used this parameter but not so common in base windows environment + Sysmon TA. +known_false_positives: other third part application may used this parameter but not + so common in base windows environment references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: analytic_story: - Suspicious Regsvr32 Activity @@ -52,9 +55,8 @@ tags: security_domain: endpoint impact: 60 confidence: 60 - # (impact * confidence)/100 risk_score: 36 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: regsvr32 process with $process$ commandline in $dest$ @@ -66,4 +68,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 9007d5bae95e31d6eaaa675fc874ab8b2c5753f9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Oct 2021 13:17:04 +0200 Subject: [PATCH 25/58] privilege_escalation_persistence --- .../endpoint/msbuild_suspicious_spawned_by_script_process.yml | 2 +- detections/endpoint/powershell_reflective_load.yml | 2 +- .../msbuild_suspicious_spawned_by_script_process.test.yml | 2 +- tests/endpoint/powershell_reflective_load.test.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index 3366e7112d..b7694505f9 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml index 8fa5537f7a..688a3709f1 100644 --- a/detections/endpoint/powershell_reflective_load.yml +++ b/detections/endpoint/powershell_reflective_load.yml @@ -24,7 +24,7 @@ tags: analytic_story: - Malicious PowerShell dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml index 4f5a6f717d..4407f84aa1 100644 --- a/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml +++ b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml index 765708d510..167a524ebc 100644 --- a/tests/endpoint/powershell_reflective_load.test.yml +++ b/tests/endpoint/powershell_reflective_load.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log source: WinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: WinEventLog \ No newline at end of file From f89631895505b402438e9a550881647ccd845626 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 4 Oct 2021 11:41:23 +0000 Subject: [PATCH 26/58] Added detection testing service results inMSBuild Suspicious Spawned By Script Process --- ...d_suspicious_spawned_by_script_process.yml | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index b7694505f9..a8165b8d65 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -6,24 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious msbuild process by MS scripting process. - This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the - compromised host. This behavior is not common and can be a good indicator to start checking the content of the script that execute the said msbuild process. +description: This analytic is to detect a suspicious msbuild process by MS scripting + process. This behavior or event are commonly seen and used by malware or adversaries + to execute malicious msbuild process using malicious script in the compromised host. + This behavior is not common and can be a good indicator to start checking the content + of the script that execute the said msbuild process. search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("wscript.exe", "cscript.exe") - AND `process_msbuild` by Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `msbuild_suspicious_spawned_by_script_process_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process + Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild @@ -39,21 +40,21 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.original_file_name - - Processes.user + - Processes.dest + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.original_file_name + - Processes.user security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 context: - Stage:Execution - Stage:Defense Evasion - message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ + message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed + by $user$ observable: - name: dest type: Endpoint @@ -62,4 +63,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 80ceb52382a9f69f6f18e8ba19f910ebf2c9eb52 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 4 Oct 2021 11:42:27 +0000 Subject: [PATCH 27/58] Added detection testing service results inPowershell Reflective Load --- .../endpoint/powershell_reflective_load.yml | 36 ++++++++++--------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml index 688a3709f1..ae5a966426 100644 --- a/detections/endpoint/powershell_reflective_load.yml +++ b/detections/endpoint/powershell_reflective_load.yml @@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious powershell loading a dll or executable using reflective load function. - this technique is commonly seen in file less malware where it download a file and directly load the downloaded file that are place in a stream memory to execute it. - this TTP is a good indicator to check the powershell that execute and what file or stream it execute. -search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `powershell_reflective_load_filter`' +description: This analytic is to detect a suspicious powershell loading a dll or executable + using reflective load function. this technique is commonly seen in file less malware + where it download a file and directly load the downloaded file that are place in + a stream memory to execute it. this TTP is a good indicator to check the powershell + that execute and what file or stream it execute. +search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" | stats + count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_reflective_load_filter`' how_to_implement: o successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: third party powershell may use this function to execute binary. references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: analytic_story: - Malicious PowerShell @@ -35,19 +36,19 @@ tags: - Splunk Cloud required_fields: - _time - - EventCode - - Message - - ComputerName - - User + - EventCode + - Message + - ComputerName + - User security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 - context: + context: - source:endpoint - stage: Defense Evasion - message: a powershell that execute binary using reflective load in command $Message$ in $ComputerName$ + message: a powershell that execute binary using reflective load in command $Message$ + in $ComputerName$ observable: - name: ComputerName type: Hostname @@ -56,4 +57,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 82633e151ac3fe905f82113ebc64fa1a17bddd34 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 5 Oct 2021 11:56:48 +0200 Subject: [PATCH 28/58] privilege_escalation_persistence --- ...le_security_logs_using_minint_registry.yml | 61 +++++++++++++++++ ...le_wdigest_uselogoncredential_registry.yml | 65 +++++++++++++++++++ .../endpoint/rundll32_shimcache_flush.yml | 65 +++++++++++++++++++ .../endpoint/suspicious_copy_on_system32.yml | 64 ++++++++++++++++++ macros/process_copy.yml | 3 + ...curity_logs_using_minint_registry.test.yml | 12 ++++ ...igest_uselogoncredential_registry.test.yml | 12 ++++ .../rundll32_shimcache_flush.test.yml | 12 ++++ .../suspicious_copy_on_system32.test.yml | 12 ++++ 9 files changed, 306 insertions(+) create mode 100644 detections/endpoint/disable_security_logs_using_minint_registry.yml create mode 100644 detections/endpoint/enable_wdigest_uselogoncredential_registry.yml create mode 100644 detections/endpoint/rundll32_shimcache_flush.yml create mode 100644 detections/endpoint/suspicious_copy_on_system32.yml create mode 100644 macros/process_copy.yml create mode 100644 tests/endpoint/disable_security_logs_using_minint_registry.test.yml create mode 100644 tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml create mode 100644 tests/endpoint/rundll32_shimcache_flush.test.yml create mode 100644 tests/endpoint/suspicious_copy_on_system32.test.yml diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml new file mode 100644 index 0000000000..b5f50ac0b3 --- /dev/null +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -0,0 +1,61 @@ +name: Disable Security Logs Using MiniNt Registry +id: 39ebdc68-25b9-11ec-aec7-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: THis analytic is to detect a suspicious registry modification to disable security audit logs. + This technique was shared by a researcher to disable Security logs of windows by adding this registry. + The Windows will think it is WinPE and will not log any event to the Security Log +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path="*\\Control\\MiniNt\\*" + by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `disable_security_logs_using_minint_registry_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://twitter.com/0gtweet/status/1182516740955226112 +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: wdigest registry $registry_path$ was added in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml new file mode 100644 index 0000000000..378b82d273 --- /dev/null +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -0,0 +1,65 @@ +name: Enable WDigest UseLogonCredential Registry +id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. + This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. + This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" + Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 + by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `enable_wdigest_uselogoncredential_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html +tags: + analytic_story: + - Credential Dumping + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: wdigest registry $registry_path$ was modified in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml new file mode 100644 index 0000000000..5b2bc12cb0 --- /dev/null +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -0,0 +1,65 @@ +name: Rundll32 Shimcache Flush +id: a913718a-25b6-11ec-96d3-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious rundll32 commandline to clear shim cache. + This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. + This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_shimcache_flush_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://blueteamops.medium.com/shimcache-flush-89daff28d15e +tags: + analytic_story: + - Unusual Processes + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Stage:Execution + - Stage:Defense Evasion + message: rundll32 process execute $process$ to clear shim cache in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml new file mode 100644 index 0000000000..8be22cd551 --- /dev/null +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -0,0 +1,64 @@ +name: Suspicious Copy on System32 +id: ce633e56-25b2-11ec-9e76-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: this analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. + This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. + this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: every user may do this event but very un-ussual. +references: +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +tags: + analytic_story: + - Unusual Processes + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1036.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Stage:Execution + - Stage:Defense Evasion + message: execution of copy exe to copy file from $process$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/macros/process_copy.yml b/macros/process_copy.yml new file mode 100644 index 0000000000..06d1c3b28f --- /dev/null +++ b/macros/process_copy.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_copy \ No newline at end of file diff --git a/tests/endpoint/disable_security_logs_using_minint_registry.test.yml b/tests/endpoint/disable_security_logs_using_minint_registry.test.yml new file mode 100644 index 0000000000..b54ddced69 --- /dev/null +++ b/tests/endpoint/disable_security_logs_using_minint_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable Security Logs Using MiniNt Registry Unit Test +tests: +- name: Disable Security Logs Using MiniNt Registry + file: endpoint/disable_security_logs_using_minint_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml b/tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml new file mode 100644 index 0000000000..735c79499f --- /dev/null +++ b/tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml @@ -0,0 +1,12 @@ +name: Enable WDigest UseLogonCredential Registry Unit Test +tests: +- name: Enable WDigest UseLogonCredential Registry + file: endpoint/enable_wdigest_uselogoncredential_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_shimcache_flush.test.yml b/tests/endpoint/rundll32_shimcache_flush.test.yml new file mode 100644 index 0000000000..2a416381a6 --- /dev/null +++ b/tests/endpoint/rundll32_shimcache_flush.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 Shimcache Flush Unit Test +tests: +- name: Rundll32 Shimcache Flush + file: endpoint/rundll32_shimcache_flush.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_copy_on_system32.test.yml b/tests/endpoint/suspicious_copy_on_system32.test.yml new file mode 100644 index 0000000000..918c57dd1b --- /dev/null +++ b/tests/endpoint/suspicious_copy_on_system32.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Copy on System32 Unit Test +tests: +- name: Suspicious Copy on System32 + file: endpoint/suspicious_copy_on_system32.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 1304e38f5ad0a188ca40e2cf7ab191380a22eb86 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 11:50:49 +0000 Subject: [PATCH 29/58] Added detection testing service results inSuspicious Copy on System32 --- .../endpoint/suspicious_copy_on_system32.yml | 41 ++++++++++--------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 8be22cd551..fce0614870 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -6,22 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. - This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. - this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` +description: this analytic is to detect a suspicious copy of file from systemroot + folder of the windows OS. This technique is commonly used by APT or other malware + as part of execution (LOLBIN) to run its malicious code using the available legitimate + tool in OS. this type of event may seen or may execute of normal user in some instance + but this is really a anomaly that needs to be check within the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", + "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: every user may do this event but very un-ussual. references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 tags: analytic_story: - Unusual Processes @@ -37,17 +40,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 90 - # (impact * confidence)/100 risk_score: 63 context: - Stage:Execution @@ -61,4 +63,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 457fc3c73ae361878c7f523274e65c26a24006d4 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 12:11:12 +0000 Subject: [PATCH 30/58] Added detection testing service results inRundll32 Shimcache Flush --- .../endpoint/rundll32_shimcache_flush.yml | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index 5b2bc12cb0..fccda13479 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious rundll32 commandline to clear shim cache. - This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. - This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic is to detect a suspicious rundll32 commandline to clear + shim cache. This technique is a anti-forensic technique to clear the cache taht + are one important artifacts in terms of digital forensic during attacks or incident. + This TTP is a good indicator that someone tries to evade some tools and clear foothold + on the machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process + = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://blueteamops.medium.com/shimcache-flush-89daff28d15e +- https://blueteamops.medium.com/shimcache-flush-89daff28d15e tags: analytic_story: - Unusual Processes @@ -38,17 +39,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Stage:Execution @@ -62,4 +62,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From ca610d934fd150da49d929666827cb5234a3bd38 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 13:07:19 +0000 Subject: [PATCH 31/58] Added detection testing service results inEnable WDigest UseLogonCredential Registry --- ...le_wdigest_uselogoncredential_registry.yml | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 378b82d273..d72f368b88 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. - This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. - This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" - Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 - by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `enable_wdigest_uselogoncredential_registry_filter`' +description: This analytic is to detect a suspicious registry modification to enable + plain text credential feature of windows. This technique was used by several malware + and also by mimikatz to be able to dumpe the a plain text credential to the compromised + or target host. This TTP is really a good indicator that someone wants to dump the + crendential of the host so it must be a good pivot for credential dumping techniques. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" + Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data + = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name + Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html +- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html tags: analytic_story: - Credential Dumping @@ -39,21 +40,20 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Credential Access - message: wdigest registry $registry_path$ was modified in $dest$ + message: wdigest registry $registry_path$ was modified in $dest$ observable: - name: user type: User @@ -62,4 +62,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 9079efb69212895a982fcfee5adb56bd40a6999e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 14:00:35 +0000 Subject: [PATCH 32/58] Added detection testing service results inDisable Security Logs Using MiniNt Registry --- ...le_security_logs_using_minint_registry.yml | 37 +++++++++---------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index b5f50ac0b3..11f3ccaf5a 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -6,19 +6,19 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: THis analytic is to detect a suspicious registry modification to disable security audit logs. - This technique was shared by a researcher to disable Security logs of windows by adding this registry. - The Windows will think it is WinPE and will not log any event to the Security Log -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path="*\\Control\\MiniNt\\*" - by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `disable_security_logs_using_minint_registry_filter`' +description: THis analytic is to detect a suspicious registry modification to disable + security audit logs. This technique was shared by a researcher to disable Security + logs of windows by adding this registry. The Windows will think it is WinPE and + will not log any event to the Security Log +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" + by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name + Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: -- https://twitter.com/0gtweet/status/1182516740955226112 +- https://twitter.com/0gtweet/status/1182516740955226112 tags: analytic_story: - Windows Defense Evasion Tactics @@ -34,21 +34,20 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: wdigest registry $registry_path$ was added in $dest$ + message: wdigest registry $registry_path$ was added in $dest$ observable: - name: user type: User @@ -58,4 +57,4 @@ tags: type: Hostname role: - Victim - \ No newline at end of file + automated_detection_testing: passed From b802809a35603848852e5c6908e9a0ecacc74f26 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 5 Oct 2021 14:31:17 -0600 Subject: [PATCH 33/58] Tomorrow Never Haags Malicious InProcServer32 Modification Process Writing DynamicWrapperX Winhlp32 Spawning a Process --- .../malicious_inprocserver32_modification.yml | 72 +++++++++++++++++ .../process_writing_dynamicwrapperx.yml | 79 +++++++++++++++++++ .../endpoint/winhlp32_spawning_a_process.yml | 74 +++++++++++++++++ 3 files changed, 225 insertions(+) create mode 100644 detections/endpoint/malicious_inprocserver32_modification.yml create mode 100644 detections/endpoint/process_writing_dynamicwrapperx.yml create mode 100644 detections/endpoint/winhlp32_spawning_a_process.yml diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml new file mode 100644 index 0000000000..3110c37214 --- /dev/null +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -0,0 +1,72 @@ +name: Malicious InProcServer32 Modification +id: 127c8d08-25ff-11ec-9223-acde48001122 +version: 1 +date: '2021-10-05' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. + Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\Software\Classes\CLSID or HKCU\Software\Classes\CLSID). Behind the implementation of a COM class is the ‘server’ (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). + During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. + search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time Processes.process_id Processes.process_name + Processes.dest Processes.process_guid Processes.user + | `drop_dm_object_name(Processes)` + | join process_guid + [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest Registry.process_guid Registry.user + | `drop_dm_object_name(Registry)` + | fields _time dest registry_path registry_key_name + registry_value_name process_name process_path process process_guid user] + | stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name + registry_value_name user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `malicious_inprocserver32_modification_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. +references: + - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ + - https://tria.ge/210929-ap75vsddan + - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +tags: + analytic_story: + - Suspicious Regsvr32 Activity + - Remcos + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.010 + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time +- dest +- process_name +- registry_path +- registry_key_name +- registry_value_name +- user + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml new file mode 100644 index 0000000000..f154158228 --- /dev/null +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -0,0 +1,79 @@ +name: Process Writing DynamicWrapperX +id: b0a078e4-2601-11ec-9aec-acde48001122 +version: 1 +date: '2021-10-05' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. + During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time Processes.process_id Processes.process_name + Processes.dest Processes.process_guid Processes.user + | `drop_dm_object_name(Processes)` + | join process_guid + [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="dynwrapx.dll" + by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.process_guid Filesystem.user + | `drop_dm_object_name(Filesystem)` + | fields _time process_guid file_path file_name file_create_time user dest process_name] + | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `process_writing_dynamicwrapperx_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. +references: + - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ + - https://www.script-coding.com/dynwrapx_eng.html + - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ + - https://tria.ge/210929-ap75vsddan + - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +tags: + analytic_story: + - Remcos + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059 + - T1559.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - process_name + - process_guid + - file_name + - file_path + - file_create_time user + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml new file mode 100644 index 0000000000..f4d38e56a1 --- /dev/null +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -0,0 +1,74 @@ +name: Winhlp32 Spawning a Process +id: d17dae9e-2618-11ec-b9f5-acde48001122 +version: 1 +date: '2021-10-05' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. + Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. + This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. + During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed. +references: + - https://www.exploit-db.com/exploits/16541 +tags: + analytic_story: + - Remcos + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file From 05be27e16a478123ba188bf069185e7b0c02d893 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 5 Oct 2021 14:33:23 -0600 Subject: [PATCH 34/58] fixes --- .../malicious_inprocserver32_modification.yml | 12 ++++++------ .../endpoint/process_writing_dynamicwrapperx.yml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index 3110c37214..8ce83ad834 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -46,12 +46,12 @@ tags: - Splunk Cloud required_fields: - _time -- dest -- process_name -- registry_path -- registry_key_name -- registry_value_name -- user + - dest + - process_name + - registry_path + - registry_key_name + - registry_value_name + - user security_domain: endpoint impact: 80 confidence: 100 diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index f154158228..6f0802038a 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -59,7 +59,7 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll + message: An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. observable: - name: user type: User From 8daecc268c765f6782fbeb5cd3817e620f239a6a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 5 Oct 2021 14:54:17 -0600 Subject: [PATCH 35/58] test files --- detections/endpoint/winhlp32_spawning_a_process.yml | 2 ++ .../malicious_inprocserver32_modification.test.yml | 12 ++++++++++++ .../process_writing_dynamicwrapperx.test.yml | 12 ++++++++++++ tests/endpoint/winhlp32_spawning_a_process.test.yml | 12 ++++++++++++ 4 files changed, 38 insertions(+) create mode 100644 tests/endpoint/malicious_inprocserver32_modification.test.yml create mode 100644 tests/endpoint/process_writing_dynamicwrapperx.test.yml create mode 100644 tests/endpoint/winhlp32_spawning_a_process.test.yml diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index f4d38e56a1..84f2036943 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -21,6 +21,8 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed. references: - https://www.exploit-db.com/exploits/16541 + - https://tria.ge/210929-ap75vsddan + - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 tags: analytic_story: - Remcos diff --git a/tests/endpoint/malicious_inprocserver32_modification.test.yml b/tests/endpoint/malicious_inprocserver32_modification.test.yml new file mode 100644 index 0000000000..dd97ac887f --- /dev/null +++ b/tests/endpoint/malicious_inprocserver32_modification.test.yml @@ -0,0 +1,12 @@ +name: Malicious InProcServer32 Modification Unit Test +tests: +- name: Malicious InProcServer32 Modification + file: endpoint/malicious_inprocserver32_modification.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/process_writing_dynamicwrapperx.test.yml b/tests/endpoint/process_writing_dynamicwrapperx.test.yml new file mode 100644 index 0000000000..9b6cdead63 --- /dev/null +++ b/tests/endpoint/process_writing_dynamicwrapperx.test.yml @@ -0,0 +1,12 @@ +name: Process Writing DynamicWrapperX Unit Test +tests: +- name: Process Writing DynamicWrapperX + file: endpoint/process_writing_dynamicwrapperx.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/winhlp32_spawning_a_process.test.yml b/tests/endpoint/winhlp32_spawning_a_process.test.yml new file mode 100644 index 0000000000..ff803d49aa --- /dev/null +++ b/tests/endpoint/winhlp32_spawning_a_process.test.yml @@ -0,0 +1,12 @@ +name: Winhlp32 Spawning a Process Unit Test +tests: +- name: Winhlp32 Spawning a Process + file: endpoint/winhlp32_spawning_a_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From fe02d867a9659881f5e2985e3f7091c45ad9b918 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 5 Oct 2021 14:59:00 -0600 Subject: [PATCH 36/58] fix --- .../endpoint/malicious_inprocserver32_modification.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index 8ce83ad834..bd76570bd4 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -6,10 +6,10 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. - Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\Software\Classes\CLSID or HKCU\Software\Classes\CLSID). Behind the implementation of a COM class is the ‘server’ (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). - During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. - search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes +description: 'The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. + Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). + During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process.' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` From 8181c7d15afb2750d263aa95eb6dc8df8f2ba010 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 5 Oct 2021 15:02:46 -0600 Subject: [PATCH 37/58] Update malicious_inprocserver32_modification.yml --- detections/endpoint/malicious_inprocserver32_modification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index bd76570bd4..f28a776657 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -25,7 +25,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. +known_false_positives: False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. references: - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ - https://tria.ge/210929-ap75vsddan From 8cd4c56855194b467129df496cf315e1bd79d99c Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 21:23:41 +0000 Subject: [PATCH 38/58] Added detection testing service results inMalicious InProcServer32 Modification --- .../malicious_inprocserver32_modification.yml | 76 +++++++++++-------- 1 file changed, 45 insertions(+), 31 deletions(-) diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index f28a776657..7e935088fb 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -1,40 +1,53 @@ name: Malicious InProcServer32 Modification -id: 127c8d08-25ff-11ec-9223-acde48001122 +id: 127c8d08-25ff-11ec-9223-acde48001122 version: 1 date: '2021-10-05' author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. - Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). - During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process.' +description: The following analytic identifies a process modifying the registry with + a known malicious CLSID under InProcServer32. Most COM classes are registered with + the operating system and are identified by a GUID that represents the Class Identifier + (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind + the implementation of a COM class is the server (some binary) that is referenced + within registry keys under the CLSID. The LocalServer32 key represents a path to + an executable (exe) implementation, and the InprocServer32 key represents a path + to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel + processes for suspicious activity. Pivot on the process GUID to see the full timeline + of events. Analyze the value and look for file modifications. Being this is looking + for inprocserver32, a DLL found in the value will most likely be loaded by a parallel + process. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time Processes.process_id Processes.process_name - Processes.dest Processes.process_guid Processes.user - | `drop_dm_object_name(Processes)` - | join process_guid - [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest Registry.process_guid Registry.user - | `drop_dm_object_name(Registry)` - | fields _time dest registry_path registry_key_name - registry_value_name process_name process_path process process_guid user] - | stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name - registry_value_name user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `malicious_inprocserver32_modification_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. + by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid + Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats + `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= + "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by + Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest + Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` | fields _time + dest registry_path registry_key_name registry_value_name process_name process_path + process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime + by dest, process_name registry_path registry_key_name registry_value_name user | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited, filter as needed. In our + test case, Remcos used regsvr32.exe to modify the registry. It may be required, + dependent upon the EDR tool producing registry events, to remove (Default) from + the command-line. references: - - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ - - https://tria.ge/210929-ap75vsddan - - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 tags: analytic_story: - Suspicious Regsvr32 Activity - Remcos - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -47,20 +60,20 @@ tags: required_fields: - _time - dest - - process_name - - registry_path + - process_name + - registry_path - registry_key_name - - registry_value_name - - user + - registry_value_name + - user security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. + message: The $process_name$ was identified on endpoint $dest$ modifying the registry + with a known malicious clsid under InProcServer32. observable: - name: dest type: Hostname @@ -69,4 +82,5 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + automated_detection_testing: passed From 87d7b8a114448aa9eb6715e6cba79fdb79cfc37b Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 21:27:14 +0000 Subject: [PATCH 39/58] Added detection testing service results inWinhlp32 Spawning a Process --- .../endpoint/winhlp32_spawning_a_process.yml | 58 +++++++++++-------- 1 file changed, 35 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 84f2036943..b549589720 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -6,27 +6,38 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: 'The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. - Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. - This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. - During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze.' +description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, + spawning a child process that loads a file out of appdata, programdata, or temp. + Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added + to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the + ".hlp" file name extension. This particular instance is related to a Remcos sample + where dynwrapx.dll is added to the registry under inprocserver32, and later module + loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During + triage, review parallel processes to identify further suspicious behavior. Review + module loads for unsuspecting unsigned modules. Capture any file modifications and + analyze. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed. + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe + Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives should be limited as winhlp32.exe is typically + not used with the latest flavors of Windows OS. However, filter as needed. references: - - https://www.exploit-db.com/exploits/16541 - - https://tria.ge/210929-ap75vsddan - - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +- https://www.exploit-db.com/exploits/16541 +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 tags: analytic_story: - Remcos - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -39,11 +50,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path @@ -51,12 +62,12 @@ tags: security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$, and is not typical activity for this process. observable: - name: user type: User @@ -73,4 +84,5 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + automated_detection_testing: passed From fa190b9700dd1575a8219c76f7e91315d534ed27 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 21:28:04 +0000 Subject: [PATCH 40/58] Added detection testing service results inProcess Writing DynamicWrapperX --- .../process_writing_dynamicwrapperx.yml | 69 +++++++++++-------- 1 file changed, 40 insertions(+), 29 deletions(-) diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index 6f0802038a..98807996a2 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -6,34 +6,44 @@ author: Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. - During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +description: DynamicWrapperX is an ActiveX component that can be used in a script + to call Windows API functions, but it requires the dynwrapx.dll to be installed + and registered. With that, a binary writing dynwrapx.dll to disk and registering + it into the registry is highly suspect. Why is it needed? In most malicious instances, + it will be written to disk at a non-standard location. During triage, review parallel + processes and pivot on the process_guid. Review the registry for any suspicious + modifications meant to load dynwrapx.dll. Identify any suspicious module loads of + dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time Processes.process_id Processes.process_name - Processes.dest Processes.process_guid Processes.user - | `drop_dm_object_name(Processes)` - | join process_guid - [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="dynwrapx.dll" - by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path Filesystem.process_guid Filesystem.user - | `drop_dm_object_name(Filesystem)` - | fields _time process_guid file_path file_name file_create_time user dest process_name] - | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid + Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats + `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where + Filesystem.file_name="dynwrapx.dll" by _time Filesystem.dest Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user + | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name + file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) + as lastTime by dest process_name process_guid file_name file_path file_create_time + user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_writing_dynamicwrapperx_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` + node. In addition, confirm the latest CIM App 4.20 or higher is installed and the + latest TA for the endpoint product. +known_false_positives: False positives should be limited, however it is possible to + filter by Processes.process_name and specific processes (ex. wscript.exe). Filter + as needed. references: - - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ - - https://www.script-coding.com/dynwrapx_eng.html - - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ - - https://tria.ge/210929-ap75vsddan - - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ +- https://www.script-coding.com/dynwrapx_eng.html +- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ +- https://tria.ge/210929-ap75vsddan +- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 tags: analytic_story: - Remcos - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,21 +55,21 @@ tags: - Splunk Cloud required_fields: - _time - - dest - - process_name - - process_guid - - file_name + - dest + - process_name + - process_guid + - file_name - file_path - file_create_time user security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. + message: An instance of $process_name$ was identified on endpoint $dest$ downloading + the DynamicWrapperX dll. observable: - name: user type: User @@ -76,4 +86,5 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + automated_detection_testing: passed From fb296c850889f1dffcc176019952ca93d017b3b6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 6 Oct 2021 11:15:47 +0200 Subject: [PATCH 41/58] privilege_escalation_persistence --- .../sdelete_application_execution.yml | 68 ++++++++++++++++++ ...pt_or_cscript_suspicious_child_process.yml | 72 +++++++++++++++++++ macros/process_sdelete.yml | 3 + .../sdelete_application_execution.test.yml | 12 ++++ ..._cscript_suspicious_child_process.test.yml | 12 ++++ 5 files changed, 167 insertions(+) create mode 100644 detections/endpoint/sdelete_application_execution.yml create mode 100644 detections/endpoint/wscript_or_cscript_suspicious_child_process.yml create mode 100644 macros/process_sdelete.yml create mode 100644 tests/endpoint/sdelete_application_execution.test.yml create mode 100644 tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml new file mode 100644 index 0000000000..0048240c1a --- /dev/null +++ b/detections/endpoint/sdelete_application_execution.yml @@ -0,0 +1,68 @@ +name: Sdelete Application Execution +id: 31702fc0-2682-11ec-85c3-acde48001122 +version: 1 +date: '2021-10-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect the execution of sdelete.exe application sysinternal tools. + This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. + This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user + execute this application which is not a common practice. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_sdelete` by Processes.process_name Processes.original_file_name + Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `sdelete_application_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: user may execute and use this application +references: +- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ +tags: + analytic_story: + - Masquerading - Rename System Utilities + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + - T1070.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: sdelete process $process_name$ executed in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml new file mode 100644 index 0000000000..9138639a44 --- /dev/null +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -0,0 +1,72 @@ +name: Wscript Or Cscript Suspicious Child Process +id: 1f35e1da-267b-11ec-90a9-acde48001122 +version: 1 +date: '2021-10-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious spawned process by wscript or cscript process. + This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended + process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list + of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") + Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wscript_or_cscript_suspicious_child_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: user may create vbs or js script that use several tool as part of its execution. +references: +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +tags: + analytic_story: + - FIN7 + - Remcos + - Unusual Processes + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + - T1543 + - T1134.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: wscript or cscript parent process spawned $process_name$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + \ No newline at end of file diff --git a/macros/process_sdelete.yml b/macros/process_sdelete.yml new file mode 100644 index 0000000000..2a5bc306d6 --- /dev/null +++ b/macros/process_sdelete.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_sdelete \ No newline at end of file diff --git a/tests/endpoint/sdelete_application_execution.test.yml b/tests/endpoint/sdelete_application_execution.test.yml new file mode 100644 index 0000000000..e86bfc34a9 --- /dev/null +++ b/tests/endpoint/sdelete_application_execution.test.yml @@ -0,0 +1,12 @@ +name: Sdelete Application Execution Unit Test +tests: +- name: Sdelete Application Execution + file: endpoint/sdelete_application_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml b/tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml new file mode 100644 index 0000000000..9b99129f6d --- /dev/null +++ b/tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml @@ -0,0 +1,12 @@ +name: Wscript Or Cscript Suspicious Child Process Unit Test +tests: +- name: Wscript Or Cscript Suspicious Child Process + file: endpoint/wscript_or_cscript_suspicious_child_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From b910a0565043c17360f8bd054a23ecfa38aae085 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 6 Oct 2021 09:52:34 +0000 Subject: [PATCH 42/58] Added detection testing service results inWscript Or Cscript Suspicious Child Process --- ...pt_or_cscript_suspicious_child_process.yml | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 9138639a44..b1783cbfbb 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -6,26 +6,28 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious spawned process by wscript or cscript process. - This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended - process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list - of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +description: This analytic is to detect a suspicious spawned process by wscript or + cscript process. This technique was a common technique used by adversaries and malware + to execute different LOLBIN, other script like powershell or create a suspended + process to inject its code as a defense evasion. This TTP may detect some normal + script that using several application tool that are in the list of the child process + it detects but a good pivot and indicator that a script is may execute suspicious + code. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") - Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wscript_or_cscript_suspicious_child_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: user may create vbs or js script that use several tool as part of its execution. + Sysmon TA. +known_false_positives: user may create vbs or js script that use several tool as part + of its execution. references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 tags: analytic_story: - FIN7 @@ -69,4 +71,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From ba99c4cee80cff8d93d2930098f903b99be5fa6d Mon Sep 17 00:00:00 2001 From: root Date: Wed, 6 Oct 2021 10:45:31 +0000 Subject: [PATCH 43/58] Added detection testing service results inSdelete Application Execution --- .../sdelete_application_execution.yml | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 0048240c1a..02de52dbf9 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -6,26 +6,26 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect the execution of sdelete.exe application sysinternal tools. - This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. - This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user - execute this application which is not a common practice. +description: This analytic is to detect the execution of sdelete.exe application sysinternal + tools. This tool is one of the most use tool of malware and adversaries to remove + or clear their tracks and artifact in the targetted host. This tool is designed + to delete securely a file in file system that remove the forensic evidence on the + machine. A good TTP query to check why user execute this application which is not + a common practice. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_sdelete` by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdelete_application_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: user may execute and use this application references: -- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ +- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ tags: analytic_story: - Masquerading - Rename System Utilities @@ -65,4 +65,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 1e18798bb75b0c1cd9e8c360b0814a6c22391f7f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 6 Oct 2021 10:01:44 -0600 Subject: [PATCH 44/58] Update process_writing_dynamicwrapperx.yml --- detections/endpoint/process_writing_dynamicwrapperx.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index 98807996a2..2acf492064 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -32,7 +32,7 @@ how_to_implement: To successfully implement this search you need to be ingesting latest TA for the endpoint product. known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter - as needed. + as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default). references: - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ - https://www.script-coding.com/dynwrapx_eng.html From c059b05588b9d8b353ad086c0ef6eb183ab4c5ed Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 6 Oct 2021 15:39:16 -0700 Subject: [PATCH 45/58] Update process_writing_dynamicwrapperx.yml minor --- detections/endpoint/process_writing_dynamicwrapperx.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index 2acf492064..bea147733f 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -75,14 +75,10 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - name: process_name type: Process role: From 87e17c35055da42141f698151e2aa682c6b0b62f Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 7 Oct 2021 14:53:56 +0200 Subject: [PATCH 46/58] privilege_escalation_persistence --- detections/endpoint/etw_registry_disabled.yml | 65 +++++++++++++++++++ tests/endpoint/etw_registry_disabled.test.yml | 12 ++++ 2 files changed, 77 insertions(+) create mode 100644 detections/endpoint/etw_registry_disabled.yml create mode 100644 tests/endpoint/etw_registry_disabled.test.yml diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml new file mode 100644 index 0000000000..55bd67bb4e --- /dev/null +++ b/detections/endpoint/etw_registry_disabled.yml @@ -0,0 +1,65 @@ +name: ETW Registry Disabled +id: 8ed523ac-276b-11ec-ac39-acde48001122 +version: 1 +date: '2021-10-07' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a registry modification to disable ETW feature of windows. + This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") + Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `etw_registry_disabled_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.006 + - T1127 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.registry_value_data + security_domain: endpoint + impact: 90 + confidence: 100 + risk_score: 90 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/etw_registry_disabled.test.yml b/tests/endpoint/etw_registry_disabled.test.yml new file mode 100644 index 0000000000..4decd04292 --- /dev/null +++ b/tests/endpoint/etw_registry_disabled.test.yml @@ -0,0 +1,12 @@ +name: ETW Registry Disabled Unit Test +tests: +- name: ETW Registry Disabled + file: endpoint/etw_registry_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 393aad02aa6c5c115517751408162570662d83f9 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 8 Oct 2021 07:55:48 +0000 Subject: [PATCH 47/58] Added detection testing service results inETW Registry Disabled --- detections/endpoint/etw_registry_disabled.yml | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 55bd67bb4e..f275ee28c4 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -6,22 +6,22 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a registry modification to disable ETW feature of windows. - This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +description: This analytic is to detect a registry modification to disable ETW feature + of windows. This technique is to evade EDR appliance to evade detections and hide + its execution from audit logs. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") + max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `etw_registry_disabled_filter`' + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 +- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 tags: analytic_story: - Windows Persistence Techniques @@ -62,4 +62,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 5226dbd99c5fbe87f7ef631f539bf0531cbaa181 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 8 Oct 2021 14:23:55 +0200 Subject: [PATCH 48/58] privilege_escalation_persistence --- .../endpoint/print_processor_registry_autostart.yml | 0 tests/endpoint/print_processor_registry_autostart.test.yml | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename detections/{ => experimental}/endpoint/print_processor_registry_autostart.yml (100%) diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/experimental/endpoint/print_processor_registry_autostart.yml similarity index 100% rename from detections/endpoint/print_processor_registry_autostart.yml rename to detections/experimental/endpoint/print_processor_registry_autostart.yml diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index c32f529f1b..0a7ef8f35f 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -1,7 +1,7 @@ name: Print Processor Registry Autostart Unit Test tests: - name: Print Processor Registry Autostart - file: endpoint/print_processor_registry_autostart.yml + file: experimental/endpoint/print_processor_registry_autostart.yml pass_condition: '| stats count | where count > 0' earliest_time: '-365d' latest_time: 'now' From f6804d708ba47507414e437ffb6167a9e40769ec Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 8 Oct 2021 12:33:23 -0600 Subject: [PATCH 49/58] Fixes and removed duplicate --- .../active_setup_registry_autostart.yml | 6 +- ...le_security_logs_using_minint_registry.yml | 21 ++++--- ...le_wdigest_uselogoncredential_registry.yml | 10 +-- detections/endpoint/etw_registry_disabled.yml | 10 +-- .../logon_script_event_trigger_execution.yml | 3 +- ...d_suspicious_spawned_by_script_process.yml | 16 +++-- .../endpoint/powershell_reflective_load.yml | 61 ------------------- .../regsvr32_silent_param_dll_loading.yml | 5 +- .../endpoint/rundll32_shimcache_flush.yml | 17 +++--- .../sdelete_application_execution.yml | 19 +++--- .../endpoint/suspicious_copy_on_system32.yml | 19 +++--- .../vbscript_execution_using_wscript_app.yml | 19 +++--- .../endpoint/verclsid_clsid_execution.yml | 22 ++++--- ...pt_or_cscript_suspicious_child_process.yml | 16 +++-- 14 files changed, 100 insertions(+), 144 deletions(-) delete mode 100644 detections/endpoint/powershell_reflective_load.yml diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index b90601b450..11492c7e1a 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -19,13 +19,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`' -how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting +how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes - to the registry.TO_IMPLEMENT -known_false_positives: active setup installer may add or modify this registry + to the registry. +known_false_positives: Active setup installer may add or modify this registry. references: - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E - https://attack.mitre.org/techniques/T1547/014/ diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 11f3ccaf5a..b73414b69a 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: THis analytic is to detect a suspicious registry modification to disable +description: This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log @@ -15,8 +15,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: Unknown. references: - https://twitter.com/0gtweet/status/1182516740955226112 tags: @@ -47,14 +52,14 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - message: wdigest registry $registry_path$ was added in $dest$ + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ observable: - - name: user - type: User - role: - - Victim - name: dest type: Hostname role: - Victim + - name: user + type: user + role: + - Victim automated_detection_testing: passed diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index d72f368b88..9f23806bae 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -17,10 +17,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. known_false_positives: unknown references: - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index f275ee28c4..c129367c35 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -15,10 +15,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. known_false_positives: unknown references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index d27bdca08a..e881970354 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -9,8 +9,7 @@ datamodel: description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript - registry entry to its malicious payload to be executed upon boot up of the machine - since this is a + registry entry to its malicious payload to be executed upon boot up of the machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index a8165b8d65..d0687e4c57 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -6,11 +6,12 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious msbuild process by MS scripting - process. This behavior or event are commonly seen and used by malware or adversaries +description: This analytic is to detect a suspicious child process of MSBuild + spawned by Windows Script Host - cscript or wscript. + This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. - This behavior is not common and can be a good indicator to start checking the content - of the script that execute the said msbuild process. + During triage, review parallel processes and identify any file modifications. MSBuild + may load a script from the same path without having command-line arguments. search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name @@ -18,11 +19,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited as developers do not spawn MSBuild via a WSH. references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml deleted file mode 100644 index ae5a966426..0000000000 --- a/detections/endpoint/powershell_reflective_load.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Powershell Reflective Load -id: 8aa0d0a2-24f4-11ec-b77a-acde48001122 -version: 1 -date: '2021-10-04' -author: Teoderick Contreras, Splunk -type: TTP -datamodel: -- Endpoint -description: This analytic is to detect a suspicious powershell loading a dll or executable - using reflective load function. this technique is commonly seen in file less malware - where it download a file and directly load the downloaded file that are place in - a stream memory to execute it. this TTP is a good indicator to check the powershell - that execute and what file or stream it execute. -search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_reflective_load_filter`' -how_to_implement: o successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: third party powershell may use this function to execute binary. -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# -tags: - analytic_story: - - Malicious PowerShell - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1059.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - Message - - ComputerName - - User - security_domain: endpoint - impact: 70 - confidence: 70 - risk_score: 49 - context: - - source:endpoint - - stage: Defense Evasion - message: a powershell that execute binary using reflective load in command $Message$ - in $ComputerName$ - observable: - - name: ComputerName - type: Hostname - role: - - Victim - - name: User - type: User - role: - - Victim - automated_detection_testing: passed diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_param_dll_loading.yml index c9d0d3b0cc..d27c7425aa 100644 --- a/detections/endpoint/regsvr32_silent_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_param_dll_loading.yml @@ -22,10 +22,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: other third part application may used this parameter but not - so common in base windows environment +known_false_positives: Other third part application may used this parameter but not + so common in base windows environment. references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://attack.mitre.org/techniques/T1218/010/ tags: analytic_story: - Suspicious Regsvr32 Activity diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index fccda13479..d4e0993b51 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -14,13 +14,10 @@ description: This analytic is to detect a suspicious rundll32 commandline to cle search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: unknown references: - https://blueteamops.medium.com/shimcache-flush-89daff28d15e @@ -41,10 +38,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint impact: 80 diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 02de52dbf9..0ded4ef8bc 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -19,10 +19,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.dest Processes.user Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdelete_application_execution_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: user may execute and use this application references: - https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ @@ -42,13 +39,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index fce0614870..3eb05fde0f 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -6,22 +6,19 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this analytic is to detect a suspicious copy of file from systemroot +description: This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", + IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: every user may do this event but very un-ussual. references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 @@ -42,10 +39,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint impact: 70 diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 9abcbf230d..5cb1e55d97 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -18,10 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: unknown references: - https://www.joesandbox.com/analysis/369332/0/html @@ -41,13 +38,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 5144212fd7..556ef2e416 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -19,12 +19,9 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.dest Processes.user Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: windows can used this application for its normal COm object - validation +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: windows can used this application for its normal COM object + validation. references: - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ @@ -43,12 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.original_file_name - Processes.dest - Processes.user - - Processes.parent_process_name - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 50 confidence: 50 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index b1783cbfbb..1d680f7db2 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -47,13 +47,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 70 @@ -61,7 +65,7 @@ tags: context: - Source:Endpoint - Stage:Execution - message: wscript or cscript parent process spawned $process_name$ in $dest$ + message: wscript or cscript parent process spawned $process_name$ in $dest$ observable: - name: dest type: Endpoint From 69d72deb158c03bf2d0084e66e4dc96453bec317 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 8 Oct 2021 12:37:20 -0600 Subject: [PATCH 50/58] Delete powershell_reflective_load.test.yml --- tests/endpoint/powershell_reflective_load.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/powershell_reflective_load.test.yml diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml deleted file mode 100644 index 167a524ebc..0000000000 --- a/tests/endpoint/powershell_reflective_load.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Powershell Reflective Load Unit Test -tests: -- name: Powershell Reflective Load - file: endpoint/powershell_reflective_load.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file From 8a1bed2fb9c8150baad8163fa8cc3aa3c463b44b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 11 Oct 2021 11:03:20 +0200 Subject: [PATCH 51/58] CARS_UPDATE_MITRE_ID_B1 --- .../abnormally_high_number_of_cloud_infrastructure_api_calls.yml | 1 + .../abnormally_high_number_of_cloud_security_group_api_calls.yml | 1 + .../cloud/aws_create_policy_version_to_allow_all_resources.yml | 1 + detections/cloud/aws_createaccesskey.yml | 1 + detections/cloud/aws_createloginprofile.yml | 1 + detections/cloud/aws_ecr_container_scanning_findings_high.yml | 1 + ...ecr_container_scanning_findings_low_informational_unknown.yml | 1 + detections/cloud/aws_ecr_container_scanning_findings_medium.yml | 1 + .../cloud/aws_ecr_container_upload_outside_business_hours.yml | 1 + detections/cloud/aws_ecr_container_upload_unknown_user.yml | 1 + detections/cloud/aws_iam_successful_group_deletion.yml | 1 + ...s_network_access_control_list_created_with_all_open_ports.yml | 1 + detections/cloud/aws_network_access_control_list_deleted.yml | 1 + detections/cloud/aws_setdefaultpolicyversion.yml | 1 + detections/cloud/aws_updateloginprofile.yml | 1 + .../cloud_compute_instance_created_by_previously_unseen_user.yml | 1 + .../cloud_instance_modified_with_previously_unseen_user.yml | 1 + detections/cloud/correlation_by_repository_and_risk.yml | 1 + detections/cloud/correlation_by_user_and_risk.yml | 1 + detections/cloud/github_dependabot_alert.yml | 1 + detections/cloud/github_pull_request_from_unknown_user.yml | 1 + detections/cloud/gsuite_drive_share_in_external_email.yml | 1 + detections/cloud/gsuite_email_suspicious_attachment.yml | 1 + .../cloud/gsuite_email_suspicious_subject_with_attachment.yml | 1 + .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 1 + .../gsuite_outbound_email_with_attachment_to_external_domain.yml | 1 + detections/cloud/gsuite_suspicious_shared_file_name.yml | 1 + detections/cloud/o365_add_app_role_assignment_grant_user.yml | 1 + detections/cloud/o365_added_service_principal.yml | 1 + detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 1 + detections/cloud/o365_new_federated_domain_added.yml | 1 + detections/cloud/o365_suspicious_admin_email_forwarding.yml | 1 + detections/cloud/o365_suspicious_rights_delegation.yml | 1 + detections/cloud/o365_suspicious_user_email_forwarding.yml | 1 + 34 files changed, 34 insertions(+) diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 0d15635152..71e463fbf9 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -44,6 +44,7 @@ tags: of $expected_upper_threshold$ with the following command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 2b216b747e..1228ec4926 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -49,6 +49,7 @@ tags: command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index eeda62b531..931bf81982 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -46,6 +46,7 @@ tags: in their account mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index ed140d24b7..5c2276390f 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -43,6 +43,7 @@ tags: from this IP $src$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index b537158602..5a203a77d8 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -46,6 +46,7 @@ tags: and did a console login from this IP $src_ip$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index e7eca8106c..9a9eeb3114 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -37,6 +37,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index f6c36e1a8a..2baabc0834 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -36,6 +36,7 @@ tags: message: Vulnerabilities with severity high found in repository $repositoryName$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index eda8bdae60..755368af77 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -35,6 +35,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 2d193b4d16..e64f1de95b 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded outside business hours from $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index 0e15c5211e..82d4fd850e 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded from unknown user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 6efc567d1d..c39a47fc4d 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -42,6 +42,7 @@ tags: mitre_attack_id: - T1069.003 - T1098 + - T1069 observable: - name: src type: IP Address diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index a7059316a2..028c55621a 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -46,6 +46,7 @@ tags: CIDR $requestParameters.cidrBlock$ mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 55634ba086..5a09c419bf 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -41,6 +41,7 @@ tags: $eventName$), such that the instance is accessible from anywhere mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 546333f7e9..6f90e57391 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -45,6 +45,7 @@ tags: event $eventName$ for updating the the default policy version mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 2d6d80437e..0c7fd9c7b2 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -39,6 +39,7 @@ tags: user $user_arn$ more access privilleges mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index f70c6e911a..43c8ea2de0 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is creating a new instance $dest$ for the first time mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 185d54b516..f05c111905 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is modifying an instance $dest$ for the first time. mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index 78763720ca..8cae1eaf2f 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index 6cbb1f0832..220dcb76c1 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 4294037188..0ac8b391b0 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 3f4235831b..82025ef1a6 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index b451a2c38f..7ce9b0e3bd 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -41,6 +41,7 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1567.002 + - T1567 observable: - name: parameters.owner type: User diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 664b291d70..5bf5875a1f 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -41,6 +41,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index be34394965..43da966e82 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -49,6 +49,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index aaf6b6cf5f..9ed9c63dd0 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index d4e3964783..c3792b9f3f 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1048.003 + - T1048 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 65c240346c..13bb20d2aa 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -46,6 +46,7 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: parameters.owner type: User diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 577c75383a..731f801395 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -41,6 +41,7 @@ tags: Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index ea17167487..6bcfb6259b 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -44,6 +44,7 @@ tags: service principal credentials from IP Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index 1fc40093a1..4a9a8ef9ea 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -45,6 +45,7 @@ tags: list of trusted IPs to bypass MFA mitre_attack_id: - T1562.007 + - T1562 observable: - name: ip_addresses_new_added type: IP Address diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 5984dfc60d..7a416e6f60 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -44,6 +44,7 @@ tags: $OrganizationName$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: OrganizationName type: Other diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 82746f0989..cbb85e57e6 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -39,6 +39,7 @@ tags: the same destination $ForwardingAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 06d05f296e..be8f002199 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -38,6 +38,7 @@ tags: that allow access to sensitive mitre_attack_id: - T1114.002 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 9a7276d8b6..7644ef34f2 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -39,6 +39,7 @@ tags: a forwarding rule to same destination $ForwardingSmtpAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE From cd46d4cf61a0c201112a70271f601b0baefae1bd Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 11 Oct 2021 11:05:34 +0200 Subject: [PATCH 52/58] Delete screensaver_event_trigger_execution.yml --- .../screensaver_event_trigger_execution.yml | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 detections/endpoint/screensaver_event_trigger_execution.yml diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml deleted file mode 100644 index dd457c5f95..0000000000 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Screensaver Event Trigger Execution -id: 58cea3ec-1f6d-11ec-8560-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -type: TTP -datamodel: -- Endpoint -description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification. - This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution - to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `screensaver_event_trigger_execution_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1546/002/ -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1546.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - security_domain: endpoint - impact: 80 - confidence: 90 - # (impact * confidence)/100 - risk_score: 72 - context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: user - role: - - Victim - \ No newline at end of file From e564e5a9f2651115f355be698f764f0bac8892e6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 11 Oct 2021 11:05:42 +0200 Subject: [PATCH 53/58] Delete screensaver_event_trigger_execution.test.yml --- .../screensaver_event_trigger_execution.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/screensaver_event_trigger_execution.test.yml diff --git a/tests/endpoint/screensaver_event_trigger_execution.test.yml b/tests/endpoint/screensaver_event_trigger_execution.test.yml deleted file mode 100644 index 4e398660f6..0000000000 --- a/tests/endpoint/screensaver_event_trigger_execution.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Screensaver Event Trigger Execution Unit Test -tests: -- name: Screensaver Event Trigger Execution - file: endpoint/screensaver_event_trigger_execution.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From 95ad76f9bafedecb10928aedf9c92eb8c87dc13f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 11 Oct 2021 12:17:40 -0600 Subject: [PATCH 54/58] Update suspicious_wevtutil_usage.yml Resolving #1669 . Thank you! --- .../endpoint/suspicious_wevtutil_usage.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 61f5a11927..4c32b8f3d4 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,18 +1,18 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 3 -date: '2020-07-22' -author: David Dorsey, Splunk +version: 4 +date: '2021-10-11' +author: David Dorsey, Michael Haag, Splunk type: TTP datamodel: - Endpoint description: The wevtutil.exe application is the windows event log utility. This searches - for wevtutil.exe with parameters for clearing the application, security, setup, + for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = wevtutil.exe Processes.process="*cl*" (Processes.process="*System*" - OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*") + where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") (Processes.process="*System*" + OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter`' @@ -23,13 +23,13 @@ how_to_implement: You must be ingesting data that records process activity from model. known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md tags: analytic_story: - Windows Log Manipulation - Ransomware - Clop Ransomware - asset_type: '' automated_detection_testing: passed cis20: - CIS 3 From d2719d316e4327d3b36da1befe53338056044e30 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Oct 2021 11:12:12 +0200 Subject: [PATCH 55/58] Update gsuite_drive_share_in_external_email.yml --- detections/cloud/gsuite_drive_share_in_external_email.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 7ce9b0e3bd..552014e94a 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -67,3 +67,4 @@ tags: - parameters.doc_type risk_score: 72 security_domain: endpoint + From 7dbacd0674077ab57a6ae6f317dd0dbc580f5093 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Oct 2021 13:02:16 -0700 Subject: [PATCH 56/58] errors and text updates --- detections/cloud/github_commit_changes_in_master.yml | 2 +- detections/cloud/github_commit_in_develop.yml | 2 +- detections/cloud/gsuite_drive_share_in_external_email.yml | 8 +++----- detections/cloud/gsuite_email_suspicious_attachment.yml | 2 +- .../gsuite_email_suspicious_subject_with_attachment.yml | 2 +- .../gsuite_email_with_known_abuse_web_service_link.yml | 2 +- ..._outbound_email_with_attachment_to_external_domain.yml | 2 +- detections/cloud/gsuite_suspicious_shared_file_name.yml | 4 ++-- 8 files changed, 11 insertions(+), 13 deletions(-) diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 8b6d910d1e..9475fcad55 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -23,7 +23,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml index 85c5cf21f8..e069f8de60 100644 --- a/detections/cloud/github_commit_in_develop.yml +++ b/detections/cloud/github_commit_in_develop.yml @@ -22,7 +22,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index b451a2c38f..28b9e83f44 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -19,22 +19,20 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner | `gsuite_drive_share_in_external_email_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: network admin or normal user may share files to customer and external team. references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 90 context: - Source:Endpoint - Stage:Reconnaissance dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log - deployments: - - Send to Phantom impact: 80 kill_chain_phases: - Exfiltration @@ -45,7 +43,7 @@ tags: - name: parameters.owner type: User role: - - attacker + - Attacker - name: email type: User role: diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 664b291d70..b2a236dbda 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -28,7 +28,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 70 context: - Source:Endpoint diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index be34394965..b7177c13e3 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -35,7 +35,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index aaf6b6cf5f..7db1ebb558 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -26,7 +26,7 @@ references: - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index d4e3964783..f7b8d47b1f 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -27,7 +27,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 30 context: - Source:Endpoint diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 65c240346c..e50926bc6a 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit | `gsuite_suspicious_shared_file_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: normal user or normal transaction may contain the subject and file type attachment that this detection try to search references: @@ -32,7 +32,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 70 context: From 05972240f4ee88e20826c3c455392a9bf97d915b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Oct 2021 13:03:43 -0700 Subject: [PATCH 57/58] story name --- stories/dev_sec_ops.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/dev_sec_ops.yml b/stories/dev_sec_ops.yml index e800aef9d9..b7008f38b2 100644 --- a/stories/dev_sec_ops.yml +++ b/stories/dev_sec_ops.yml @@ -14,7 +14,7 @@ narrative: DevSecOps is a collaborative framework, which thinks about applicatio references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: - analytic_story: DevSecOps + analytic_story: Dev Sec Ops category: - Cloud Security product: From f67ee09979f0162b971785218100db98aa8630c3 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 12 Oct 2021 13:08:33 -0700 Subject: [PATCH 58/58] revert deployments: - Send to Phantom --- detections/cloud/gsuite_drive_share_in_external_email.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 28b9e83f44..8d8d37bef2 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -33,6 +33,8 @@ tags: - Stage:Reconnaissance dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log + deployments: + - Send to Phantom impact: 80 kill_chain_phases: - Exfiltration