From 7a4e594ef1bf76a0a269d716307d274dede881c8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 4 Jan 2023 14:21:58 -0800 Subject: [PATCH 1/2] carried over changes --- .../endpoint/account_discovery_with_net_app.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index d22b22d34f..bc649ee263 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -1,12 +1,12 @@ name: Account Discovery With Net App id: 339805ce-ac30-11eb-b87d-acde48001122 -version: 3 -date: '2021-09-16' -author: Teoderick Contreras, Splunk +version: 4 +date: '2023-01-04' +author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community type: TTP datamodel: - Endpoint -description: this search is to detect a potential account discovery series of command +description: This search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series @@ -16,7 +16,7 @@ description: this search is to detect a potential account discovery series of co search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND (Processes.process="*user*" OR Processes.process="*config*" + where `process_net` AND (Processes.process="* user *" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`' @@ -81,4 +81,4 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon - asset_type: Endpoint + asset_type: Endpoint \ No newline at end of file From 8db65681c90ee86e97d51f66c99ff4cbb53c55a8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 4 Jan 2023 16:55:43 -0800 Subject: [PATCH 2/2] minorupdate --- detections/endpoint/account_discovery_with_net_app.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index bc649ee263..3693116f45 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -18,14 +18,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="* user *" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user - Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` + Processes.parent_process_name | where count >=4 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.. -known_false_positives: admin or power user may used this series of command. +known_false_positives: Admin or power user may used this series of command. references: - https://labs.vipre.com/trickbot-and-its-modules/ - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/