admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-07-11 13:18:20 -07:00
committed by GitHub
parent eff909fb5e ca60c3b4f6
commit d88ddff761
10 changed files with 67 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/mshtml_module_load_in_office_product.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: MSHTML Module Load in Office Product
id: 5f1c168e-118b-11ec-84ff-acde48001122
version: 5
date: '2023-02-15'
version: 6
date: '2023-07-11'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: TTP
@@ -13,7 +13,7 @@ description: The following detection identifies the module load of mshtml.dll in
data_source:
- Sysmon Event ID 7
search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
"msaccess.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
"msaccess.exe","Graph.exe","winproj.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
@@ -30,6 +30,7 @@ tags:
analytic_story:
- Spearphishing Attachments
- Microsoft MSHTML Remote Code Execution CVE-2021-40444
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 100
cve:
detections/endpoint/office_document_spawned_child_process_to_download.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Document Spawned Child Process To Download
id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
version: 5
date: '2023-02-15'
version: 6
date: '2023-07-11'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -13,7 +13,7 @@ data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe")
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe")
Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe",
"chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
@@ -31,6 +31,7 @@ references:
tags:
analytic_story:
- Spearphishing Attachments
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 50
impact: 70
detections/endpoint/office_product_spawn_cmd_process.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawn CMD Process
id: b8b19420-e892-11eb-9244-acde48001122
version: 4
date: '2022-02-15'
version: 5
date: '2023-07-11'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
= "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
= "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe" OR Processes.parent_process_name
= "onenotem.exe" OR Processes.parent_process_name = "onenoteviewer.exe" OR Processes.parent_process_name
= "onenoteim.exe" OR Processes.parent_process_name = "msaccess.exe") `process_cmd`
= "onenoteim.exe" OR Processes.parent_process_name = "msaccess.exe" OR Processes.parent_process_name="Graph.exe" OR Processes.parent_process_name="winproj.exe") `process_cmd`
by Processes.parent_process Processes.process_name Processes.process Processes.process_id
Processes.process_guid Processes.user Processes.dest Processes.original_file_name
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
@@ -43,6 +43,7 @@ tags:
- Qakbot
- AgentTesla
- CVE-2023-21716 Word RTF Heap Corruption
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 80
impact: 70
detections/endpoint/office_product_spawning_bitsadmin.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning BITSAdmin
id: e8c591f4-a6d7-11eb-8cf7-acde48001122
version: 4
date: '2023-02-15'
version: 5
date: '2023-07-11'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -21,7 +21,7 @@ data_source:
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
"msaccess.exe") `process_bitsadmin` by Processes.dest Processes.user Processes.parent_process
"msaccess.exe", "Graph.exe","winproj.exe") `process_bitsadmin` by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.original_file_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`'
@@ -37,6 +37,7 @@ references:
tags:
analytic_story:
- Spearphishing Attachments
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 90
impact: 70
detections/endpoint/office_product_spawning_certutil.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning CertUtil
id: 6925fe72-a6d5-11eb-9e17-acde48001122
version: 4
date: '2023-02-15'
version: 5
date: '2023-07-11'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -19,7 +19,7 @@ data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe")
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe")
`process_certutil` by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
@@ -39,6 +39,7 @@ tags:
- Spearphishing Attachments
- AgentTesla
- Trickbot
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 90
impact: 70
detections/endpoint/office_product_spawning_mshta.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning MSHTA
id: 6078fa20-a6d2-11eb-b662-acde48001122
version: 3
date: '2023-02-15'
version: 4
date: '2023-07-11'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -20,7 +20,7 @@ data_source:
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe", "onenote.exe","onenotem.exe",
"msaccess.exe") `process_mshta` by Processes.dest Processes.user Processes.parent_process
"msaccess.exe","Graph.exe","winproj.exe") `process_mshta` by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.original_file_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`'
@@ -37,6 +37,7 @@ tags:
- Spearphishing Attachments
- IcedID
- Azorult
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 90
impact: 70
detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning Rundll32 with no DLL
id: c661f6be-a38c-11eb-be57-acde48001122
version: 4
date: '2023-02-15'
version: 5
date: '2023-07-11'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -20,7 +20,7 @@ data_source:
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
"msaccess.exe") `process_rundll32` (Processes.process!=*.dll*) by Processes.dest
"msaccess.exe", "Graph.exe","winproj.exe") `process_rundll32` (Processes.process!=*.dll*) by Processes.dest
Processes.user Processes.parent_process Processes.process_name Processes.process
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_rundll32_with_no_dll_filter`'
@@ -38,6 +38,7 @@ references:
tags:
analytic_story:
- Spearphishing Attachments
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 90
impact: 70
detections/endpoint/office_product_spawning_windows_script_host.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning Windows Script Host
id: b3628a5b-8d02-42fa-a891-eebf2351cbe1
version: 3
date: '2023-02-15'
version: 4
date: '2023-07-11'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -13,7 +13,7 @@ data_source:
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
"msaccess.exe") Processes.process_name IN ("wscript.exe", "cscript.exe") by Processes.dest
"msaccess.exe","Graph.exe","winproj.exe") Processes.process_name IN ("wscript.exe", "cscript.exe") by Processes.dest
Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_windows_script_host_filter`'
@@ -32,6 +32,7 @@ tags:
analytic_story:
- Spearphishing Attachments
- Remcos
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 90
impact: 70
detections/endpoint/office_product_spawning_wmic.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Office Product Spawning Wmic
id: ffc236d6-a6c9-11eb-95f1-acde48001122
version: 5
date: '2023-02-15'
version: 6
date: '2023-07-11'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -19,7 +19,7 @@ data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe")
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe")
`process_wmic` by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
@@ -39,6 +39,7 @@ tags:
analytic_story:
- Spearphishing Attachments
- FIN7
- CVE-2023-36884 Office and Windows HTML RCE Vulnerability
asset_type: Endpoint
confidence: 90
impact: 70
stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml
+31
View File
@@ -0,0 +1,31 @@
name: CVE-2023-36884 Office and Windows HTML RCE Vulnerability
id: dd7fb691-63d6-47ad-9a7f-1b9005cefad2
version: 1
date: '2023-07-11'
author: Michael Haag, Splunk
description: CVE-2023-36884 is an unpatched zero-day vulnerability affecting Windows and Microsoft Office products. The vulnerability allows for remote code execution through specially crafted Microsoft Office documents, enabling an attacker to operate in the context of the victim. As of now, there are no security updates available. However, users of Microsoft Defender for Office and the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are safeguarded against this exploit. For other users, temporary mitigation can be achieved by adding specific application names to a designated registry key.
narrative: CVE-2023-36884 is a serious security vulnerability that affects a range of Microsoft Office products and Windows systems. It is a zero-day flaw, meaning it was already being exploited before Microsoft became aware of it or had a chance to develop a patch. \
An attacker exploiting this vulnerability would create a Microsoft Office document containing malicious code. This document, when opened by the victim, allows for remote code execution, giving the attacker the ability to run their own code on the victim's machine. This poses a significant risk as the attacker could perform actions like data theft, system damage, or creating backdoors for future access. \
Currently, there is no security patch available from Microsoft, which makes the issue more critical. Microsoft is working on investigating these vulnerabilities and will likely provide a security update either through their monthly release cycle or an out-of-cycle update, based on the urgency. \
In the meantime, users of Microsoft Defender for Office and those utilizing the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are protected from attempts to exploit this vulnerability. This is because these protections add an extra layer of security, blocking the malicious code from executing. \
For users who are not using these protections, Microsoft recommends a workaround by adding specific application names to a particular Windows registry key (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION) with data set as "1". This action aims to mitigate the risk until a permanent fix is available. \
The disclosure of this flaw involved multiple entities including Microsoft Threat Intelligence, Vlad Stolyarov, Clement Lecigne and Bahare Sabouri from Google's Threat Analysis Group (TAG), Paul Rascagneres and Tom Lancaster from Volexity, and the Microsoft Office Product Group Security Team. This collective effort indicates the severity and importance of addressing this issue.
references:
- https://gist.github.com/MHaggis/22ad19081300493e70ce0b873e98b2d0
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
- https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2023-patch-tuesday-warns-of-6-zero-days-132-flaws/
- https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/
tags:
analytic_story: CVE-2023-36884 Office and Windows HTML RCE Vulnerability
category:
- Adversary Tactics
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
usecase: Advanced Threat Detection